linux-kernel - [GIT PULL] vfs fixes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20240727-vfs-fixes-c054317e0d77@brauner>
Date: Sat, 27 Jul 2024 11:05:08 +0200
From: Christian Brauner <brauner@...nel.org>
To: Linus Torvalds <torvalds@...ux-foundation.org>
Cc: Christian Brauner <brauner@...nel.org>,
	linux-fsdevel@...r.kernel.org,
	linux-kernel@...r.kernel.org
Subject: [GIT PULL] vfs fixes

/* Summary */
This contains two fixes for this merge window:

VFS:

- I noticed that it is possible for a privileged user to mount most filesystems
  with a non-initial user namespace in sb->s_user_ns. When fsopen() is called
  in a non-init namespace the caller's namespace is recorded in
  fs_context->user_ns. If the returned file descriptor is then passed to a
  process privileged in init_user_ns, that process can call
  fsconfig(fd_fs, FSCONFIG_CMD_CREATE*), creating a new superblock with
  sb->s_user_ns set to the namespace of the process which called fsopen().

  This is problematic as only filesystems that raise FS_USERNS_MOUNT are known
  to be able to support a non-initial s_user_ns. Others may suffer security
  issues, on-disk corruption or outright crash the kernel. Prevent that by
  restricting such delegation to filesystems that allow FS_USERNS_MOUNT.

  Note, that this delegation requires a privileged process to actually create
  the superblock so either the privileged process is cooperaing or someone must
  have tricked a privileged process into operating on a fscontext file
  descriptor whose origin it doesn't know (a stupid idea).

  The bug dates back to about 5 years afaict.

misc:

- Fix hostfs parsing when the mount request comes in via the legacy mount api.
  In the legacy mount api hostfs allows to specify the host directory mount
  without any key. Restore that behavior.

/* Testing */
clang: Debian clang version 16.0.6 (27)
gcc: (Debian 13.2.0-25) 13.2.0

/* Conflicts */
No known conflicts.

The following changes since commit c33ffdb70cc6df4105160f991288e7d2567d7ffa:

  Merge tag 'phy-for-6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy (2024-07-24 13:11:28 -0700)

are available in the Git repository at:

  git@...olite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs tags/vfs-6.11-rc1.fixes.3

for you to fetch changes up to ef9ca17ca458ac7253ae71b552e601e49311fc48:

  hostfs: fix the host directory parse when mounting. (2024-07-27 09:56:33 +0200)

Please consider pulling these changes from the signed vfs-6.11-rc1.fixes.3 tag.

Thanks!
Christian

----------------------------------------------------------------
vfs-6.11-rc1.fixes.3

----------------------------------------------------------------
Hongbo Li (1):
      hostfs: fix the host directory parse when mounting.

Seth Forshee (DigitalOcean) (1):
      fs: don't allow non-init s_user_ns for filesystems without FS_USERNS_MOUNT

 fs/hostfs/hostfs_kern.c | 65 +++++++++++++++++++++++++++++++++++++++++--------
 fs/super.c              | 11 +++++++++
 2 files changed, 66 insertions(+), 10 deletions(-)