* [PATCH] fscrypto: add authorization check for setting encryption policy
@ 2016-09-12 19:03 Eric Biggers
2016-09-15 17:19 ` Greg KH
0 siblings, 1 reply; 6+ messages in thread
From: Eric Biggers @ 2016-09-12 19:03 UTC (permalink / raw)
To: stable; +Cc: gregkh, tytso, Eric Biggers
commit 163ae1c6ad6299b19e22b4a35d5ab24a89791a98 upstream, backported to
fs/ext4/ and fs/f2fs/ for 4.4 kernels.
On an ext4 or f2fs filesystem with file encryption supported, a user
could set an encryption policy on any empty directory(*) to which they
had readonly access. This is obviously problematic, since such a
directory might be owned by another user and the new encryption policy
would prevent that other user from creating files in their own directory
(for example).
Fix this by requiring inode_owner_or_capable() permission to set an
encryption policy. This means that either the caller must own the file,
or the caller must have the capability CAP_FOWNER.
(*) Or also on any regular file, for f2fs v4.6 and later and ext4
v4.8-rc1 and later; a separate bug fix is coming for that.
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
---
fs/ext4/crypto_policy.c | 3 +++
fs/f2fs/crypto_policy.c | 3 +++
2 files changed, 6 insertions(+)
diff --git a/fs/ext4/crypto_policy.c b/fs/ext4/crypto_policy.c
index ad05069..8a9feb3 100644
--- a/fs/ext4/crypto_policy.c
+++ b/fs/ext4/crypto_policy.c
@@ -102,6 +102,9 @@ static int ext4_create_encryption_context_from_policy(
int ext4_process_policy(const struct ext4_encryption_policy *policy,
struct inode *inode)
{
+ if (!inode_owner_or_capable(inode))
+ return -EACCES;
+
if (policy->version != 0)
return -EINVAL;
diff --git a/fs/f2fs/crypto_policy.c b/fs/f2fs/crypto_policy.c
index d4a96af..e504f54 100644
--- a/fs/f2fs/crypto_policy.c
+++ b/fs/f2fs/crypto_policy.c
@@ -89,6 +89,9 @@ static int f2fs_create_encryption_context_from_policy(
int f2fs_process_policy(const struct f2fs_encryption_policy *policy,
struct inode *inode)
{
+ if (!inode_owner_or_capable(inode))
+ return -EACCES;
+
if (policy->version != 0)
return -EINVAL;
--
2.8.0.rc3.226.g39d4020
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH] fscrypto: add authorization check for setting encryption policy
2016-09-12 19:03 [PATCH] fscrypto: add authorization check for setting encryption policy Eric Biggers
@ 2016-09-15 17:19 ` Greg KH
0 siblings, 0 replies; 6+ messages in thread
From: Greg KH @ 2016-09-15 17:19 UTC (permalink / raw)
To: Eric Biggers; +Cc: stable, tytso
On Mon, Sep 12, 2016 at 12:03:44PM -0700, Eric Biggers wrote:
> commit 163ae1c6ad6299b19e22b4a35d5ab24a89791a98 upstream, backported to
> fs/ext4/ and fs/f2fs/ for 4.4 kernels.
Many thanks for this!
greg k-h
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] fscrypto: add authorization check for setting encryption policy
2016-09-10 3:37 ` Theodore Ts'o
@ 2016-09-10 4:03 ` Jaegeuk Kim
0 siblings, 0 replies; 6+ messages in thread
From: Jaegeuk Kim @ 2016-09-10 4:03 UTC (permalink / raw)
To: Theodore Ts'o; +Cc: Eric Biggers, linux-fsdevel, linux-ext4, linux-f2fs
On Fri, Sep 09, 2016 at 11:37:59PM -0400, Theodore Ts'o wrote:
> On Thu, Sep 08, 2016 at 10:57:08AM -0700, Eric Biggers wrote:
> > On an ext4 or f2fs filesystem with file encryption supported, a user
> > could set an encryption policy on any empty directory(*) to which they
> > had readonly access. This is obviously problematic, since such a
> > directory might be owned by another user and the new encryption policy
> > would prevent that other user from creating files in their own directory
> > (for example).
> >
> > Fix this by requiring inode_owner_or_capable() permission to set an
> > encryption policy. This means that either the caller must own the file,
> > or the caller must have the capability CAP_FOWNER.
> >
> > (*) Or also on any regular file, for f2fs v4.6 and later and ext4
> > v4.8-rc1 and later; a separate bug fix is coming for that.
> >
> > Signed-off-by: Eric Biggers <ebiggers@google.com>
> > Cc: stable@vger.kernel.org # 4.1+; check fs/{ext4,f2fs}
>
> Thanks, applied. (Jaeguk, I plan to send this to Linus via the
> ext4.git tree as a fix for v4.8)
Sure, no problem.
>
> - Ted
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] fscrypto: add authorization check for setting encryption policy
2016-09-08 17:57 Eric Biggers
2016-09-08 18:20 ` Eric Biggers
@ 2016-09-10 3:37 ` Theodore Ts'o
2016-09-10 4:03 ` Jaegeuk Kim
1 sibling, 1 reply; 6+ messages in thread
From: Theodore Ts'o @ 2016-09-10 3:37 UTC (permalink / raw)
To: Eric Biggers; +Cc: linux-fsdevel, linux-ext4, linux-f2fs, jaegeuk
On Thu, Sep 08, 2016 at 10:57:08AM -0700, Eric Biggers wrote:
> On an ext4 or f2fs filesystem with file encryption supported, a user
> could set an encryption policy on any empty directory(*) to which they
> had readonly access. This is obviously problematic, since such a
> directory might be owned by another user and the new encryption policy
> would prevent that other user from creating files in their own directory
> (for example).
