Commit 030b533c authored by Jan Kara's avatar Jan Kara

fs: Avoid premature clearing of capabilities

Currently, notify_change() clears capabilities or IMA attributes by
calling security_inode_killpriv() before calling into ->setattr. Thus it
happens before any other permission checks in inode_change_ok() and user
is thus allowed to trigger clearing of capabilities or IMA attributes
for any file he can look up e.g. by calling chown for that file. This is
unexpected and can lead to user DoSing a system.

Fix the problem by calling security_inode_killpriv() at the end of
inode_change_ok() instead of from notify_change(). At that moment we are
sure user has permissions to do the requested change.

References: CVE-2015-1350
Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
Signed-off-by: default avatarJan Kara <jack@suse.cz>
parent 31051c85
...@@ -47,7 +47,7 @@ int setattr_prepare(struct dentry *dentry, struct iattr *attr) ...@@ -47,7 +47,7 @@ int setattr_prepare(struct dentry *dentry, struct iattr *attr)
/* If force is set do it anyway. */ /* If force is set do it anyway. */
if (ia_valid & ATTR_FORCE) if (ia_valid & ATTR_FORCE)
return 0; goto kill_priv;
/* Make sure a caller can chown. */ /* Make sure a caller can chown. */
if ((ia_valid & ATTR_UID) && if ((ia_valid & ATTR_UID) &&
...@@ -80,6 +80,16 @@ int setattr_prepare(struct dentry *dentry, struct iattr *attr) ...@@ -80,6 +80,16 @@ int setattr_prepare(struct dentry *dentry, struct iattr *attr)
return -EPERM; return -EPERM;
} }
kill_priv:
/* User has permission for the change */
if (ia_valid & ATTR_KILL_PRIV) {
int error;
error = security_inode_killpriv(dentry);
if (error)
return error;
}
return 0; return 0;
} }
EXPORT_SYMBOL(setattr_prepare); EXPORT_SYMBOL(setattr_prepare);
...@@ -220,13 +230,11 @@ int notify_change(struct dentry * dentry, struct iattr * attr, struct inode **de ...@@ -220,13 +230,11 @@ int notify_change(struct dentry * dentry, struct iattr * attr, struct inode **de
if (!(ia_valid & ATTR_MTIME_SET)) if (!(ia_valid & ATTR_MTIME_SET))
attr->ia_mtime = now; attr->ia_mtime = now;
if (ia_valid & ATTR_KILL_PRIV) { if (ia_valid & ATTR_KILL_PRIV) {
attr->ia_valid &= ~ATTR_KILL_PRIV;
ia_valid &= ~ATTR_KILL_PRIV;
error = security_inode_need_killpriv(dentry); error = security_inode_need_killpriv(dentry);
if (error > 0) if (error < 0)
error = security_inode_killpriv(dentry);
if (error)
return error; return error;
if (error == 0)
ia_valid = attr->ia_valid &= ~ATTR_KILL_PRIV;
} }
/* /*
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment