From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <stable-owner@vger.kernel.org>
Received: from imap.thunk.org ([74.207.234.97]:43878 "EHLO imap.thunk.org"
        rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP
        id S1754058AbcIMC7U (ORCPT <rfc822;stable@vger.kernel.org>);
        Mon, 12 Sep 2016 22:59:20 -0400
Date: Mon, 12 Sep 2016 22:59:08 -0400
From: Theodore Ts'o <tytso@mit.edu>
To: Eric Biggers <ebiggers@google.com>
Cc: gregkh@linuxfoundation.org, stable@vger.kernel.org,
        stable-commits@vger.kernel.org
Subject: Re: Patch "fscrypto: add authorization check for setting encryption
 policy" has been added to the 4.7-stable tree
Message-ID: <20160913025908.nfccsxmzs33l7d5n@thunk.org>
References: <147369353118593@kroah.com>
 <20160912184902.GB7129@google.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20160912184902.GB7129@google.com>
Sender: stable-owner@vger.kernel.org
List-ID: <stable.vger.kernel.org>

On Mon, Sep 12, 2016 at 11:49:02AM -0700, Eric Biggers wrote:
> On Mon, Sep 12, 2016 at 05:18:51PM +0200, gregkh@linuxfoundation.org wrote:
> > 
> > This is a note to let you know that I've just added the patch titled
> > 
> >     fscrypto: add authorization check for setting encryption policy
> > 
> > to the 4.7-stable tree which can be found at:
> >     http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
> 
> For the 4.7 kernel, fs/ext4/crypto_policy.c needs to be patched as well since
> the buggy code was duplicated there.  Here is the correct diff:

Acked-by: Theodore Ts'o <tytso@mit.edu>

> 
> diff --git a/fs/crypto/policy.c b/fs/crypto/policy.c
> index 0f9961e..c9800b1 100644
> --- a/fs/crypto/policy.c
> +++ b/fs/crypto/policy.c
> @@ -95,6 +95,9 @@ static int create_encryption_context_from_policy(struct inode *inode,
>  int fscrypt_process_policy(struct inode *inode,
>  				const struct fscrypt_policy *policy)
>  {
> +	if (!inode_owner_or_capable(inode))
> +		return -EACCES;
> +
>  	if (policy->version != 0)
>  		return -EINVAL;
>  
> diff --git a/fs/ext4/crypto_policy.c b/fs/ext4/crypto_policy.c
> index ad05069..8a9feb3 100644
> --- a/fs/ext4/crypto_policy.c
> +++ b/fs/ext4/crypto_policy.c
> @@ -102,6 +102,9 @@ static int ext4_create_encryption_context_from_policy(
>  int ext4_process_policy(const struct ext4_encryption_policy *policy,
>  			struct inode *inode)
>  {
> +	if (!inode_owner_or_capable(inode))
> +		return -EACCES;
> +
>  	if (policy->version != 0)
>  		return -EINVAL;
>  
> -- 
> 2.8.0.rc3.226.g39d4020
>