Messages in this thread | | | From | Amir Goldstein <> | Date | Tue, 8 Dec 2020 15:49:25 +0200 | Subject | Re: [PATCH v2 03/10] ovl: check privs before decoding file handle |
| |
On Mon, Dec 7, 2020 at 6:36 PM Miklos Szeredi <mszeredi@redhat.com> wrote: > > CAP_DAC_READ_SEARCH is required by open_by_handle_at(2) so check it in > ovl_decode_real_fh() as well to prevent privilege escalation for > unprivileged overlay mounts. > > Signed-off-by: Miklos Szeredi <mszeredi@redhat.com> > --- > fs/overlayfs/namei.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/fs/overlayfs/namei.c b/fs/overlayfs/namei.c > index a6162c4076db..82a55fdb1e7a 100644 > --- a/fs/overlayfs/namei.c > +++ b/fs/overlayfs/namei.c > @@ -156,6 +156,9 @@ struct dentry *ovl_decode_real_fh(struct ovl_fh *fh, struct vfsmount *mnt, > struct dentry *real; > int bytes; > > + if (!capable(CAP_DAC_READ_SEARCH)) > + return NULL; > +
If the mounter is not capable in init ns, ovl_check_origin() and ovl_verify_index() will not function as expected and this will break index and nfs export features. So I think we need to also check capability in ovl_can_decode_fh(), to auto disable those features.
Thanks, Amir.
| |