linux-kernel - Re: [PATCH 5.10 1/1] ovl: fail on invalid uid/gid mapping at copy up

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAOQ4uxgCizoAT1fWLKy6hytdhBiCwV0nSwkqzyVckozx5EACPA@mail.gmail.com>
Date:   Tue, 30 May 2023 11:30:48 +0300
From:   Amir Goldstein <amir73il@...il.com>
To:     Danila Chernetsov <listdansp@...l.ru>
Cc:     stable@...r.kernel.org,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Miklos Szeredi <miklos@...redi.hu>,
        linux-unionfs@...r.kernel.org, linux-kernel@...r.kernel.org,
        Miklos Szeredi <mszeredi@...hat.com>,
        Seth Forshee <sforshee@...nel.org>,
        Christian Brauner <brauner@...nel.org>
Subject: Re: [PATCH 5.10 1/1] ovl: fail on invalid uid/gid mapping at copy up

On Tue, May 30, 2023 at 5:44 AM Danila Chernetsov <listdansp@...l.ru> wrote:
>
> From: Miklos Szeredi <mszeredi@...hat.com>
>
> commit  4f11ada10d0ad3fd53e2bd67806351de63a4f9c3 upstream.
>
> If st_uid/st_gid doesn't have a mapping in the mounter's user_ns, then
> copy-up should fail, just like it would fail if the mounter task was doing
> the copy using "cp -a".
>
> There's a corner case where the "cp -a" would succeed but copy up fail: if
> there's a mapping of the invalid uid/gid (65534 by default) in the user
> namespace.  This is because stat(2) will return this value if the mapping
> doesn't exist in the current user_ns and "cp -a" will in turn be able to
> create a file with this uid/gid.
>
> This behavior would be inconsistent with POSIX ACL's, which return -1 for
> invalid uid/gid which result in a failed copy.
>
> For consistency and simplicity fail the copy of the st_uid/st_gid are
> invalid.
>
> Fixes: 459c7c565ac3 ("ovl: unprivieged mounts")
> Cc: <stable@...r.kernel.org> # v5.11
> Signed-off-by: Miklos Szeredi <mszeredi@...hat.com>
> Reviewed-by: Christian Brauner <brauner@...nel.org>
> Reviewed-by: Seth Forshee <sforshee@...nel.org>
> Signed-off-by: Danila Chernetsov <listdansp@...l.ru>
> ---
>  fs/overlayfs/copy_up.c | 4 ++++
>  1 file changed, 4 insertions(+)
>
> diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c
> index e466c58f9ec4..fd33abc0edc0 100644
> --- a/fs/overlayfs/copy_up.c
> +++ b/fs/overlayfs/copy_up.c
> @@ -882,6 +882,10 @@ static int ovl_copy_up_one(struct dentry *parent, struct dentry *dentry,
>         if (err)
>                 return err;
>
> +       if (!kuid_has_mapping(current_user_ns(), ctx.stat.uid) ||
> +           !kgid_has_mapping(current_user_ns(), ctx.stat.gid))
> +               return -EOVERFLOW;
> +
>         ctx.metacopy = ovl_need_meta_copy_up(dentry, ctx.stat.mode, flags);
>
>         if (parent) {
> --
> 2.25.1
>

You are requesting to backport to kernel 5.10.y a fix to a bug that is tagged as
introduced in 5.11 with overlayfs unprivileged mounts.

IOW, in kernel 5.10, current_user_ns() would always be init_user_ns.

Am I missing something?

Thanks,
Amir.