linux-kernel - Re: [PATCH] ovl: fix uid/gid when creating over whiteout

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Wed, 15 Jun 2016 10:20:59 -0400
From:	Vivek Goyal <vgoyal@...hat.com>
To:	Miklos Szeredi <miklos@...redi.hu>
Cc:	Stephen Smalley <sds@...ho.nsa.gov>,
	"linux-unionfs@...r.kernel.org" <linux-unionfs@...r.kernel.org>,
	linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] ovl: fix uid/gid when creating over whiteout

On Wed, Jun 15, 2016 at 04:09:47PM +0200, Miklos Szeredi wrote:
> On Wed, Jun 15, 2016 at 4:01 PM, Vivek Goyal <vgoyal@...hat.com> wrote:
> > On Wed, Jun 15, 2016 at 03:30:02PM +0200, Miklos Szeredi wrote:
> 
> >> --- a/fs/overlayfs/dir.c
> >> +++ b/fs/overlayfs/dir.c
> >> @@ -405,12 +405,21 @@ static int ovl_create_or_link(struct den
> >>               err = ovl_create_upper(dentry, inode, &stat, link, hardlink);
> >>       } else {
> >>               const struct cred *old_cred;
> >> +             struct cred *override_cred;
> >>
> >>               old_cred = ovl_override_creds(dentry->d_sb);
> >>
> >> -             err = ovl_create_over_whiteout(dentry, inode, &stat, link,
> >> -                                            hardlink);
> >> +             err = -ENOMEM;
> >> +             override_cred = prepare_creds();
> >> +             if (override_cred) {
> >> +                     override_cred->fsuid = old_cred->fsuid;
> >> +                     override_cred->fsgid = old_cred->fsgid;
> >
> > Hi Miklos,
> >
> > I am wondering if we are switching to tasks's ->fsuid and ->fsgid too
> > early. ovl_create_over_whiteout() calls ovl_lookup_temp(workdir) and
> > IIUC, task might not have permission to do lookup in workdir.
> >
> > Should we switch to this override_cred, just before ovl_create_real()
> > so that task ->fsuid and ->fsgid are used only for creation purposes
> > only.
> 
> For lookup in workdir only CAP_DAC_OVERRIDE should matter, the actual
> value of the fsuid and fsgid should be irrelevant (user, group and
> others all have zero permission on workdir).

Ok. Agreed that CAP_DAC_OVERRIDE should do.

Thanks
Vivek