linux-ext4 - [PATCH 4.1 2/3] fscrypto: add authorization check for setting encryption policy

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20180302222113.85389-3-ebiggers3@gmail.com>
Date:   Fri,  2 Mar 2018 14:21:12 -0800
From:   Eric Biggers <ebiggers3@...il.com>
To:     stable@...r.kernel.org, Sasha Levin <Alexander.Levin@...rosoft.com>
Cc:     linux-ext4@...r.kernel.org, Eric Biggers <ebiggers@...gle.com>,
        Theodore Ts'o <tytso@....edu>
Subject: [PATCH 4.1 2/3] fscrypto: add authorization check for setting encryption policy

From: Eric Biggers <ebiggers@...gle.com>

commit 163ae1c6ad6299b19e22b4a35d5ab24a89791a98 upstream.

On an ext4 or f2fs filesystem with file encryption supported, a user
could set an encryption policy on any empty directory(*) to which they
had readonly access.  This is obviously problematic, since such a
directory might be owned by another user and the new encryption policy
would prevent that other user from creating files in their own directory
(for example).

Fix this by requiring inode_owner_or_capable() permission to set an
encryption policy.  This means that either the caller must own the file,
or the caller must have the capability CAP_FOWNER.

(*) Or also on any regular file, for f2fs v4.6 and later and ext4
    v4.8-rc1 and later; a separate bug fix is coming for that.

Signed-off-by: Eric Biggers <ebiggers@...gle.com>
Signed-off-by: Theodore Ts'o <tytso@....edu>
---
 fs/ext4/crypto_policy.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/fs/ext4/crypto_policy.c b/fs/ext4/crypto_policy.c
index a6d6291aea16..591fc37dcd9e 100644
--- a/fs/ext4/crypto_policy.c
+++ b/fs/ext4/crypto_policy.c
@@ -85,6 +85,9 @@ static int ext4_create_encryption_context_from_policy(
 int ext4_process_policy(const struct ext4_encryption_policy *policy,
 			struct inode *inode)
 {
+	if (!inode_owner_or_capable(inode))
+		return -EACCES;
+
 	if (policy->version != 0)
 		return -EINVAL;

-- 
2.16.2.395.g2e18187dfd-goog