lkml.org 
[lkml]   [2020]   [Sep]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.19 63/78] rbd: require global CAP_SYS_ADMIN for mapping and unmapping
    Date
    From: Ilya Dryomov <idryomov@gmail.com>

    commit f44d04e696feaf13d192d942c4f14ad2e117065a upstream.

    It turns out that currently we rely only on sysfs attribute
    permissions:

    $ ll /sys/bus/rbd/{add*,remove*}
    --w------- 1 root root 4096 Sep 3 20:37 /sys/bus/rbd/add
    --w------- 1 root root 4096 Sep 3 20:37 /sys/bus/rbd/add_single_major
    --w------- 1 root root 4096 Sep 3 20:37 /sys/bus/rbd/remove
    --w------- 1 root root 4096 Sep 3 20:38 /sys/bus/rbd/remove_single_major

    This means that images can be mapped and unmapped (i.e. block devices
    can be created and deleted) by a UID 0 process even after it drops all
    privileges or by any process with CAP_DAC_OVERRIDE in its user namespace
    as long as UID 0 is mapped into that user namespace.

    Be consistent with other virtual block devices (loop, nbd, dm, md, etc)
    and require CAP_SYS_ADMIN in the initial user namespace for mapping and
    unmapping, and also for dumping the configuration string and refreshing
    the image header.

    Cc: stable@vger.kernel.org
    Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
    Reviewed-by: Jeff Layton <jlayton@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/block/rbd.c | 12 ++++++++++++
    1 file changed, 12 insertions(+)

    --- a/drivers/block/rbd.c
    +++ b/drivers/block/rbd.c
    @@ -4124,6 +4124,9 @@ static ssize_t rbd_config_info_show(stru
    {
    struct rbd_device *rbd_dev = dev_to_rbd_dev(dev);

    + if (!capable(CAP_SYS_ADMIN))
    + return -EPERM;
    +
    return sprintf(buf, "%s\n", rbd_dev->config_info);
    }

    @@ -4235,6 +4238,9 @@ static ssize_t rbd_image_refresh(struct
    struct rbd_device *rbd_dev = dev_to_rbd_dev(dev);
    int ret;

    + if (!capable(CAP_SYS_ADMIN))
    + return -EPERM;
    +
    ret = rbd_dev_refresh(rbd_dev);
    if (ret)
    return ret;
    @@ -5846,6 +5852,9 @@ static ssize_t do_rbd_add(struct bus_typ
    struct rbd_client *rbdc;
    int rc;

    + if (!capable(CAP_SYS_ADMIN))
    + return -EPERM;
    +
    if (!try_module_get(THIS_MODULE))
    return -ENODEV;

    @@ -5995,6 +6004,9 @@ static ssize_t do_rbd_remove(struct bus_
    bool force = false;
    int ret;

    + if (!capable(CAP_SYS_ADMIN))
    + return -EPERM;
    +
    dev_id = -1;
    opt_buf[0] = '\0';
    sscanf(buf, "%d %5s", &dev_id, opt_buf);

    \
     
     \ /
      Last update: 2020-09-16 02:19    [W:3.789 / U:0.988 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site