openkylin
/
linux
mirror of https://gitee.com/openkylin/linux.git
9
0
Fork 0
Code Issues Projects Releases Wiki Activity

ovl: check privs before decoding file handle 

CAP_DAC_READ_SEARCH is required by open_by_handle_at(2) so check it in
ovl_decode_real_fh() as well to prevent privilege escalation for
unprivileged overlay mounts.

[Amir] If the mounter is not capable in init ns, ovl_check_origin() and
ovl_verify_index() will not function as expected and this will break index
and nfs export features.  So check capability in ovl_can_decode_fh(), to
auto disable those features.

Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
This commit is contained in:
Miklos Szeredi 2020-12-14 15:26:14 +01:00
parent 3078d85c9a
commit c846af050f
2 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
fs/overlayfs/namei.c
View File

@ -156,6 +156,9 @@ struct dentry *ovl_decode_real_fh(struct ovl_fs *ofs, struct ovl_fh *fh,
struct dentry *real; struct dentry *real;
int bytes; int bytes;
if (!capable(CAP_DAC_READ_SEARCH))
return NULL;
/* /*
* Make sure that the stored uuid matches the uuid of the lower * Make sure that the stored uuid matches the uuid of the lower
* layer where file handle will be decoded. * layer where file handle will be decoded.

3
fs/overlayfs/util.c
View File

@ -50,6 +50,9 @@ const struct cred *ovl_override_creds(struct super_block *sb)
*/ */
int ovl_can_decode_fh(struct super_block *sb) int ovl_can_decode_fh(struct super_block *sb)
{ {
if (!capable(CAP_DAC_READ_SEARCH))
return 0;
if (!sb->s_export_op || !sb->s_export_op->fh_to_dentry) if (!sb->s_export_op || !sb->s_export_op->fh_to_dentry)
return 0; return 0;