On Mon, Dec 7, 2020 at 6:36 PM Miklos Szeredi <mszeredi@xxxxxxxxxx> wrote: > > CAP_DAC_READ_SEARCH is required by open_by_handle_at(2) so check it in > ovl_decode_real_fh() as well to prevent privilege escalation for > unprivileged overlay mounts. > > Signed-off-by: Miklos Szeredi <mszeredi@xxxxxxxxxx> > --- > fs/overlayfs/namei.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/fs/overlayfs/namei.c b/fs/overlayfs/namei.c > index a6162c4076db..82a55fdb1e7a 100644 > --- a/fs/overlayfs/namei.c > +++ b/fs/overlayfs/namei.c > @@ -156,6 +156,9 @@ struct dentry *ovl_decode_real_fh(struct ovl_fh *fh, struct vfsmount *mnt, > struct dentry *real; > int bytes; > > + if (!capable(CAP_DAC_READ_SEARCH)) > + return NULL; > + If the mounter is not capable in init ns, ovl_check_origin() and ovl_verify_index() will not function as expected and this will break index and nfs export features. So I think we need to also check capability in ovl_can_decode_fh(), to auto disable those features. Thanks, Amir.
