diff options
Diffstat (limited to 'debian/patches/bugfix/all/ovl-fail-on-invalid-uid-gid-mapping-at-copy-up.patch')
| -rw-r--r-- | debian/patches/bugfix/all/ovl-fail-on-invalid-uid-gid-mapping-at-copy-up.patch | 49 |
1 files changed, 49 insertions, 0 deletions
diff --git a/debian/patches/bugfix/all/ovl-fail-on-invalid-uid-gid-mapping-at-copy-up.patch b/debian/patches/bugfix/all/ovl-fail-on-invalid-uid-gid-mapping-at-copy-up.patch new file mode 100644 index 000000000..368787579 --- /dev/null +++ b/debian/patches/bugfix/all/ovl-fail-on-invalid-uid-gid-mapping-at-copy-up.patch @@ -0,0 +1,49 @@ +From: Miklos Szeredi <mszeredi@redhat.com> +Date: Tue, 24 Jan 2023 16:41:18 +0100 +Subject: ovl: fail on invalid uid/gid mapping at copy up +Origin: https://git.kernel.org/linus/4f11ada10d0ad3fd53e2bd67806351de63a4f9c3 +Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2023-0386 + +If st_uid/st_gid doesn't have a mapping in the mounter's user_ns, then +copy-up should fail, just like it would fail if the mounter task was doing +the copy using "cp -a". + +There's a corner case where the "cp -a" would succeed but copy up fail: if +there's a mapping of the invalid uid/gid (65534 by default) in the user +namespace. This is because stat(2) will return this value if the mapping +doesn't exist in the current user_ns and "cp -a" will in turn be able to +create a file with this uid/gid. + +This behavior would be inconsistent with POSIX ACL's, which return -1 for +invalid uid/gid which result in a failed copy. + +For consistency and simplicity fail the copy of the st_uid/st_gid are +invalid. + +Fixes: 459c7c565ac3 ("ovl: unprivieged mounts") +Cc: <stable@vger.kernel.org> # v5.11 +Signed-off-by: Miklos Szeredi <mszeredi@redhat.com> +Reviewed-by: Christian Brauner <brauner@kernel.org> +Reviewed-by: Seth Forshee <sforshee@kernel.org> +--- + fs/overlayfs/copy_up.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c +index 140f2742074d..c14e90764e35 100644 +--- a/fs/overlayfs/copy_up.c ++++ b/fs/overlayfs/copy_up.c +@@ -1011,6 +1011,10 @@ static int ovl_copy_up_one(struct dentry *parent, struct dentry *dentry, + if (err) + return err; + ++ if (!kuid_has_mapping(current_user_ns(), ctx.stat.uid) || ++ !kgid_has_mapping(current_user_ns(), ctx.stat.gid)) ++ return -EOVERFLOW; ++ + ctx.metacopy = ovl_need_meta_copy_up(dentry, ctx.stat.mode, flags); + + if (parent) { +-- +2.40.1 + |