From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 81F4DC38145 for ; Fri, 2 Sep 2022 12:26:36 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236373AbiIBM0f (ORCPT ); Fri, 2 Sep 2022 08:26:35 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48408 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236170AbiIBMZw (ORCPT ); Fri, 2 Sep 2022 08:25:52 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9FD25D3448; Fri, 2 Sep 2022 05:23:28 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 510FBB82A98; Fri, 2 Sep 2022 12:22:30 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9FCF5C433D6; Fri, 2 Sep 2022 12:22:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1662121349; bh=BMQq+XVOq16fiD117B6x9rrAbs3XfQzw3IPiWDPqzlM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=k98pZMiX/xotA2hQ+7pgESch6InwX8at3M2ddZAMxQdYAFb9z7DphPqODvl0foCsR AIXAridBcMMCYnF9AX2sk7UcWVtUUiV9i5StDS6pccEJEcJT7b5Wy68UY8K+N849A5 QIMXANw1WoFTBCJTLXgWDFjPkATM2Lcvn2YjN9r0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Qu Wenruo , Filipe Manana , Goldwyn Rodrigues , David Sterba Subject: [PATCH 4.14 21/42] btrfs: check if root is readonly while setting security xattr Date: Fri, 2 Sep 2022 14:18:45 +0200 Message-Id: <20220902121359.542722507@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220902121358.773776406@linuxfoundation.org> References: <20220902121358.773776406@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Goldwyn Rodrigues commit b51111271b0352aa596c5ae8faf06939e91b3b68 upstream. For a filesystem which has btrfs read-only property set to true, all write operations including xattr should be denied. However, security xattr can still be changed even if btrfs ro property is true. This happens because xattr_permission() does not have any restrictions on security.*, system.* and in some cases trusted.* from VFS and the decision is left to the underlying filesystem. See comments in xattr_permission() for more details. This patch checks if the root is read-only before performing the set xattr operation. Testcase: DEV=/dev/vdb MNT=/mnt mkfs.btrfs -f $DEV mount $DEV $MNT echo "file one" > $MNT/f1 setfattr -n "security.one" -v 2 $MNT/f1 btrfs property set /mnt ro true setfattr -n "security.one" -v 1 $MNT/f1 umount $MNT CC: stable@vger.kernel.org # 4.9+ Reviewed-by: Qu Wenruo Reviewed-by: Filipe Manana Signed-off-by: Goldwyn Rodrigues Reviewed-by: David Sterba Signed-off-by: David Sterba Signed-off-by: Greg Kroah-Hartman --- fs/btrfs/xattr.c | 3 +++ 1 file changed, 3 insertions(+) --- a/fs/btrfs/xattr.c +++ b/fs/btrfs/xattr.c @@ -378,6 +378,9 @@ static int btrfs_xattr_handler_get(const struct dentry *unused, struct inode *inode, const char *name, void *buffer, size_t size) { + if (btrfs_root_readonly(BTRFS_I(inode)->root)) + return -EROFS; + name = xattr_full_name(handler, name); return __btrfs_getxattr(inode, name, buffer, size); }