From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-pa0-f43.google.com ([209.85.220.43]:34988 "EHLO mail-pa0-f43.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754957AbcILStM (ORCPT ); Mon, 12 Sep 2016 14:49:12 -0400 Received: by mail-pa0-f43.google.com with SMTP id b2so53333342pat.2 for ; Mon, 12 Sep 2016 11:49:11 -0700 (PDT) Date: Mon, 12 Sep 2016 11:49:02 -0700 From: Eric Biggers To: gregkh@linuxfoundation.org Cc: tytso@mit.edu, stable@vger.kernel.org, stable-commits@vger.kernel.org Subject: Re: Patch "fscrypto: add authorization check for setting encryption policy" has been added to the 4.7-stable tree Message-ID: <20160912184902.GB7129@google.com> References: <147369353118593@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <147369353118593@kroah.com> Sender: stable-owner@vger.kernel.org List-ID: On Mon, Sep 12, 2016 at 05:18:51PM +0200, gregkh@linuxfoundation.org wrote: > > This is a note to let you know that I've just added the patch titled > > fscrypto: add authorization check for setting encryption policy > > to the 4.7-stable tree which can be found at: > http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary For the 4.7 kernel, fs/ext4/crypto_policy.c needs to be patched as well since the buggy code was duplicated there. Here is the correct diff: diff --git a/fs/crypto/policy.c b/fs/crypto/policy.c index 0f9961e..c9800b1 100644 --- a/fs/crypto/policy.c +++ b/fs/crypto/policy.c @@ -95,6 +95,9 @@ static int create_encryption_context_from_policy(struct inode *inode, int fscrypt_process_policy(struct inode *inode, const struct fscrypt_policy *policy) { + if (!inode_owner_or_capable(inode)) + return -EACCES; + if (policy->version != 0) return -EINVAL; diff --git a/fs/ext4/crypto_policy.c b/fs/ext4/crypto_policy.c index ad05069..8a9feb3 100644 --- a/fs/ext4/crypto_policy.c +++ b/fs/ext4/crypto_policy.c @@ -102,6 +102,9 @@ static int ext4_create_encryption_context_from_policy( int ext4_process_policy(const struct ext4_encryption_policy *policy, struct inode *inode) { + if (!inode_owner_or_capable(inode)) + return -EACCES; + if (policy->version != 0) return -EINVAL; -- 2.8.0.rc3.226.g39d4020