Received: by 2002:ac0:a594:0:0:0:0:0 with SMTP id m20-v6csp1437737imm; Wed, 23 May 2018 16:26:59 -0700 (PDT) X-Google-Smtp-Source: AB8JxZrLgAsi3FsZubAcSQ2DVA8VkfDlL3yIDiP88O6nuI/TkCCPy5ZyKCz8hqBRpn5J2z/Zn/lU X-Received: by 2002:a17:902:7109:: with SMTP id a9-v6mr4857021pll.271.1527118019297; Wed, 23 May 2018 16:26:59 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1527118019; cv=none; d=google.com; s=arc-20160816; b=Y13tbLaGU4bhBCE/o28HxlH4XWBKcQKAgxVef/NbrMK9aRzcnDI9vr7cGjse68N9vI hQm/IWQ+dGdWobrKS12yndljSOBqLqKNMJK3jxh/tzVorrJnMHEWd6LnomtPk31bD7Nf Pe9qKumGRtvN1rnDnuJeQ5wKD230HLo6UXrH8/HqaURvhnUvvEV0sH/nrppTgCV/G7LN dpSp/4yqBkXEnb+UB5M4nlzQv7G1VMKLGGTbq+yd1qOpwP4gFDsJOSjbo+1Q68bwromw XrH2RWBoVchDX7LrMpG8q/1nc6pUE3dEktEeYkH8mivv6MTdBnnsbi0Lh/hSspDUefbl 5m3g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:subject:references:in-reply-to:message-id :date:cc:to:from:arc-authentication-results; bh=Br7UZxHFz6MmsRCgjlJVeuW9UtmQJ/nCxQfXtfzpeKQ=; b=zwcYaOvkjoaUXycIZuPpqTMhaMw2Mr+h0UoBSSkLm/kkCmYIF6ON+fHuVAKoCiIGCx KhQHCiJPxfqMJvjRdU3B9Y60+laLNJZbJJX+8xNyo/DqrN2D04zydP4Qp7psLZjtgtMv zYYsZoRbZWmXHv/qTEcxNweKzIhHTMT1YZySvSrp7Bm1TB+OY5ktBg/VpGCex8Tf9U5E iqr9TYPG2p4ZqB8pMZUy0aYAjCbNXwr4X4OySWQIRb2ENsdw6BmVL4WncPWnsotI9zCl VSdKH6VTball0caWmYuloZO7vTzRxNa7hMIVkdsnLgJoBUqZOWyrduMKdjdIMMixeVM5 2/+g== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id m14-v6si12953227pgd.518.2018.05.23.16.26.44; Wed, 23 May 2018 16:26:59 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S935127AbeEWX00 (ORCPT + 99 others); Wed, 23 May 2018 19:26:26 -0400 Received: from out03.mta.xmission.com ([166.70.13.233]:56728 "EHLO out03.mta.xmission.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S934671AbeEWX0Y (ORCPT ); Wed, 23 May 2018 19:26:24 -0400 Received: from in02.mta.xmission.com ([166.70.13.52]) by out03.mta.xmission.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.87) (envelope-from ) id 1fLd9D-0002Pf-TQ; Wed, 23 May 2018 17:26:23 -0600 Received: from [97.119.174.25] (helo=x220.int.ebiederm.org) by in02.mta.xmission.com with esmtpsa (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.87) (envelope-from ) id 1fLd9C-0004ID-Ux; Wed, 23 May 2018 17:26:23 -0600 From: "Eric W. Biederman" To: Linux Containers Cc: linux-fsdevel@vger.kernel.org, Seth Forshee , "Serge E. Hallyn" , Christian Brauner , linux-kernel@vger.kernel.org, "Eric W. Biederman" Date: Wed, 23 May 2018 18:25:33 -0500 Message-Id: <20180523232538.4880-1-ebiederm@xmission.com> X-Mailer: git-send-email 2.14.1 In-Reply-To: <87o9h6554f.fsf@xmission.com> References: <87o9h6554f.fsf@xmission.com> X-XM-SPF: eid=1fLd9C-0004ID-Ux;;;mid=<20180523232538.4880-1-ebiederm@xmission.com>;;;hst=in02.mta.xmission.com;;;ip=97.119.174.25;;;frm=ebiederm@xmission.com;;;spf=neutral X-XM-AID: U2FsdGVkX19eKqJt0cpioD/yT+QSQ6u7kRu9a0uqwD4= X-SA-Exim-Connect-IP: 97.119.174.25 X-SA-Exim-Mail-From: ebiederm@xmission.com X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on sa03.xmission.com X-Spam-Level: ***** X-Spam-Status: No, score=5.8 required=8.0 tests=ALL_TRUSTED,BAYES_50, DCC_CHECK_NEGATIVE,TR_Symld_Words,T_TooManySym_01,XMNoVowels,XMSubLong, XMSubMetaSxObfu_03,XMSubMetaSx_00 