diff options
| author | Eric Biggers <ebiggers@google.com> | 2016-09-08 10:57:08 -0700 |
|---|---|---|
| committer | Theodore Ts'o <tytso@mit.edu> | 2016-09-09 23:37:14 -0400 |
| commit | 163ae1c6ad6299b19e22b4a35d5ab24a89791a98 (patch) | |
| tree | 5a351f56caaf3180dc3f04a2bcab9549724503d9 | |
| parent | c6935931c1894ff857616ff8549b61236a19148f (diff) | |
| download | lwn-163ae1c6ad6299b19e22b4a35d5ab24a89791a98.tar.gz lwn-163ae1c6ad6299b19e22b4a35d5ab24a89791a98.zip | |
fscrypto: add authorization check for setting encryption policy
On an ext4 or f2fs filesystem with file encryption supported, a user
could set an encryption policy on any empty directory(*) to which they
had readonly access. This is obviously problematic, since such a
directory might be owned by another user and the new encryption policy
would prevent that other user from creating files in their own directory
(for example).
Fix this by requiring inode_owner_or_capable() permission to set an
encryption policy. This means that either the caller must own the file,
or the caller must have the capability CAP_FOWNER.
(*) Or also on any regular file, for f2fs v4.6 and later and ext4
v4.8-rc1 and later; a separate bug fix is coming for that.
Signed-off-by: Eric Biggers <ebiggers@google.com>
Cc: stable@vger.kernel.org # 4.1+; check fs/{ext4,f2fs}
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
| -rw-r--r-- | fs/crypto/policy.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/fs/crypto/policy.c b/fs/crypto/policy.c index 0f9961eede1e..c9800b1a2e93 100644 --- a/fs/crypto/policy.c +++ b/fs/crypto/policy.c @@ -95,6 +95,9 @@ static int create_encryption_context_from_policy(struct inode *inode, int fscrypt_process_policy(struct inode *inode, const struct fscrypt_policy *policy) { + if (!inode_owner_or_capable(inode)) + return -EACCES; + if (policy->version != 0) return -EINVAL; |