diff options
| author | Ilya Dryomov <idryomov@gmail.com> | 2020-09-03 13:24:11 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2020-09-23 08:44:25 +0200 |
| commit | e349a5786f4c23eb11d1e7385703ddbf94f3f061 (patch) | |
| tree | eaeb09e3be739da4a0cc64db70112ec430d8f0db /drivers/block | |
| parent | 2bd7dd40de9f171de3585f3dac2d4271d359d841 (diff) | |
| download | linux-stable-e349a5786f4c23eb11d1e7385703ddbf94f3f061.tar.gz linux-stable-e349a5786f4c23eb11d1e7385703ddbf94f3f061.tar.bz2 linux-stable-e349a5786f4c23eb11d1e7385703ddbf94f3f061.zip | |
rbd: require global CAP_SYS_ADMIN for mapping and unmapping
commit f44d04e696feaf13d192d942c4f14ad2e117065a upstream.
It turns out that currently we rely only on sysfs attribute
permissions:
$ ll /sys/bus/rbd/{add*,remove*}
--w------- 1 root root 4096 Sep 3 20:37 /sys/bus/rbd/add
--w------- 1 root root 4096 Sep 3 20:37 /sys/bus/rbd/add_single_major
--w------- 1 root root 4096 Sep 3 20:37 /sys/bus/rbd/remove
--w------- 1 root root 4096 Sep 3 20:38 /sys/bus/rbd/remove_single_major
This means that images can be mapped and unmapped (i.e. block devices
can be created and deleted) by a UID 0 process even after it drops all
privileges or by any process with CAP_DAC_OVERRIDE in its user namespace
as long as UID 0 is mapped into that user namespace.
Be consistent with other virtual block devices (loop, nbd, dm, md, etc)
and require CAP_SYS_ADMIN in the initial user namespace for mapping and
unmapping, and also for dumping the configuration string and refreshing
the image header.
Cc: stable@vger.kernel.org
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/block')
| -rw-r--r-- | drivers/block/rbd.c | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c index e0699a20859f..445ca973edd6 100644 --- a/drivers/block/rbd.c +++ b/drivers/block/rbd.c @@ -3945,6 +3945,9 @@ static ssize_t rbd_image_refresh(struct device *dev, struct rbd_device *rbd_dev = dev_to_rbd_dev(dev); int ret; + if (!capable(CAP_SYS_ADMIN)) + return -EPERM; + ret = rbd_dev_refresh(rbd_dev); if (ret) return ret; @@ -5404,6 +5407,9 @@ static ssize_t do_rbd_add(struct bus_type *bus, bool read_only; int rc; + if (!capable(CAP_SYS_ADMIN)) + return -EPERM; + if (!try_module_get(THIS_MODULE)) return -ENODEV; @@ -5548,6 +5554,9 @@ static ssize_t do_rbd_remove(struct bus_type *bus, bool already = false; int ret; + if (!capable(CAP_SYS_ADMIN)) + return -EPERM; + ret = kstrtoul(buf, 10, &ul); if (ret) return ret; |