diff options
author | Andy Lutomirski <luto@amacapital.net> | 2014-06-10 15:45:42 -0400 |
---|---|---|
committer | Linus Torvalds <torvalds@linux-foundation.org> | 2014-06-10 16:57:22 -0400 |
commit | 23adbe12ef7d3d4195e80800ab36b37bee28cd03 (patch) | |
tree | 000f8f8b3172aa6629b7c9a4148a96549a07acb6 | |
parent | 5b174fd6472b1d6b6402b30210a212f3fd770d96 (diff) |
fs,userns: Change inode_capable to capable_wrt_inode_uidgid
The kernel has no concept of capabilities with respect to inodes; inodes
exist independently of namespaces. For example, inode_capable(inode,
CAP_LINUX_IMMUTABLE) would be nonsense.
This patch changes inode_capable to check for uid and gid mappings and
renames it to capable_wrt_inode_uidgid, which should make it more
obvious what it does.
Fixes CVE-2014-4014.
Cc: Theodore Ts'o <tytso@mit.edu>
Cc: Serge Hallyn <serge.hallyn@ubuntu.com>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Dave Chinner <david@fromorbit.com>
Cc: stable@vger.kernel.org
Signed-off-by: Andy Lutomirski <luto@amacapital.net>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
-rw-r--r-- | fs/attr.c | 8 | ||||
-rw-r--r-- | fs/inode.c | 10 | ||||
-rw-r--r-- | fs/namei.c | 11 | ||||
-rw-r--r-- | fs/xfs/xfs_ioctl.c | 2 | ||||
-rw-r--r-- | include/linux/capability.h | 2 | ||||
-rw-r--r-- | kernel/capability.c | 20 |
6 files changed, 27 insertions, 26 deletions
@@ -50,14 +50,14 @@ int inode_change_ok(const struct inode *inode, struct iattr *attr) | |||
50 | if ((ia_valid & ATTR_UID) && | 50 | if ((ia_valid & ATTR_UID) && |
51 | (!uid_eq(current_fsuid(), inode->i_uid) || | 51 | (!uid_eq(current_fsuid(), inode->i_uid) || |
52 | !uid_eq(attr->ia_uid, inode->i_uid)) && | 52 | !uid_eq(attr->ia_uid, inode->i_uid)) && |
53 | !inode_capable(inode, CAP_CHOWN)) | 53 | !capable_wrt_inode_uidgid(inode, CAP_CHOWN)) |
54 | return -EPERM; | 54 | return -EPERM; |
55 | 55 | ||
56 | /* Make sure caller can chgrp. */ | 56 | /* Make sure caller can chgrp. */ |
57 | if ((ia_valid & ATTR_GID) && | 57 | if ((ia_valid & ATTR_GID) && |
58 | (!uid_eq(current_fsuid(), inode->i_uid) || | 58 | (!uid_eq(current_fsuid(), inode->i_uid) || |
59 | (!in_group_p(attr->ia_gid) && !gid_eq(attr->ia_gid, inode->i_gid))) && | 59 | (!in_group_p(attr->ia_gid) && !gid_eq(attr->ia_gid, inode->i_gid))) && |
60 | !inode_capable(inode, CAP_CHOWN)) | 60 | !capable_wrt_inode_uidgid(inode, CAP_CHOWN)) |
61 | return -EPERM; | 61 | return -EPERM; |
62 | 62 | ||
63 | /* Make sure a caller can chmod. */ | 63 | /* Make sure a caller can chmod. */ |
@@ -67,7 +67,7 @@ int inode_change_ok(const struct inode *inode, struct iattr *attr) | |||
67 | /* Also check the setgid bit! */ | 67 | /* Also check the setgid bit! */ |
68 | if (!in_group_p((ia_valid & ATTR_GID) ? attr->ia_gid : | 68 | if (!in_group_p((ia_valid & ATTR_GID) ? attr->ia_gid : |
69 | inode->i_gid) && | 69 | inode->i_gid) && |
70 | !inode_capable(inode, CAP_FSETID)) | 70 | !capable_wrt_inode_uidgid(inode, CAP_FSETID)) |
71 | attr->ia_mode &= ~S_ISGID; | 71 | attr->ia_mode &= ~S_ISGID; |
72 | } | 72 | } |
73 | 73 | ||
@@ -160,7 +160,7 @@ void setattr_copy(struct inode *inode, const struct iattr *attr) | |||
160 | umode_t mode = attr->ia_mode; | 160 | umode_t mode = attr->ia_mode; |
161 | 161 | ||
162 | if (!in_group_p(inode->i_gid) && | 162 | if (!in_group_p(inode->i_gid) && |
163 | !inode_capable(inode, CAP_FSETID)) | 163 | !capable_wrt_inode_uidgid(inode, CAP_FSETID)) |
164 | mode &= ~S_ISGID; | 164 | mode &= ~S_ISGID; |
165 | inode->i_mode = mode; | 165 | inode->i_mode = mode; |
166 | } | 166 | } |
