Re: [PATCH] autofs: sanity check status reported with AUTOFS_DEV_IOCTL_FAIL

From	Michael Ellerman <mpe@ellerman.id.au>
Newsgroups	linux.kernel
Subject	Re: [PATCH] autofs: sanity check status reported with AUTOFS_DEV_IOCTL_FAIL
Date	2017-06-16 12:40 +0200
Message-ID	<tSWPw-7fv-1@gated-at.bofh.it> (permalink)
References	<tPyA2-eM-15@gated-at.bofh.it> <tSMwO-xz-13@gated-at.bofh.it> <tSP1D-2jZ-1@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

NeilBrown <neilb@suse.com> writes:
> On Thu, Jun 15 2017, Andrew Morton wrote:
>> On Wed, 07 Jun 2017 12:08:38 +1000 NeilBrown <neilb@suse.com> wrote:
>>> --- a/fs/autofs4/dev-ioctl.c
>>> +++ b/fs/autofs4/dev-ioctl.c
>>> @@ -344,7 +344,7 @@ static int autofs_dev_ioctl_fail(struct file *fp,
>>>  	int status;
>>>  
>>>  	token = (autofs_wqt_t) param->fail.token;
>>> -	status = param->fail.status ? param->fail.status : -ENOENT;
>>> +	status = param->fail.status < 0 ? param->fail.status : -ENOENT;
>>>  	return autofs4_wait_release(sbi, token, status);
>>>  }
>>
>> Sounds serious.  Was the absence of a cc:stable deliberate?
>
> You need CAP_SYS_ADMIN to  get the ioctl even looked at.  Doesn't that
> mean the bug can only be triggered by a process that could easily do
> worse?
>
> Or do containers allow admins to give out CAP_SYS_ADMIN to untrusted
> people??  I haven't been keeping up.

Yep. They can be configured individually in fact, eg:

  $ docker run --cap-drop=ALL --cap-add=sys_admin -it debian:jessie /bin/bash
  root@aedebe8c46e0:/# capsh --print
  Current: = cap_sys_admin+eip
  Bounding set =cap_sys_admin
  Securebits: 00/0x0/1'b0
   secure-noroot: no (unlocked)
   secure-no-suid-fixup: no (unlocked)
   secure-keep-caps: no (unlocked)
  uid=0(root)
  gid=0(root)
  groups=


cheers

Back to linux.kernel | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

Re: [PATCH] autofs: sanity check status reported with  AUTOFS_DEV_IOCTL_FAIL Andrew Morton <akpm@linux-foundation.org> - 2017-06-16 01:40 +0200
  Re: [PATCH] autofs: sanity check status reported with AUTOFS_DEV_IOCTL_FAIL NeilBrown <neilb@suse.com> - 2017-06-16 04:20 +0200
    Re: [PATCH] autofs: sanity check status reported with  AUTOFS_DEV_IOCTL_FAIL Ian Kent <raven@themaw.net> - 2017-06-16 05:40 +0200
    Re: [PATCH] autofs: sanity check status reported with AUTOFS_DEV_IOCTL_FAIL Michael Ellerman <mpe@ellerman.id.au> - 2017-06-16 12:40 +0200

csiph-web