Commit d1fe96c0 authored Feb 02, 2018 by Vivek Goyal Committed by Miklos Szeredi Feb 26, 2018

ovl: redirect_dir=nofollow should not follow redirect for opaque lower



redirect_dir=nofollow should not follow a redirect. But in a specific
configuration it can still follow it.  For example try this.

$ mkdir -p lower0 lower1/foo upper work merged
$ touch lower1/foo/lower-file.txt
$ setfattr -n "trusted.overlay.opaque" -v "y" lower1/foo
$ mount -t overlay -o lowerdir=lower1:lower0,workdir=work,upperdir=upper,redirect_dir=on none merged
$ cd merged
$ mv foo foo-renamed
$ umount merged

# mount again. This time with redirect_dir=nofollow
$ mount -t overlay -o lowerdir=lower1:lower0,workdir=work,upperdir=upper,redirect_dir=nofollow none merged
$ ls merged/foo-renamed/
# This lists lower-file.txt, while it should not have.

Basically, we are doing redirect check after we check for d.stop. And
if this is not last lower, and we find an opaque lower, d.stop will be
set.

ovl_lookup_single()
        if (!d->last && ovl_is_opaquedir(this)) {
                d->stop = d->opaque = true;
                goto out;
        }

To fix this, first check redirect is allowed. And after that check if
d.stop has been set or not.

Signed-off-by: Vivek Goyal <vgoyal@redhat.com>
Fixes: 438c84c2 ("ovl: don't follow redirects if redirect_dir=off")
Cc: <stable@vger.kernel.org> #v4.15
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>

parent b5095f24

fs/overlayfs/namei.c

+3 −3

Original line number	Diff line number	Diff line
		@@ -913,9 +913,6 @@ struct dentry ovl_lookup(struct inode dir, struct dentry *dentry,
		stack[ctr].layer = lower.layer;
		ctr++;

		if (d.stop)
		break;

		/*
		* Following redirects can have security consequences: it's like
		* a symlink into the lower layer without the permission checks.
		@@ -933,6 +930,9 @@ struct dentry ovl_lookup(struct inode dir, struct dentry *dentry,
		goto out_put;
		}

		if (d.stop)
		break;

		if (d.redirect && d.redirect[0] == '/' && poe != roe) {
		poe = roe;
		/* Find the current layer on the root dentry */

Admin message