On Mon, Dec 28, 2020 at 11:26 AM <gregkh@xxxxxxxxxxxxxxxxxxx> wrote:
>
>
> The patch below does not apply to the 4.19-stable tree.
> If someone wants it applied there, or to any other stable or longterm
> tree, then please email the backport, including the original git commit
> id to <stable@xxxxxxxxxxxxxxx>.
>
> thanks,
>
> greg k-h
>
> ------------------ original commit in Linus's tree ------------------
>
> From 89bdfaf93d9157499c3a0d61f489df66f2dead7f Mon Sep 17 00:00:00 2001
> From: Miklos Szeredi <mszeredi@xxxxxxxxxx>
> Date: Mon, 14 Dec 2020 15:26:14 +0100
> Subject: [PATCH] ovl: make ioctl() safe
>
> ovl_ioctl_set_flags() does a capability check using flags, but then the
> real ioctl double-fetches flags and uses potentially different value.
>
> The "Check the capability before cred override" comment misleading: user
> can skip this check by presenting benign flags first and then overwriting
> them to non-benign flags.
>
> Just remove the cred override for now,
> hoping this doesn't cause a regression.
Above is a sentence you don't want to see in stable patches.
At least it should indicate that a longer period is needed before backporting.
> The proper solution is to create a new setxflags i_op (patches are in the
works).
I looked into this and I am not sure it is worth backporting this temporary fix.
One observation is that the theoretic security flaw is arguably very hard to
exploit in practice.
The solution can be described as the lesser evil, but it is far from
perfect as it regresses some other functional test cases.
If anyone would like to backport this patch, one might also consider
backporting:
292f902a40c1 ovl: call secutiry hook in ovl_real_ioctl()
* be4df0cea08a ovl: use generic vfs_ioc_setflags_prepare() helper
[*] $SUBJECT patch replaces this code, so applying this commit eases the
backport. $SUBJECT patch won't apply cleanly, but the merge conflicts
are trivial.
Thanks,
Amir.
