Re: [PATCH review 03/18] umount: Disallow unprivileged mount force

Andy Lutomirski
2014-12-12T23:07:28Z

On Fri, Dec 12, 2014 at 2:48 PM, Eric W. Biederman
<ebiederm@xmission.com> wrote:
> Forced unmount affects not just the mount namespace but the underlying
> superblock as well. Restrict forced unmount to the global root user
> for now. Otherwise it becomes possible a user in a less privileged
> mount namespace to force the shutdown of a superblock of a filesystem
> in a more privileged mount namespace, allowing a DOS attack on root.
>

I thought I already fixed this. Did I miss part of it?

> Cc: stable@vger.kernel.org
> Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
> ---
> fs/namespace.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/fs/namespace.c b/fs/namespace.c
> index 3a1a87dc33df..43b16af8af30 100644
> --- a/fs/namespace.c
> +++ b/fs/namespace.c
> @@ -1544,6 +1544,9 @@ SYSCALL_DEFINE2(umount, char __user *, name, int, flags)
> goto dput_and_out;
> if (mnt->mnt.mnt_flags & MNT_LOCKED)
> goto dput_and_out;
> + retval = -EPERM;
> + if (flags & MNT_FORCE && !capable(CAP_SYS_ADMIN))
> + goto dput_and_out;
>
> retval = do_umount(mnt, flags);
> dput_and_out:
> --
> 1.9.1
>

--
Andy Lutomirski
AMA Capital Management, LLC