Revision e1c5ae59c0f22f7fe5c07fb5513a29e4aad868c9 authored by Seth Forshee (DigitalOcean) on 24 July 2024, 14:53:59 UTC, committed by Christian Brauner on 27 July 2024, 07:56:33 UTC
Christian noticed that it is possible for a privileged user to mount most filesystems with a non-initial user namespace in sb->s_user_ns. When fsopen() is called in a non-init namespace the caller's namespace is recorded in fs_context->user_ns. If the returned file descriptor is then passed to a process priviliged in init_user_ns, that process can call fsconfig(fd_fs, FSCONFIG_CMD_CREATE), creating a new superblock with sb->s_user_ns set to the namespace of the process which called fsopen(). This is problematic. We cannot assume that any filesystem which does not set FS_USERNS_MOUNT has been written with a non-initial s_user_ns in mind, increasing the risk for bugs and security issues. Prevent this by returning EPERM from sget_fc() when FS_USERNS_MOUNT is not set for the filesystem and a non-initial user namespace will be used. sget() does not need to be updated as it always uses the user namespace of the current context, or the initial user namespace if SB_SUBMOUNT is set. Fixes: cb50b348c71f ("convenience helpers: vfs_get_super() and sget_fc()") Reported-by: Christian Brauner <brauner@kernel.org> Signed-off-by: Seth Forshee (DigitalOcean) <sforshee@kernel.org> Link: https://lore.kernel.org/r/20240724-s_user_ns-fix-v1-1-895d07c94701@kernel.org Reviewed-by: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@canonical.com> Signed-off-by: Christian Brauner <brauner@kernel.org>
1 parent c33ffdb
File | Mode | Size |
---|---|---|
Documentation | ||
LICENSES | ||
arch | ||
block | ||
certs | ||
crypto | ||
drivers | ||
fs | ||
include | ||
init | ||
io_uring | ||
ipc | ||
kernel | ||
lib | ||
mm | ||
net | ||
rust | ||
samples | ||
scripts | ||
security | ||
sound | ||
tools | ||
usr | ||
virt | ||
.clang-format | -rw-r--r-- | 21.7 KB |
.cocciconfig | -rw-r--r-- | 59 bytes |
.editorconfig | -rw-r--r-- | 575 bytes |
.get_maintainer.ignore | -rw-r--r-- | 194 bytes |
.gitattributes | -rw-r--r-- | 105 bytes |
.gitignore | -rw-r--r-- | 2.1 KB |
.mailmap | -rw-r--r-- | 40.0 KB |
.rustfmt.toml | -rw-r--r-- | 369 bytes |
COPYING | -rw-r--r-- | 496 bytes |
CREDITS | -rw-r--r-- | 102.5 KB |
Kbuild | -rw-r--r-- | 2.5 KB |
Kconfig | -rw-r--r-- | 555 bytes |
MAINTAINERS | -rw-r--r-- | 754.6 KB |
Makefile | -rw-r--r-- | 66.5 KB |
README | -rw-r--r-- | 726 bytes |
![swh spinner](/static/img/swh-spinner.gif)
Computing file changes ...