Tree - rpms/kernel - src.fedoraproject.org

Blob History Raw

		475e0ae	`From: Andy Lutomirski <luto@amacapital.net>`
		475e0ae	`Date: Wed, 8 Oct 2014 12:37:46 -0700`
		475e0ae	`Subject: [PATCH] fs: Add a missing permission check to do_umount`
		475e0ae
		475e0ae	`Accessing do_remount_sb should require global CAP_SYS_ADMIN, but`
		475e0ae	`only one of the two call sites was appropriately protected.`
		475e0ae
		475e0ae	`Fixes CVE-2014-7975.`
		475e0ae
		475e0ae	`Cc: stable@vger.kernel.org`
		475e0ae	`Signed-off-by: Andy Lutomirski <luto@amacapital.net>`
		475e0ae	`---`
		475e0ae	`fs/namespace.c \| 2 ++`
		475e0ae	`1 file changed, 2 insertions(+)`
		475e0ae
		475e0ae	`diff --git a/fs/namespace.c b/fs/namespace.c`
		57e2b74	`index 74647c2fe69c..550dbff08677 100644`
		475e0ae	`--- a/fs/namespace.c`
		475e0ae	`+++ b/fs/namespace.c`
		57e2b74	`@@ -1356,6 +1356,8 @@ static int do_umount(struct mount *mnt, int flags)`
		475e0ae	`* Special case for "unmounting" root ...`
		475e0ae	`* we just try to remount it readonly.`
		475e0ae	`*/`
		475e0ae	`+ if (!capable(CAP_SYS_ADMIN))`
		475e0ae	`+ return -EPERM;`
		475e0ae	`down_write(&sb->s_umount);`
		475e0ae	`if (!(sb->s_flags & MS_RDONLY))`
		475e0ae	`retval = do_remount_sb(sb, MS_RDONLY, NULL, 0);`
		475e0ae	`--`
		475e0ae	`1.9.3`
		475e0ae