APPLIED/CMT[F]: [SRU][F/B][CVE-2020-25284][PATCH v2 1/1] rbd: require global CAP_SYS_ADMIN for mapping and unmapping

[Ian May]

This patch was applied in the following patchset:

        Focal update: v5.4.66 upstream stable release
	https://bugs.launchpad.net/bugs/1896824

Thanks!
Ian

On 2020-09-25 12:30:07 , William Breathitt Gray wrote:
> From: Ilya Dryomov <idryomov at gmail.com>
> 
> It turns out that currently we rely only on sysfs attribute
> permissions:
> 
>   $ ll /sys/bus/rbd/{add*,remove*}
>   --w------- 1 root root 4096 Sep  3 20:37 /sys/bus/rbd/add
>   --w------- 1 root root 4096 Sep  3 20:37 /sys/bus/rbd/add_single_major
>   --w------- 1 root root 4096 Sep  3 20:37 /sys/bus/rbd/remove
>   --w------- 1 root root 4096 Sep  3 20:38 /sys/bus/rbd/remove_single_major
> 
> This means that images can be mapped and unmapped (i.e. block devices
> can be created and deleted) by a UID 0 process even after it drops all
> privileges or by any process with CAP_DAC_OVERRIDE in its user namespace
> as long as UID 0 is mapped into that user namespace.
> 
> Be consistent with other virtual block devices (loop, nbd, dm, md, etc)
> and require CAP_SYS_ADMIN in the initial user namespace for mapping and
> unmapping, and also for dumping the configuration string and refreshing
> the image header.
> 
> Cc: stable at vger.kernel.org
> Signed-off-by: Ilya Dryomov <idryomov at gmail.com>
> Reviewed-by: Jeff Layton <jlayton at kernel.org>
> 
> CVE-2020-25284
> 
> (cherry-picked from commit f44d04e696feaf13d192d942c4f14ad2e117065a)
> Signed-off-by: William Breathitt Gray <william.gray at canonical.com>
> ---
>  drivers/block/rbd.c | 12 ++++++++++++
>  1 file changed, 12 insertions(+)
> 
> diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
> index 274beda31c35..bf2f0373a3b2 100644
> --- a/drivers/block/rbd.c
> +++ b/drivers/block/rbd.c
> @@ -5280,6 +5280,9 @@ static ssize_t rbd_config_info_show(struct device *dev,
>  {
>  	struct rbd_device *rbd_dev = dev_to_rbd_dev(dev);
>  
> +	if (!capable(CAP_SYS_ADMIN))
> +		return -EPERM;
> +
>  	return sprintf(buf, "%s\n", rbd_dev->config_info);
>  }
>  
> @@ -5391,6 +5394,9 @@ static ssize_t rbd_image_refresh(struct device *dev,
>  	struct rbd_device *rbd_dev = dev_to_rbd_dev(dev);
>  	int ret;
>  
> +	if (!capable(CAP_SYS_ADMIN))
> +		return -EPERM;
> +
>  	ret = rbd_dev_refresh(rbd_dev);
>  	if (ret)
>  		return ret;
> @@ -7059,6 +7065,9 @@ static ssize_t do_rbd_add(struct bus_type *bus,
>  	struct rbd_client *rbdc;
>  	int rc;
>  
> +	if (!capable(CAP_SYS_ADMIN))
> +		return -EPERM;
> +
>  	if (!try_module_get(THIS_MODULE))
>  		return -ENODEV;
>  
> @@ -7208,6 +7217,9 @@ static ssize_t do_rbd_remove(struct bus_type *bus,
>  	bool force = false;
>  	int ret;
>  
> +	if (!capable(CAP_SYS_ADMIN))
> +		return -EPERM;
> +
>  	dev_id = -1;
>  	opt_buf[0] = '\0';
>  	sscanf(buf, "%d %5s", &dev_id, opt_buf);
> -- 
> 2.25.1
> 
> 
> -- 
> kernel-team mailing list
> kernel-team at lists.ubuntu.com
> https://lists.ubuntu.com/mailman/listinfo/kernel-team