Re: Missing check for CAP_SYS_ADMIN in do_reconfigure_mnt()

From: Matthew Wilcox <willy@infradead.org>
To: tianyu zhou <tyjoe.linux@gmail.com>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>, linux-fsdevel@vger.kernel.org
Subject: Re: Missing check for CAP_SYS_ADMIN in do_reconfigure_mnt()
Date: Mon, 31 May 2021 18:07:08 +0100	[thread overview]
Message-ID: <YLUXvOI433/W8EvD@casper.infradead.org> (raw)
In-Reply-To: <CAM6ytZrBUMB6xpP_srni8VParnNiuFPZZ2H-WsWUJEZH_vSk1w@mail.gmail.com>

On Mon, May 31, 2021 at 10:59:54PM +0800, tianyu zhou wrote:
> Hi, function do_remount() in fs/namespace.c checks the CAP_SYS_ADMIN
> before it calls set_mount_attributes().
> 
> However, in another caller of set_mount_attributes(),
> do_reconfigure_mnt(), I have not found any check for CAP_SYS_ADMIN.
> So, is there a missing check bug inside do_reconfigure_mnt() ? (which
> makes it possible for normal user to reach set_mount_attributes())

You weren't looking hard enough ...

path_mount()
        if (!may_mount())
                return -EPERM;
...
        if ((flags & (MS_REMOUNT | MS_BIND)) == (MS_REMOUNT | MS_BIND))
                return do_reconfigure_mnt(path, mnt_flags);

(this is the only call to do_reconfigure_mnt())

and:

static inline bool may_mount(void)
{
        return ns_capable(current->nsproxy->mnt_ns->user_ns, CAP_SYS_ADMIN);
}