linux-kernel - [PATCH 1/1] xattr: Allow user.* xattr on symlink/special files with CAP_SYS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 25 Jun 2021 15:12:29 -0400
From:   Vivek Goyal <vgoyal@...hat.com>
To:     linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org,
        viro@...iv.linux.org.uk
Cc:     virtio-fs@...hat.com, dwalsh@...hat.com, dgilbert@...hat.com,
        berrange@...hat.com, vgoyal@...hat.com
Subject: [PATCH 1/1] xattr: Allow user.* xattr on symlink/special files with CAP_SYS_RESOURCE

As of now user.* xattrs are allowed only on regular files and directories.
And in case of directories if sticky bit is set, then it is allowed
only if caller is owner or has CAP_FOWNER.

"man xattr" suggests that primary reason behind this restrcition is that
users can set unlimited amount of "user.*" xattrs on symlinks and special
files and bypass quota checks. Following is from man page.

"These differences would allow users to consume filesystem resources  in
 a  way not controllable by disk quotas for group or world writable spe‐
 cial files and directories"

Capability CAP_SYS_RESOURCE allows for overriding disk quota limits. If
being able to bypass quota is primary reason behind these restrictions,
can we relax these restrictions if caller has CAP_SYS_RESOURCE.

Signed-off-by: Vivek Goyal <vgoyal@...hat.com>
---
 fs/xattr.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/xattr.c b/fs/xattr.c
index 5c8c5175b385..10bb918029dd 100644
--- a/fs/xattr.c
+++ b/fs/xattr.c
@@ -124,7 +124,8 @@ xattr_permission(struct user_namespace *mnt_userns, struct inode *inode,
 	 * extended attributes. For sticky directories, only the owner and
 	 * privileged users can write attributes.
 	 */
-	if (!strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN)) {
+	if (!strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN) &&
+	    !capable(CAP_SYS_RESOURCE)) {
 		if (!S_ISREG(inode->i_mode) && !S_ISDIR(inode->i_mode))
 			return (mask & MAY_WRITE) ? -EPERM : -ENODATA;
 		if (S_ISDIR(inode->i_mode) && (inode->i_mode & S_ISVTX) &&
-- 
2.25.4