linux-kernel - Re: [PATCH v2 1/1] OverlayFS: Fix checking permissions during lookup.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sat, 27 Feb 2016 13:40:02 +0300
From:	Nazarov Sergey <s-nazarov@...dex.ru>
To:	Vivek Goyal <vgoyal@...hat.com>,
	Ignacy Gawędzki 
	<ignacy.gawedzki@...en-communications.fr>,
	"linux-unionfs@...r.kernel.org" <linux-unionfs@...r.kernel.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Cc:	"linux-fsdevel@...r.kernel.org" <linux-fsdevel@...r.kernel.org>
Subject: Re: [PATCH v2 1/1] OverlayFS: Fix checking permissions during lookup.

26.02.2016, 22:41, "Vivek Goyal" <vgoyal@...hat.com>:
>
> So what's the problem we are trying to solve. Why should we able to
> override the DAC checks of lower layer if same directory in upper
> is searchable for user but it is not searchable in lower layer.
>

If I right, this is a one of the main feature of overlayfs - upper layer has priority over lower ones.
Override AC checks necessary for lookup operation only. Lower layer files access AC checks
remain, so this should not be a security problem.
Sergey.