diff mbox series

[SRU,X,CVE-2020-25284,v2,1/1] rbd: require global CAP_SYS_ADMIN for mapping and unmapping

Message ID 20200925163008.39727-3-william.gray@canonical.com
State New
Headers show
Series rbd: require global CAP_SYS_ADMIN for mapping and unmapping | expand

Commit Message

William Breathitt Gray Sept. 25, 2020, 4:30 p.m. UTC 
From: Ilya Dryomov <idryomov@gmail.com>

It turns out that currently we rely only on sysfs attribute
permissions:

  $ ll /sys/bus/rbd/{add*,remove*}
  --w------- 1 root root 4096 Sep  3 20:37 /sys/bus/rbd/add
  --w------- 1 root root 4096 Sep  3 20:37 /sys/bus/rbd/add_single_major
  --w------- 1 root root 4096 Sep  3 20:37 /sys/bus/rbd/remove
  --w------- 1 root root 4096 Sep  3 20:38 /sys/bus/rbd/remove_single_major

This means that images can be mapped and unmapped (i.e. block devices
can be created and deleted) by a UID 0 process even after it drops all
privileges or by any process with CAP_DAC_OVERRIDE in its user namespace
as long as UID 0 is mapped into that user namespace.

Be consistent with other virtual block devices (loop, nbd, dm, md, etc)
and require CAP_SYS_ADMIN in the initial user namespace for mapping and
unmapping, and also for dumping the configuration string and refreshing
the image header.

Cc: stable@vger.kernel.org
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>

CVE-2020-25284

(backported from commit f44d04e696feaf13d192d942c4f14ad2e117065a)
[ vilhelmgray: Remove changes for sysfs attr that does not exist ]
[ vilhelmgray: Context adjustments ]
Signed-off-by: William Breathitt Gray <william.gray@canonical.com>
---
Changes in v2:
 - Add missing code for do_rbd_add and do_rbd_remove

 drivers/block/rbd.c | 9 +++++++++
 1 file changed, 9 insertions(+)
diff mbox series

Patch

diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
index 995d9c432744..c66033b6b67f 100644
--- a/drivers/block/rbd.c
+++ b/drivers/block/rbd.c
@@ -3945,6 +3945,9 @@  static ssize_t rbd_image_refresh(struct device *dev,
 	struct rbd_device *rbd_dev = dev_to_rbd_dev(dev);
 	int ret;
 
+	if (!capable(CAP_SYS_ADMIN))
+		return -EPERM;
+
 	ret = rbd_dev_refresh(rbd_dev);
 	if (ret)
 		return ret;
@@ -5404,6 +5407,9 @@  static ssize_t do_rbd_add(struct bus_type *bus,
 	bool read_only;
 	int rc;
 
+	if (!capable(CAP_SYS_ADMIN))
+		return -EPERM;
+
 	if (!try_module_get(THIS_MODULE))
 		return -ENODEV;
 
@@ -5548,6 +5554,9 @@  static ssize_t do_rbd_remove(struct bus_type *bus,
 	bool already = false;
 	int ret;
 
+	if (!capable(CAP_SYS_ADMIN))
+		return -EPERM;
+
 	ret = kstrtoul(buf, 10, &ul);
 	if (ret)
 		return ret;