Tree - rpms/kernel - src.fedoraproject.org

Blob History Raw

		6b37529	`From: Andy Lutomirski <luto@amacapital.net>`
		6b37529	`Date: Wed, 8 Oct 2014 12:37:46 -0700`
		6b37529	`Subject: [PATCH] fs: Add a missing permission check to do_umount`
		6b37529
		6b37529	`Accessing do_remount_sb should require global CAP_SYS_ADMIN, but`
		6b37529	`only one of the two call sites was appropriately protected.`
		6b37529
		6b37529	`Fixes CVE-2014-7975.`
		6b37529
		6b37529	`Cc: stable@vger.kernel.org`
		6b37529	`Signed-off-by: Andy Lutomirski <luto@amacapital.net>`
		6b37529	`---`
		6b37529	`fs/namespace.c \| 2 ++`
		6b37529	`1 file changed, 2 insertions(+)`
		6b37529
		6b37529	`diff --git a/fs/namespace.c b/fs/namespace.c`
		6b37529	`index c8e3034ff4b2..fbba8b17330d 100644`
		6b37529	`--- a/fs/namespace.c`
		6b37529	`+++ b/fs/namespace.c`
		6b37529	`@@ -1439,6 +1439,8 @@ static int do_umount(struct mount *mnt, int flags)`
		6b37529	`* Special case for "unmounting" root ...`
		6b37529	`* we just try to remount it readonly.`
		6b37529	`*/`
		6b37529	`+ if (!capable(CAP_SYS_ADMIN))`
		6b37529	`+ return -EPERM;`
		6b37529	`down_write(&sb->s_umount);`
		6b37529	`if (!(sb->s_flags & MS_RDONLY))`
		6b37529	`retval = do_remount_sb(sb, MS_RDONLY, NULL, 0);`
		6b37529	`--`
		6b37529	`1.9.3`
		6b37529