Patch "fscrypto: add authorization check for setting encryption policy" has been added to the 4.7-stable tree

Patch "fscrypto: add authorization check for setting encryption policy" has been added to the 4.7-stable tree

[gregkh]

This is a note to let you know that I've just added the patch titled

    fscrypto: add authorization check for setting encryption policy

to the 4.7-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     fscrypto-add-authorization-check-for-setting-encryption-policy.patch
and it can be found in the queue-4.7 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.


>From 163ae1c6ad6299b19e22b4a35d5ab24a89791a98 Mon Sep 17 00:00:00 2001
From: Eric Biggers <ebiggers@google.com>
Date: Thu, 8 Sep 2016 10:57:08 -0700
Subject: fscrypto: add authorization check for setting encryption policy

From: Eric Biggers <ebiggers@google.com>

commit 163ae1c6ad6299b19e22b4a35d5ab24a89791a98 upstream.

On an ext4 or f2fs filesystem with file encryption supported, a user
could set an encryption policy on any empty directory(*) to which they
had readonly access.  This is obviously problematic, since such a
directory might be owned by another user and the new encryption policy
would prevent that other user from creating files in their own directory
(for example).

Fix this by requiring inode_owner_or_capable() permission to set an
encryption policy.  This means that either the caller must own the file,
or the caller must have the capability CAP_FOWNER.

(*) Or also on any regular file, for f2fs v4.6 and later and ext4
    v4.8-rc1 and later; a separate bug fix is coming for that.

Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/crypto/policy.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/fs/crypto/policy.c
+++ b/fs/crypto/policy.c
@@ -95,6 +95,9 @@ static int create_encryption_context_fro
 int fscrypt_process_policy(struct inode *inode,
 				const struct fscrypt_policy *policy)
 {
+	if (!inode_owner_or_capable(inode))
+		return -EACCES;
+
 	if (policy->version != 0)
 		return -EINVAL;
 


Patches currently in stable-queue which might be from ebiggers@google.com are

queue-4.7/fscrypto-add-authorization-check-for-setting-encryption-policy.patch
queue-4.7/fscrypto-only-allow-setting-encryption-policy-on-directories.patch

Re: Patch "fscrypto: add authorization check for setting encryption policy" has been added to the 4.7-stable tree

[Eric Biggers]

On Mon, Sep 12, 2016 at 05:18:51PM +0200, gregkh@linuxfoundation.org wrote:
> 
> This is a note to let you know that I've just added the patch titled
> 
>     fscrypto: add authorization check for setting encryption policy
> 
> to the 4.7-stable tree which can be found at:
>     http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

For the 4.7 kernel, fs/ext4/crypto_policy.c needs to be patched as well since
the buggy code was duplicated there.  Here is the correct diff:

diff --git a/fs/crypto/policy.c b/fs/crypto/policy.c
index 0f9961e..c9800b1 100644
--- a/fs/crypto/policy.c
+++ b/fs/crypto/policy.c
@@ -95,6 +95,9 @@ static int create_encryption_context_from_policy(struct inode *inode,
 int fscrypt_process_policy(struct inode *inode,
 				const struct fscrypt_policy *policy)
 {
+	if (!inode_owner_or_capable(inode))
+		return -EACCES;
+
 	if (policy->version != 0)
 		return -EINVAL;
 
diff --git a/fs/ext4/crypto_policy.c b/fs/ext4/crypto_policy.c
index ad05069..8a9feb3 100644
--- a/fs/ext4/crypto_policy.c
+++ b/fs/ext4/crypto_policy.c
@@ -102,6 +102,9 @@ static int ext4_create_encryption_context_from_policy(
 int ext4_process_policy(const struct ext4_encryption_policy *policy,
 			struct inode *inode)
 {
+	if (!inode_owner_or_capable(inode))
+		return -EACCES;
+
 	if (policy->version != 0)
 		return -EINVAL;
 
-- 
2.8.0.rc3.226.g39d4020

Re: Patch "fscrypto: add authorization check for setting encryption policy" has been added to the 4.7-stable tree

