Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1237533

Re: [PATCH 1/5] fs: Verify access of user towards block device file when mounting

Show all headers | View raw

On Thu, Oct 01, 2015 at 10:40:08AM -0500, Eric W. Biederman wrote:
> Seth Forshee <seth.forshee@canonical.com> writes:
> 
> > When mounting a filesystem on a block device there is currently
> > no verification that the user has appropriate access to the
> > device file passed to mount. This has not been an issue so far
> > since the user in question has always been root, but this must
> > be changed before allowing unprivileged users to mount in user
> > namespaces.
> >
> > To fix this, add an argument to lookup_bdev() to specify the
> > required permissions. If the mask of permissions is zero, or
> > if the user has CAP_SYS_ADMIN, the permission check is skipped,
> > otherwise the lookup fails if the user does not have the
> > specified access rights for the inode at the supplied path.
> >
> > Callers associated with mounting are updated to pass permission
> > masks to lookup_bdev() so that these mounts will fail for an
> > unprivileged user who lacks permissions for the block device
> > inode. All other callers pass 0 to maintain their current
> > behaviors.
> >
> 
> Seth can you split this patch?
> 
> One patch to add an argument to lookup_bdev,
> and then for each kind of callsite a follow-on patch (if we are ready
> for that).
> 
> That will separate the logical changes and make things easier to track
> via bisect and more importantly easier to review things.

Sure, I'll do that.

Seth
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Back to linux.kernel | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

[PATCH 1/5] fs: Verify access of user towards block device file when mounting Seth Forshee <seth.forshee@canonical.com> - 2015-09-30 22:20 +0200
  Re: [PATCH 1/5] fs: Verify access of user towards block device file  when mounting Mike Snitzer <snitzer@redhat.com> - 2015-10-01 01:50 +0200
    Re: [PATCH 1/5] fs: Verify access of user towards block device file  when mounting Seth Forshee <seth.forshee@canonical.com> - 2015-10-01 15:00 +0200
      Re: [PATCH 1/5] fs: Verify access of user towards block device file  when mounting Mike Snitzer <snitzer@redhat.com> - 2015-10-01 15:50 +0200
        Re: [PATCH 1/5] fs: Verify access of user towards block device file  when mounting Seth Forshee <seth.forshee@canonical.com> - 2015-10-01 16:50 +0200
        Re: [PATCH 1/5] fs: Verify access of user towards block device file when mounting ebiederm@xmission.com (Eric W. Biederman) - 2015-10-01 18:10 +0200
          Re: [PATCH 1/5] fs: Verify access of user towards block device file  when mounting Jan Kara <jack@suse.cz> - 2015-10-02 01:10 +0200
            Re: [PATCH 1/5] fs: Verify access of user towards block device file  when mounting Seth Forshee <seth.forshee@canonical.com> - 2015-10-05 16:30 +0200
  Re: [PATCH 1/5] fs: Verify access of user towards block device file when mounting ebiederm@xmission.com (Eric W. Biederman) - 2015-10-01 17:50 +0200
    Re: [PATCH 1/5] fs: Verify access of user towards block device file  when mounting Seth Forshee <seth.forshee@canonical.com> - 2015-10-01 18:00 +0200

csiph-web