reiserfs: fix permissions on .reiserfs_priv (cac36f70) · Commits · 戴 / test

Commit ("reiserfs: remove privroot hiding in lookup") removed the magic from the lookup code to hide the .reiserfs_priv directory since it was getting loaded at mount-time instead. The intent was that the entry would be hidden from the user via a poisoned d_compare, but this was faulty. This introduced a security issue where unprivileged users could access and modify extended attributes or ACLs belonging to other users, including root. This patch resolves the issue by properly hiding .reiserfs_priv. This was the intent of the xattr poisoning code, but it appears to have never worked as expected. This is fixed by using d_revalidate instead of d_compare. This patch makes -oexpose_privroot a no-op. I'm fine leaving it this way. The effort involved in working out the corner cases wrt permissions and caching outweigh the benefit of the feature. Signed-off-by:

Jeff Mahoney <jeffm@suse.com> Acked-by:

Edward Shishkin <edward.shishkin@gmail.com> Reported-by:

Matt McCutchen <matt@mattmccutchen.net> Tested-by:

Matt McCutchen <matt@mattmccutchen.net> Cc: Frederic Weisbecker <fweisbec@gmail.com> Cc: Al Viro <viro@zeniv.linux.org.uk> Cc: <stable@kernel.org> Signed-off-by:

Andrew Morton <akpm@linux-foundation.org> Signed-off-by:

Linus Torvalds <torvalds@linux-foundation.org>

fs/reiserfs/dir.c

+0 −2

Original line number	Diff line number	Diff line
		@@ -46,8 +46,6 @@ static inline bool is_privroot_deh(struct dentry *dir,
		struct reiserfs_de_head *deh)
		{
		struct dentry *privroot = REISERFS_SB(dir->d_sb)->priv_root;
		if (reiserfs_expose_privroot(dir->d_sb))
		return 0;
		return (dir == dir->d_parent && privroot->d_inode &&
		deh->deh_objectid == INODE_PKEY(privroot->d_inode)->k_objectid);
		}

fs/reiserfs/xattr.c

+4 −13

Original line number	Diff line number	Diff line
		@@ -973,21 +973,13 @@ int reiserfs_permission(struct inode *inode, int mask)
		return generic_permission(inode, mask, NULL);
		}

		/* This will catch lookups from the fs root to .reiserfs_priv */
		static int
		xattr_lookup_poison(struct dentry dentry, struct qstr q1, struct qstr *name)
		static int xattr_hide_revalidate(struct dentry dentry, struct nameidata nd)
		{
		struct dentry *priv_root = REISERFS_SB(dentry->d_sb)->priv_root;
		if (container_of(q1, struct dentry, d_name) == priv_root)
		return -ENOENT;
		if (q1->len == name->len &&
		!memcmp(q1->name, name->name, name->len))
		return 0;
		return 1;
		return -EPERM;
		}

		static const struct dentry_operations xattr_lookup_poison_ops = {
		.d_compare = xattr_lookup_poison,
		.d_revalidate = xattr_hide_revalidate,
		};

		int reiserfs_lookup_privroot(struct super_block *s)
		@@ -1001,8 +993,7 @@ int reiserfs_lookup_privroot(struct super_block *s)
		strlen(PRIVROOT_NAME));
		if (!IS_ERR(dentry)) {
		REISERFS_SB(s)->priv_root = dentry;
		if (!reiserfs_expose_privroot(s))
		s->s_root->d_op = &xattr_lookup_poison_ops;
		dentry->d_op = &xattr_lookup_poison_ops;
		if (dentry->d_inode)
		dentry->d_inode->i_flags \|= S_PRIVATE;
		} else

Admin message