[Theodore Ts'o]

On Mon, Sep 12, 2016 at 11:49:02AM -0700, Eric Biggers wrote:
> On Mon, Sep 12, 2016 at 05:18:51PM +0200, gregkh@linuxfoundation.org wrote:
> > 
> > This is a note to let you know that I've just added the patch titled
> > 
> >     fscrypto: add authorization check for setting encryption policy
> > 
> > to the 4.7-stable tree which can be found at:
> >     http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
> 
> For the 4.7 kernel, fs/ext4/crypto_policy.c needs to be patched as well since
> the buggy code was duplicated there.  Here is the correct diff:

Acked-by: Theodore Ts'o <tytso@mit.edu>

> 
> diff --git a/fs/crypto/policy.c b/fs/crypto/policy.c
> index 0f9961e..c9800b1 100644
> --- a/fs/crypto/policy.c
> +++ b/fs/crypto/policy.c
> @@ -95,6 +95,9 @@ static int create_encryption_context_from_policy(struct inode *inode,
>  int fscrypt_process_policy(struct inode *inode,
>  				const struct fscrypt_policy *policy)
>  {
> +	if (!inode_owner_or_capable(inode))
> +		return -EACCES;
> +
>  	if (policy->version != 0)
>  		return -EINVAL;
>  
> diff --git a/fs/ext4/crypto_policy.c b/fs/ext4/crypto_policy.c
> index ad05069..8a9feb3 100644
> --- a/fs/ext4/crypto_policy.c
> +++ b/fs/ext4/crypto_policy.c
> @@ -102,6 +102,9 @@ static int ext4_create_encryption_context_from_policy(
>  int ext4_process_policy(const struct ext4_encryption_policy *policy,
>  			struct inode *inode)
>  {
> +	if (!inode_owner_or_capable(inode))
> +		return -EACCES;
> +
>  	if (policy->version != 0)
>  		return -EINVAL;
>  
> -- 
> 2.8.0.rc3.226.g39d4020
> 

Re: Patch "fscrypto: add authorization check for setting encryption policy" has been added to the 4.7-stable tree

[Greg KH]

On Mon, Sep 12, 2016 at 11:49:02AM -0700, Eric Biggers wrote:
> On Mon, Sep 12, 2016 at 05:18:51PM +0200, gregkh@linuxfoundation.org wrote:
> > 
> > This is a note to let you know that I've just added the patch titled
> > 
> >     fscrypto: add authorization check for setting encryption policy
> > 
> > to the 4.7-stable tree which can be found at:
> >     http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
> 
> For the 4.7 kernel, fs/ext4/crypto_policy.c needs to be patched as well since
> the buggy code was duplicated there.  Here is the correct diff:
> 
> diff --git a/fs/crypto/policy.c b/fs/crypto/policy.c
> index 0f9961e..c9800b1 100644
> --- a/fs/crypto/policy.c
> +++ b/fs/crypto/policy.c
> @@ -95,6 +95,9 @@ static int create_encryption_context_from_policy(struct inode *inode,
>  int fscrypt_process_policy(struct inode *inode,
>  				const struct fscrypt_policy *policy)
>  {
> +	if (!inode_owner_or_capable(inode))
> +		return -EACCES;
> +
>  	if (policy->version != 0)
>  		return -EINVAL;
>  
> diff --git a/fs/ext4/crypto_policy.c b/fs/ext4/crypto_policy.c
> index ad05069..8a9feb3 100644
> --- a/fs/ext4/crypto_policy.c
> +++ b/fs/ext4/crypto_policy.c
> @@ -102,6 +102,9 @@ static int ext4_create_encryption_context_from_policy(
>  int ext4_process_policy(const struct ext4_encryption_policy *policy,
>  			struct inode *inode)
>  {
> +	if (!inode_owner_or_capable(inode))
> +		return -EACCES;
> +
>  	if (policy->version != 0)
>  		return -EINVAL;
>  

Thanks for this, now updated.

greg k-h