From patchwork Sun Jan 1 11:04:28 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Fabian Frederick X-Patchwork-Id: 709998 Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 3try666RPmz9sCM for ; Sun, 1 Jan 2017 22:05:02 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754968AbdAALEf (ORCPT ); Sun, 1 Jan 2017 06:04:35 -0500 Received: from mailrelay101.isp.belgacom.be ([195.238.20.128]:45913 "EHLO mailrelay101.isp.belgacom.be" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752517AbdAALEe (ORCPT ); Sun, 1 Jan 2017 06:04:34 -0500 X-Belgacom-Dynamic: yes X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A2ATBAAP4WhY/2ZisVtdDg8GDIM4AQEBA?= =?us-ascii?q?QEfQIErjVdyk3cBkmWCD4IIhiKBYEAUAQIBAQEBAQEBYiiFFi8jT0skARKIYxG?= =?us-ascii?q?xDDqKaoZFjwgFiFyHbIo1kT4CkFNIkXUfOIEqg0IBThyBIzw9NIkPAQEB?= X-IPAS-Result: =?us-ascii?q?A2ATBAAP4WhY/2ZisVtdDg8GDIM4AQEBAQEfQIErjVdyk3c?= =?us-ascii?q?BkmWCD4IIhiKBYEAUAQIBAQEBAQEBYiiFFi8jT0skARKIYxGxDDqKaoZFjwgFi?= =?us-ascii?q?FyHbIo1kT4CkFNIkXUfOIEqg0IBThyBIzw9NIkPAQEB?= Received: from 102.98-177-91.adsl-dyn.isp.belgacom.be (HELO inkjet2.lan) ([91.177.98.102]) by relay.skynet.be with ESMTP; 01 Jan 2017 12:04:32 +0100 From: Fabian Frederick To: tytso@mit.edu, Andreas Dilger Cc: linux-ext4@vger.kernel.org, linux-kernel@vger.kernel.org, fabf@skynet.be Subject: [PATCH V2 1/2 linux-next] ext4: check inode permissions in ext4_ioctl() Date: Sun, 1 Jan 2017 12:04:28 +0100 Message-Id: <1483268668-32246-1-git-send-email-fabf@skynet.be> X-Mailer: git-send-email 2.7.4 Sender: linux-ext4-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-ext4@vger.kernel.org According to other FS like UDF, ioctl has to check if inode is readable before proceeding otherwise permissions updated between file opening and ioctl are ignored. Set operations were already protected but nothing around get like EXT4_IOC_GETVERSION This patch applies the same test than udf_ioctl() but returns -EACCES "permission denied" like the rest of ext4_ioctl() Signed-off-by: Fabian Frederick --- V2: check readability in get operations only. fs/ext4/ioctl.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c index 49fd137..f665c02 100644 --- a/fs/ext4/ioctl.c +++ b/fs/ext4/ioctl.c @@ -453,6 +453,9 @@ long ext4_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) switch (cmd) { case EXT4_IOC_GETFLAGS: + if (inode_permission(inode, MAY_READ) != 0) + return -EACCES; + ext4_get_inode_flags(ei); flags = ei->i_flags & EXT4_FL_USER_VISIBLE; return put_user(flags, (int __user *) arg); @@ -489,6 +492,9 @@ long ext4_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) } case EXT4_IOC_GETVERSION: case EXT4_IOC_GETVERSION_OLD: + if (inode_permission(inode, MAY_READ) != 0) + return -EACCES; + return put_user(inode->i_generation, (int __user *) arg); case EXT4_IOC_SETVERSION: case EXT4_IOC_SETVERSION_OLD: { @@ -834,12 +840,18 @@ long ext4_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) #endif } case EXT4_IOC_GET_ENCRYPTION_POLICY: + if (inode_permission(inode, MAY_READ) != 0) + return -EACCES; + return fscrypt_ioctl_get_policy(filp, (void __user *)arg); case EXT4_IOC_FSGETXATTR: { struct fsxattr fa; + if (inode_permission(inode, MAY_READ) != 0) + return -EACCES; + memset(&fa, 0, sizeof(struct fsxattr)); ext4_get_inode_flags(ei); fa.fsx_xflags = ext4_iflags_to_xflags(ei->i_flags & EXT4_FL_USER_VISIBLE);