Messages in this thread | | | Date | Tue, 23 Jun 2020 13:16:13 -0400 | From | Sasha Levin <> | Subject | Re: [PATCH AUTOSEL 4.14 090/108] ovl: verify permissions in ovl_path_open() |
| |
On Tue, Jun 23, 2020 at 08:55:38PM +0530, Naresh Kamboju wrote: >On Thu, 18 Jun 2020 at 07:18, Sasha Levin <sashal@kernel.org> wrote: >> >> From: Miklos Szeredi <mszeredi@redhat.com> >> >> [ Upstream commit 56230d956739b9cb1cbde439d76227d77979a04d ] >> >> Check permission before opening a real file. >> >> ovl_path_open() is used by readdir and copy-up routines. >> >> ovl_permission() theoretically already checked copy up permissions, but it >> doesn't hurt to re-do these checks during the actual copy-up. >> >> For directory reading ovl_permission() only checks access to topmost >> underlying layer. Readdir on a merged directory accesses layers below the >> topmost one as well. Permission wasn't checked for these layers. >> >> Note: modifying ovl_permission() to perform this check would be far more >> complex and hence more bug prone. The result is less precise permissions >> returned in access(2). If this turns out to be an issue, we can revisit >> this bug. >> >> Signed-off-by: Miklos Szeredi <mszeredi@redhat.com> >> Signed-off-by: Sasha Levin <sashal@kernel.org> >> --- >> fs/overlayfs/util.c | 27 ++++++++++++++++++++++++++- >> 1 file changed, 26 insertions(+), 1 deletion(-) >> >> diff --git a/fs/overlayfs/util.c b/fs/overlayfs/util.c >> index afdc2533ce74..76d6610767f6 100644 >> --- a/fs/overlayfs/util.c >> +++ b/fs/overlayfs/util.c >> @@ -307,7 +307,32 @@ bool ovl_is_whiteout(struct dentry *dentry) >> >> struct file *ovl_path_open(struct path *path, int flags) >> { >> - return dentry_open(path, flags | O_NOATIME, current_cred()); >> + struct inode *inode = d_inode(path->dentry); >> + int err, acc_mode; >> + >> + if (flags & ~(O_ACCMODE | O_LARGEFILE)) >> + BUG(); >> + >> + switch (flags & O_ACCMODE) { >> + case O_RDONLY: >> + acc_mode = MAY_READ; >> + break; >> + case O_WRONLY: >> + acc_mode = MAY_WRITE; >> + break; >> + default: >> + BUG(); > >This BUG: triggered on stable-rc 5.7, 5.4, 4.19 and 4.14. > >steps to reproduce: > - cd /opt/ltp > - ./runltp -s execveat03
Yup, that patch has been dropped, thanks for testing!
-- Thanks, Sasha
| |