lkml.org 
[lkml]   [2019]   [Feb]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Date
    Subject[PATCH 3.16 160/305] mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts
    3.16.63-rc1 review patch.  If anyone has any objections, please let me know.

    ------------------

    From: "Eric W. Biederman" <ebiederm@xmission.com>

    commit df7342b240185d58d3d9665c0bbf0a0f5570ec29 upstream.

    Jonathan Calmels from NVIDIA reported that he's able to bypass the
    mount visibility security check in place in the Linux kernel by using
    a combination of the unbindable property along with the private mount
    propagation option to allow a unprivileged user to see a path which
    was purposefully hidden by the root user.

    Reproducer:
    # Hide a path to all users using a tmpfs
    root@castiana:~# mount -t tmpfs tmpfs /sys/devices/
    root@castiana:~#

    # As an unprivileged user, unshare user namespace and mount namespace
    stgraber@castiana:~$ unshare -U -m -r

    # Confirm the path is still not accessible
    root@castiana:~# ls /sys/devices/

    # Make /sys recursively unbindable and private
    root@castiana:~# mount --make-runbindable /sys
    root@castiana:~# mount --make-private /sys

    # Recursively bind-mount the rest of /sys over to /mnnt
    root@castiana:~# mount --rbind /sys/ /mnt

    # Access our hidden /sys/device as an unprivileged user
    root@castiana:~# ls /mnt/devices/
    breakpoint cpu cstate_core cstate_pkg i915 intel_pt isa kprobe
    LNXSYSTM:00 msr pci0000:00 platform pnp0 power software system
    tracepoint uncore_arb uncore_cbox_0 uncore_cbox_1 uprobe virtual

    Solve this by teaching copy_tree to fail if a mount turns out to be
    both unbindable and locked.

    Fixes: 5ff9d8a65ce8 ("vfs: Lock in place mounts from more privileged users")
    Reported-by: Jonathan Calmels <jcalmels@nvidia.com>
    Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    ---
    fs/namespace.c | 10 ++++++++--
    1 file changed, 8 insertions(+), 2 deletions(-)

    --- a/fs/namespace.c
    +++ b/fs/namespace.c
    @@ -1574,8 +1574,14 @@ struct mount *copy_tree(struct mount *mn
    struct mount *t = NULL;
    if (!(flag & CL_COPY_UNBINDABLE) &&
    IS_MNT_UNBINDABLE(s)) {
    - s = skip_mnt_tree(s);
    - continue;
    + if (s->mnt.mnt_flags & MNT_LOCKED) {
    + /* Both unbindable and locked. */
    + q = ERR_PTR(-EPERM);
    + goto out;
    + } else {
    + s = skip_mnt_tree(s);
    + continue;
    + }
    }
    if (!(flag & CL_COPY_MNT_NS_FILE) &&
    is_mnt_ns_file(s->mnt.mnt_root)) {
    \
     
     \ /
      Last update: 2019-02-03 15:28    [W:4.833 / U:0.864 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site