diff --git a/fs/inode.c b/fs/inode.c index 2feb9b69f1be..6eecb7ff0b9a 100644 --- a/fs/inode.c +++ b/fs/inode.c | |||
@@ -1839,14 +1839,18 @@ EXPORT_SYMBOL(inode_init_owner); | |||
1839 | * inode_owner_or_capable - check current task permissions to inode | 1839 | * inode_owner_or_capable - check current task permissions to inode |
1840 | * @inode: inode being checked | 1840 | * @inode: inode being checked |
1841 | * | 1841 | * |
1842 | * Return true if current either has CAP_FOWNER to the inode, or | 1842 | * Return true if current either has CAP_FOWNER in a namespace with the |
1843 | * owns the file. | 1843 | * inode owner uid mapped, or owns the file. |
1844 | */ | 1844 | */ |
1845 | bool inode_owner_or_capable(const struct inode *inode) | 1845 | bool inode_owner_or_capable(const struct inode *inode) |
1846 | { | 1846 | { |
1847 | struct user_namespace *ns; | ||
1848 | |||
1847 | if (uid_eq(current_fsuid(), inode->i_uid)) | 1849 | if (uid_eq(current_fsuid(), inode->i_uid)) |
1848 | return true; | 1850 | return true; |
1849 | if (inode_capable(inode, CAP_FOWNER)) | 1851 | |
1852 | ns = current_user_ns(); | ||
1853 | if (ns_capable(ns, CAP_FOWNER) && kuid_has_mapping(ns, inode->i_uid)) | ||
1850 | return true; | 1854 | return true; |
1851 | return false; | 1855 | return false; |
1852 | } | 1856 | } |
diff --git a/fs/namei.c b/fs/namei.c index 80168273396b..985c6f368485 100644 --- a/fs/namei.c +++ b/fs/namei.c | |||
@@ -332,10 +332,11 @@ int generic_permission(struct inode *inode, int mask) | |||
332 | 332 | ||
333 | if (S_ISDIR(inode->i_mode)) { | 333 | if (S_ISDIR(inode->i_mode)) { |
334 | /* DACs are overridable for directories */ | 334 | /* DACs are overridable for directories */ |
335 | if (inode_capable(inode, CAP_DAC_OVERRIDE)) | 335 | if (capable_wrt_inode_uidgid(inode, CAP_DAC_OVERRIDE)) |
336 | return 0; | 336 | return 0; |
337 | if (!(mask & MAY_WRITE)) | 337 | if (!(mask & MAY_WRITE)) |
338 | if (inode_capable(inode, CAP_DAC_READ_SEARCH)) | 338 | if (capable_wrt_inode_uidgid(inode, |
339 | CAP_DAC_READ_SEARCH)) | ||
339 | return 0; | 340 | return 0; |
340 | return -EACCES; | 341 | return -EACCES; |
341 | } | 342 | } |
@@ -345,7 +346,7 @@ int generic_permission(struct inode *inode, int mask) | |||
345 | * at least one exec bit set. | 346 | * at least one exec bit set. |
346 | */ | 347 | */ |
347 | if (!(mask & MAY_EXEC) || (inode->i_mode & S_IXUGO)) | 348 | if (!(mask & MAY_EXEC) || (inode->i_mode & S_IXUGO)) |
348 | if (inode_capable(inode, CAP_DAC_OVERRIDE)) | 349 | if (capable_wrt_inode_uidgid(inode, CAP_DAC_OVERRIDE)) |
349 | return 0; | 350 | return 0; |
350 | 351 | ||
351 | /* | 352 | /* |
@@ -353,7 +354,7 @@ int generic_permission(struct inode *inode, int mask) | |||
353 | */ | 354 | */ |
354 | mask &= MAY_READ | MAY_WRITE | MAY_EXEC; | 355 | mask &= MAY_READ | MAY_WRITE | MAY_EXEC; |
355 | if (mask == MAY_READ) | 356 | if (mask == MAY_READ) |
356 | if (inode_capable(inode, CAP_DAC_READ_SEARCH)) | 357 | if (capable_wrt_inode_uidgid(inode, CAP_DAC_READ_SEARCH)) |
357 | return 0; | 358 | return 0; |
358 | 359 | ||
359 | return -EACCES; | 360 | return -EACCES; |
@@ -2379,7 +2380,7 @@ static inline int check_sticky(struct inode *dir, struct inode *inode) | |||
2379 | return 0; | 2380 | return 0; |
2380 | if (uid_eq(dir->i_uid, fsuid)) | 2381 | if (uid_eq(dir->i_uid, fsuid)) |
2381 | return 0; | 2382 | return 0; |
2382 | return !inode_capable(inode, CAP_FOWNER); | 2383 | return !capable_wrt_inode_uidgid(inode, CAP_FOWNER); |
2383 | } | 2384 | } |
2384 | 2385 | ||
2385 | /* | 2386 | /* |
