From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.linuxfoundation.org ([140.211.169.12]:40130 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751190AbcITMKl (ORCPT ); Tue, 20 Sep 2016 08:10:41 -0400 Subject: Patch "fscrypto: require write access to mount to set encryption policy" has been added to the 4.4-stable tree To: ebiggers@google.com, gregkh@linuxfoundation.org, jaegeuk@kernel.org, tytso@mit.edu Cc: , From: Date: Tue, 20 Sep 2016 14:10:46 +0200 Message-ID: <147437344620352@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org List-ID: This is a note to let you know that I've just added the patch titled fscrypto: require write access to mount to set encryption policy to the 4.4-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: fscrypto-require-write-access-to-mount-to-set-encryption-policy.patch and it can be found in the queue-4.4 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let know about it. >>From ba63f23d69a3a10e7e527a02702023da68ef8a6d Mon Sep 17 00:00:00 2001 From: Eric Biggers Date: Thu, 8 Sep 2016 14:20:38 -0700 Subject: fscrypto: require write access to mount to set encryption policy From: Eric Biggers commit ba63f23d69a3a10e7e527a02702023da68ef8a6d upstream. Since setting an encryption policy requires writing metadata to the filesystem, it should be guarded by mnt_want_write/mnt_drop_write. Otherwise, a user could cause a write to a frozen or readonly filesystem. This was handled correctly by f2fs but not by ext4. Make fscrypt_process_policy() handle it rather than relying on the filesystem to get it right. Signed-off-by: Eric Biggers Cc: stable@vger.kernel.org # 4.1+; check fs/{ext4,f2fs} Signed-off-by: Theodore Ts'o Acked-by: Jaegeuk Kim Signed-off-by: Greg Kroah-Hartman --- fs/ext4/ioctl.c | 6 ++++++ 1 file changed, 6 insertions(+) --- a/fs/ext4/ioctl.c +++ b/fs/ext4/ioctl.c @@ -629,7 +629,13 @@ resizefs_out: goto encryption_policy_out; } + err = mnt_want_write_file(filp); + if (err) + goto encryption_policy_out; + err = ext4_process_policy(&policy, inode); + + mnt_drop_write_file(filp); encryption_policy_out: return err; #else Patches currently in stable-queue which might be from ebiggers@google.com are queue-4.4/fscrypto-require-write-access-to-mount-to-set-encryption-policy.patch queue-4.4/fscrypto-add-authorization-check-for-setting-encryption-policy.patch