>
> Fix this by requiring inode_owner_or_capable() permission to set an
> encryption policy. This means that either the caller must own the file,
> or the caller must have the capability CAP_FOWNER.
>
> (*) Or also on any regular file, for f2fs v4.6 and later and ext4
> v4.8-rc1 and later; a separate bug fix is coming for that.
>
> Signed-off-by: Eric Biggers <ebiggers@google.com>
> Cc: stable@vger.kernel.org # 4.1+; check fs/{ext4,f2fs}
Thanks, applied. (Jaeguk, I plan to send this to Linus via the
ext4.git tree as a fix for v4.8)
- Ted
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] fscrypto: add authorization check for setting encryption policy
2016-09-08 17:57 Eric Biggers
@ 2016-09-08 18:20 ` Eric Biggers
2016-09-10 3:37 ` Theodore Ts'o
1 sibling, 0 replies; 6+ messages in thread
From: Eric Biggers @ 2016-09-08 18:20 UTC (permalink / raw)
To: linux-fsdevel; +Cc: linux-ext4, linux-f2fs-devel, tytso, jaegeuk
(Fixing Cc list: the F2FS mailing list is
linux-f2fs-devel@lists.sourceforge.net, not linux-f2fs@vger.kernel.org.)
On Thu, Sep 08, 2016 at 10:57:08AM -0700, Eric Biggers wrote:
> On an ext4 or f2fs filesystem with file encryption supported, a user
> could set an encryption policy on any empty directory(*) to which they
> had readonly access. This is obviously problematic, since such a
> directory might be owned by another user and the new encryption policy
> would prevent that other user from creating files in their own directory
> (for example).
>
> Fix this by requiring inode_owner_or_capable() permission to set an
> encryption policy. This means that either the caller must own the file,
> or the caller must have the capability CAP_FOWNER.
>
> (*) Or also on any regular file, for f2fs v4.6 and later and ext4
> v4.8-rc1 and later; a separate bug fix is coming for that.
>
> Signed-off-by: Eric Biggers <ebiggers@google.com>
> Cc: stable@vger.kernel.org # 4.1+; check fs/{ext4,f2fs}
> ---
> fs/crypto/policy.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/fs/crypto/policy.c b/fs/crypto/policy.c
> index 0f9961e..c9800b1 100644
> --- a/fs/crypto/policy.c
> +++ b/fs/crypto/policy.c
> @@ -95,6 +95,9 @@ static int create_encryption_context_from_policy(struct inode *inode,
> int fscrypt_process_policy(struct inode *inode,
> const struct fscrypt_policy *policy)
> {
> + if (!inode_owner_or_capable(inode))
> + return -EACCES;
> +
> if (policy->version != 0)
> return -EINVAL;
>
> --
> 2.8.0.rc3.226.g39d4020
>
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH] fscrypto: add authorization check for setting encryption policy
@ 2016-09-08 17:57 Eric Biggers
2016-09-08 18:20 ` Eric Biggers
2016-09-10 3:37 ` Theodore Ts'o
0 siblings, 2 replies; 6+ messages in thread
From: Eric Biggers @ 2016-09-08 17:57 UTC (permalink / raw)
To: linux-fsdevel; +Cc: linux-ext4, linux-f2fs, tytso, jaegeuk, Eric Biggers
On an ext4 or f2fs filesystem with file encryption supported, a user
could set an encryption policy on any empty directory(*) to which they
had readonly access. This is obviously problematic, since such a
directory might be owned by another user and the new encryption policy
would prevent that other user from creating files in their own directory
(for example).
Fix this by requiring inode_owner_or_capable() permission to set an
encryption policy. This means that either the caller must own the file,
or the caller must have the capability CAP_FOWNER.
(*) Or also on any regular file, for f2fs v4.6 and later and ext4
v4.8-rc1 and later; a separate bug fix is coming for that.
Signed-off-by: Eric Biggers <ebiggers@google.com>
Cc: stable@vger.kernel.org # 4.1+; check fs/{ext4,f2fs}
---
fs/crypto/policy.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/fs/crypto/policy.c b/fs/crypto/policy.c
index 0f9961e..c9800b1 100644
--- a/fs/crypto/policy.c
+++ b/fs/crypto/policy.c
@@ -95,6 +95,9 @@ static int create_encryption_context_from_policy(struct inode *inode,
int fscrypt_process_policy(struct inode *inode,
const struct fscrypt_policy *policy)
{
+ if (!inode_owner_or_capable(inode))
+ return -EACCES;
+
if (policy->version != 0)
return -EINVAL;
--
2.8.0.rc3.226.g39d4020
^ permalink raw reply related [flat|nested] 6+ messages in thread
end of thread, other threads:[~2016-09-15 17:19 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-09-12 19:03 [PATCH] fscrypto: add authorization check for setting encryption policy Eric Biggers
2016-09-15 17:19 ` Greg KH
-- strict thread matches above, loose matches on Subject: below --
2016-09-08 17:57 Eric Biggers
2016-09-08 18:20 ` Eric Biggers
2016-09-10 3:37 ` Theodore Ts'o
2016-09-10 4:03 ` Jaegeuk Kim
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.