autolearn=disabled version=3.4.0 X-Spam-Report: * -1.0 ALL_TRUSTED Passed through trusted hosts only via SMTP * 0.7 XMSubLong Long Subject * 1.5 TR_Symld_Words too many words that have symbols inside * 1.5 XMNoVowels Alpha-numberic number with no vowels * 0.8 BAYES_50 BODY: Bayes spam probability is 40 to 60% * [score: 0.5000] * -0.0 DCC_CHECK_NEGATIVE Not listed in DCC * [sa03 1397; Body=1 Fuz1=1 Fuz2=1] * 1.0 XMSubMetaSx_00 1+ Sexy Words * 0.0 T_TooManySym_01 4+ unique symbols in subject * 1.2 XMSubMetaSxObfu_03 Obfuscated Sexy Noun-People X-Spam-DCC: XMission; sa03 1397; Body=1 Fuz1=1 Fuz2=1 X-Spam-Combo: *****;Linux Containers X-Spam-Relay-Country: X-Spam-Timing: total 564 ms - load_scoreonly_sql: 0.06 (0.0%), signal_user_changed: 3.0 (0.5%), b_tie_ro: 2.0 (0.4%), parse: 1.20 (0.2%), extract_message_metadata: 25 (4.4%), get_uri_detail_list: 2.2 (0.4%), tests_pri_-1000: 10 (1.8%), tests_pri_-950: 2.2 (0.4%), tests_pri_-900: 1.81 (0.3%), tests_pri_-400: 27 (4.8%), check_bayes: 25 (4.5%), b_tokenize: 10 (1.7%), b_tok_get_all: 6 (1.1%), b_comp_prob: 3.4 (0.6%), b_tok_touch_all: 2.6 (0.5%), b_finish: 0.88 (0.2%), tests_pri_0: 480 (85.1%), check_dkim_signature: 0.81 (0.1%), check_dkim_adsp: 4.7 (0.8%), tests_pri_500: 9 (1.5%), rewrite_mail: 0.00 (0.0%) Subject: [REVIEW][PATCH 1/6] vfs: Don't allow changing the link count of an inode with an invalid uid or gid X-Spam-Flag: No X-SA-Exim-Version: 4.2.1 (built Thu, 05 May 2016 13:38:54 -0600) X-SA-Exim-Scanned: Yes (on in02.mta.xmission.com) Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Changing the link count of an inode via unlink or link will cause a write back of that inode. If the uids or gids are invalid (aka not known to the kernel) writing the inode back may change the uid or gid in the filesystem. To prevent possible filesystem and to avoid the need for filesystem maintainers to worry about it don't allow operations on inodes with an invalid uid or gid. Signed-off-by: "Eric W. Biederman" --- fs/namei.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/fs/namei.c b/fs/namei.c index 186bd2464fd5..942c1f096f6b 100644 --- a/fs/namei.c +++ b/fs/namei.c @@ -984,13 +984,15 @@ static bool safe_hardlink_source(struct inode *inode) */ static int may_linkat(struct path *link) { - struct inode *inode; + struct inode *inode = link->dentry->d_inode; + + /* Inode writeback is not safe when the uid or gid are invalid. */ + if (!uid_valid(inode->i_uid) || !gid_valid(inode->i_gid)) + return -EOVERFLOW; if (!sysctl_protected_hardlinks) return 0; - inode = link->dentry->d_inode; - /* Source inode owner (or CAP_FOWNER) can hardlink all they like, * otherwise, it must be a safe source. */ @@ -2749,6 +2751,11 @@ static int may_delete(struct inode *dir, struct dentry *victim, bool isdir) BUG_ON(!inode); BUG_ON(victim->d_parent->d_inode != dir); + + /* Inode writeback is not safe when the uid or gid are invalid. */ + if (!uid_valid(inode->i_uid) || !gid_valid(inode->i_gid)) + return -EOVERFLOW; + audit_inode_child(dir, victim, AUDIT_TYPE_CHILD_DELETE); error = inode_permission(dir, MAY_WRITE | MAY_EXEC); -- 2.14.1