linux-kernel - [PATCH]eCryptfs: quota check ignored in the context of kernel thr ead

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:	Sat, 26 Nov 2011 13:04:36 +0800
From:	"Li Wang" <liwang@...t.edu.cn>
To:	linux-kernel@...r.kernel.org
Cc:	linux-fsdevel@...r.kernel.org, ecryptfs@...r.kernel.org
Subject: [PATCH]eCryptfs: quota check ignored in the context of kernel thr
 ead

Hi there,
   The latest eCryptfs changes the write path to perform the encryption in ecryptfs_writepage, which minimizes the number of encryptions, however, if the ecryptfs_writepage is invoked in the context of page cache write back kernel thread, to write out the dirty pages to the lower page cache, the quota check by the lower file system gotta be ignored since the kernel thread has the CAP_SYS_CAPABILITY. To validate this, just let a user application open a file, write much data into it, then sleep for several miniutes before close it, those data gotta definitely be safely written into the disk in despite of the user quota limit. The patch below try to fix this by simply temporarily removing the capability from the kernel thread before invoking ecryptfs_write_lower, thereafter, reassign it.

  Fixme: It seems those commented codes in the patch (prepare_creds(), ..., commit_creds()) do the thing in a more official way, but they perform too much validity checks which are not needed in our case. Only if the simple cap_lower/cap_raise call will trigger some race condtions, otherwise I think it should be ok?         

Cheers,
Li Wang

signed-off-by: Li Wang <liwang@...t.edu.cn>
               Yong Peng <pengyong@...inos.com.cn>

---
--- fs/ecryptfs/crypto.c.orig 2011-11-26 20:21:08.109304786 +0800
+++ fs/ecryptfs/crypto.c 2011-11-26 20:20:09.651315978 +0800
@@ -506,8 +506,33 @@ int ecryptfs_encrypt_page(struct page *p
        * (PAGE_CACHE_SIZE
           / crypt_stat->extent_size))
       + extent_offset), crypt_stat);
+  /*
+    * Temporarily remove the CAP_SYS_RESOURCE capability from the
+    * write back kernel thread to let it undergo quota check by
+    * the lower file system
+    */
+  if (current->flags & PF_KTHREAD) {
+   cap_lower(((struct cred *)current->cred)->cap_effective, CAP_SYS_RESOURCE);
+   /*
+     * struct cred *cred;
+     * cred = prepare_creds();
+     * if (unlikely(!cred)) {
+     *  rc = -ENOMEM;
+     * goto out;
+     * }
+     * cap_lower(cred->cap_effective, CAP_SYS_RESOURCE);
+     * rc = commit_creds(cred);
+     * if (rc)
+     *  goto out;
+     */  
+  }
   rc = ecryptfs_write_lower(ecryptfs_inode, enc_extent_virt,
        offset, crypt_stat->extent_size);
+  /*
+    * Reassign the CAP_SYS_RESOURCE capability
+    */
+  if (current->flags & PF_KTHREAD)
+   cap_raise(((struct cred *)current->cred)->cap_effective, CAP_SYS_RESOURCE);
   if (rc < 0) {
    ecryptfs_printk(KERN_ERR, "Error attempting "
      "to write lower page; rc = [%d]"