lkml.org 
[lkml]   [2020]   [Dec]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    Date
    SubjectRe: [PATCH v2 03/10] ovl: check privs before decoding file handle
    On Mon, Dec 7, 2020 at 6:36 PM Miklos Szeredi <mszeredi@redhat.com> wrote:
    >
    > CAP_DAC_READ_SEARCH is required by open_by_handle_at(2) so check it in
    > ovl_decode_real_fh() as well to prevent privilege escalation for
    > unprivileged overlay mounts.
    >
    > Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
    > ---
    > fs/overlayfs/namei.c | 3 +++
    > 1 file changed, 3 insertions(+)
    >
    > diff --git a/fs/overlayfs/namei.c b/fs/overlayfs/namei.c
    > index a6162c4076db..82a55fdb1e7a 100644
    > --- a/fs/overlayfs/namei.c
    > +++ b/fs/overlayfs/namei.c
    > @@ -156,6 +156,9 @@ struct dentry *ovl_decode_real_fh(struct ovl_fh *fh, struct vfsmount *mnt,
    > struct dentry *real;
    > int bytes;
    >
    > + if (!capable(CAP_DAC_READ_SEARCH))
    > + return NULL;
    > +

    If the mounter is not capable in init ns, ovl_check_origin() and
    ovl_verify_index()
    will not function as expected and this will break index and nfs export features.
    So I think we need to also check capability in ovl_can_decode_fh(), to auto
    disable those features.

    Thanks,
    Amir.

    \
     
     \ /
      Last update: 2020-12-08 14:50    [W:4.170 / U:0.020 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site