diff --git a/fs/xfs/xfs_ioctl.c b/fs/xfs/xfs_ioctl.c index 0b18776b075e..6152cbe353e8 100644 --- a/fs/xfs/xfs_ioctl.c +++ b/fs/xfs/xfs_ioctl.c | |||
@@ -1215,7 +1215,7 @@ xfs_ioctl_setattr( | |||
1215 | * cleared upon successful return from chown() | 1215 | * cleared upon successful return from chown() |
1216 | */ | 1216 | */ |
1217 | if ((ip->i_d.di_mode & (S_ISUID|S_ISGID)) && | 1217 | if ((ip->i_d.di_mode & (S_ISUID|S_ISGID)) && |
1218 | !inode_capable(VFS_I(ip), CAP_FSETID)) | 1218 | !capable_wrt_inode_uidgid(VFS_I(ip), CAP_FSETID)) |
1219 | ip->i_d.di_mode &= ~(S_ISUID|S_ISGID); | 1219 | ip->i_d.di_mode &= ~(S_ISUID|S_ISGID); |
1220 | 1220 | ||
1221 | /* | 1221 | /* |
diff --git a/include/linux/capability.h b/include/linux/capability.h index a6ee1f9a5018..84b13ad67c1c 100644 --- a/include/linux/capability.h +++ b/include/linux/capability.h | |||
@@ -210,7 +210,7 @@ extern bool has_ns_capability_noaudit(struct task_struct *t, | |||
210 | struct user_namespace *ns, int cap); | 210 | struct user_namespace *ns, int cap); |
211 | extern bool capable(int cap); | 211 | extern bool capable(int cap); |
212 | extern bool ns_capable(struct user_namespace *ns, int cap); | 212 | extern bool ns_capable(struct user_namespace *ns, int cap); |
213 | extern bool inode_capable(const struct inode *inode, int cap); | 213 | extern bool capable_wrt_inode_uidgid(const struct inode *inode, int cap); |
214 | extern bool file_ns_capable(const struct file *file, struct user_namespace *ns, int cap); | 214 | extern bool file_ns_capable(const struct file *file, struct user_namespace *ns, int cap); |
215 | 215 | ||
216 | /* audit system wants to get cap info from files as well */ | 216 | /* audit system wants to get cap info from files as well */ |
diff --git a/kernel/capability.c b/kernel/capability.c index 84b2bbf443e7..a5cf13c018ce 100644 --- a/kernel/capability.c +++ b/kernel/capability.c | |||
@@ -424,23 +424,19 @@ bool capable(int cap) | |||
424 | EXPORT_SYMBOL(capable); | 424 | EXPORT_SYMBOL(capable); |
425 | 425 | ||
426 | /** | 426 | /** |
427 | * inode_capable - Check superior capability over inode | 427 | * capable_wrt_inode_uidgid - Check nsown_capable and uid and gid mapped |
428 | * @inode: The inode in question | 428 | * @inode: The inode in question |
429 | * @cap: The capability in question | 429 | * @cap: The capability in question |
430 | * | 430 | * |
431 | * Return true if the current task has the given superior capability | 431 | * Return true if the current task has the given capability targeted at |
432 | * targeted at it's own user namespace and that the given inode is owned | 432 | * its own user namespace and that the given inode's uid and gid are |
433 | * by the current user namespace or a child namespace. | 433 | * mapped into the current user namespace. |
434 | * | ||
435 | * Currently we check to see if an inode is owned by the current | ||
436 | * user namespace by seeing if the inode's owner maps into the | ||
437 | * current user namespace. | ||
438 | * | ||
439 | */ | 434 | */ |
440 | bool inode_capable(const struct inode *inode, int cap) | 435 | bool capable_wrt_inode_uidgid(const struct inode *inode, int cap) |
441 | { | 436 | { |
442 | struct user_namespace *ns = current_user_ns(); | 437 | struct user_namespace *ns = current_user_ns(); |
443 | 438 | ||
444 | return ns_capable(ns, cap) && kuid_has_mapping(ns, inode->i_uid); | 439 | return ns_capable(ns, cap) && kuid_has_mapping(ns, inode->i_uid) && |
440 | kgid_has_mapping(ns, inode->i_gid); | ||
445 | } | 441 | } |
446 | EXPORT_SYMBOL(inode_capable); | 442 | EXPORT_SYMBOL(capable_wrt_inode_uidgid); |