lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Tue, 8 Dec 2020 15:49:25 +0200 From: Amir Goldstein <amir73il@...il.com> To: Miklos Szeredi <mszeredi@...hat.com> Cc: "Eric W . Biederman" <ebiederm@...ssion.com>, linux-fsdevel <linux-fsdevel@...r.kernel.org>, overlayfs <linux-unionfs@...r.kernel.org>, LSM List <linux-security-module@...r.kernel.org>, linux-kernel <linux-kernel@...r.kernel.org> Subject: Re: [PATCH v2 03/10] ovl: check privs before decoding file handle On Mon, Dec 7, 2020 at 6:36 PM Miklos Szeredi <mszeredi@...hat.com> wrote: > > CAP_DAC_READ_SEARCH is required by open_by_handle_at(2) so check it in > ovl_decode_real_fh() as well to prevent privilege escalation for > unprivileged overlay mounts. > > Signed-off-by: Miklos Szeredi <mszeredi@...hat.com> > --- > fs/overlayfs/namei.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/fs/overlayfs/namei.c b/fs/overlayfs/namei.c > index a6162c4076db..82a55fdb1e7a 100644 > --- a/fs/overlayfs/namei.c > +++ b/fs/overlayfs/namei.c > @@ -156,6 +156,9 @@ struct dentry *ovl_decode_real_fh(struct ovl_fh *fh, struct vfsmount *mnt, > struct dentry *real; > int bytes; > > + if (!capable(CAP_DAC_READ_SEARCH)) > + return NULL; > + If the mounter is not capable in init ns, ovl_check_origin() and ovl_verify_index() will not function as expected and this will break index and nfs export features. So I think we need to also check capability in ovl_can_decode_fh(), to auto disable those features. Thanks, Amir.
Powered by blists - more mailing lists