Re: [PATCH] ext4: check CAP_SYS_ADMIN in ext4_ioctl_get_tune_sb()

["Theodore Tso" <tytso@mit.edu>]

On Tue, Oct 13, 2026 at 10:01:45AM -0500, Guanglei Zhu wrote:
> 
> You are probably right that reading these parameters is not
> sensitive on its own: most of them are already visible through
> /proc/mounts or statfs(), and the superblock is readable by anyone
> with read access to the block device.  The argument of my patch was
> the asymmetry with the SET side rather than an actual leak.
> 
> I'm happy to drop this patch if Ted confirms that the missing check
> was deliberate.

Yes, it's deliberate, precisely because the parameters are visible in
/proc/mounts and in /proc/fs/ext4/<block>/options.  (The latter shows
*all* of the mount parameters currently active, whereas the former
show those mount options which differ from the defaults.)

There should be nothing in the file system parameters which are
secret; things like keying information for fscrypt are not passed in
the mount options, for Very Good Reasons; instead we use the Linux Key
Management facility[1].  As far as I'm concerned, storing passwords in
the mount options ala cifs[2] is an anti-pattern.

[1]  https://man7.org/linux/man-pages/man7/keyrings.7.html
[2]  https://man7.org/linux/man-pages/man8/mount.cifs.8.html

     	   	 	       	      	       - Ted