lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date:   Sat, 09 Oct 2021 10:23:45 +0000
Subject: [Bug 214665] New: security bug:using "truncate" bypass disk quotas

            Bug ID: 214665
           Summary: security bug:using "truncate" bypass disk quotas limit
           Product: File System
           Version: 2.5
    Kernel Version: 3.10.0-1160.36.2.el7.x86_64
          Hardware: All
                OS: Linux
              Tree: Mainline
            Status: NEW
          Severity: normal
          Priority: P1
         Component: ext4
        Regression: No

* Overview

  system user can bypass "disk quota limit" using "truncate -s 10T id" command
(that can create a file whose size is 10T).

* Steps to Reproduce

  1. create a user and setup a disk quota for this user

    create user "test"
    useradd test

    create filesystem
    [root@...0-50-0-18 ~]# dd if=/dev/zero of=ext4 bs=1G count=1
    [root@...0-50-0-18 ~]# mkfs.ext4 ext4
    [root@...0-50-0-18 ~]# mkdir -p /tmp/test && chmod -R 777 /tmp/test &&
mount -o usrquota,grpquota ext4 /tmp/test

    setup disk quota
    [root@...0-50-0-18 ~]# quotacheck -u /tmp/test/       # create
"aquota.user" file
    [root@...0-50-0-18 ~]# edquota -u test
    [root@...0-50-0-18 ~]# quotaon /tmp/test/ -u    # open quota service

    the quota setting is like below: user "test" can not use disk space which
size exceed 10K.
    Disk quotas for user test (uid 1000):
    Filesystem                   blocks       soft       hard     inodes    
soft     hard
    /dev/loop0                        0          10          10          0     
  0        0

  2. verify the quota limit using "dd"

    [root@...0-50-0-18 ~]# su - test
    上一次登录:六 10月  9 18:14:31 CST 2021pts/1 上
    [test@...0-50-0-18 ~]$ dd if=/dev/zero of=/tmp/test/id bs=20K count=1
    loop0: write failed, user block limit reached.            # yes,this limit
is as expected
    dd: error writing ‘/tmp/test/id’: Disk quota exceeded
    1+0 records in
    0+0 records out
    8192 bytes (8.2 kB) copied, 0.000221445 s, 37.0 MB/s

    this result is as expected: "test" user can not write file whose size is
more than 10K.

  3. verify the quota limit using "truncate"

    [test@...0-50-0-18 test]$ truncate -s 10T id
    [test@...0-50-0-18 test]$ ll -h id
    -rw-rw-r-- 1 test test 10T Oct  9 17:16 id

    actual results is: "test" user can create file whose size is 10T, larger
more than 10K

    expected result is: like "dd result" above,  "test" user can not write file
whose size is more than 10K.

You may reply to this email to add a comment.

You are receiving this mail because:
You are watching the assignee of the bug.

Powered by blists - more mailing lists