releases/4.15.10/ovl-redirect_dir-nofollow-should-not-follow-redirect-for-opaque-lower.patch

   1 From d1fe96c0e4de78ba0cd336ea3df3b850d06b9b9a Mon Sep 17 00:00:00 2001
   2 From: Vivek Goyal <vgoyal@redhat.com>
   3 Date: Fri, 2 Feb 2018 10:23:24 -0500
   4 Subject: ovl: redirect_dir=nofollow should not follow redirect for opaque lower
   5
   6 From: Vivek Goyal <vgoyal@redhat.com>
   7
   8 commit d1fe96c0e4de78ba0cd336ea3df3b850d06b9b9a upstream.
   9
  10 redirect_dir=nofollow should not follow a redirect. But in a specific
  11 configuration it can still follow it.  For example try this.
  12
  13 $ mkdir -p lower0 lower1/foo upper work merged
  14 $ touch lower1/foo/lower-file.txt
  15 $ setfattr -n "trusted.overlay.opaque" -v "y" lower1/foo
  16 $ mount -t overlay -o lowerdir=lower1:lower0,workdir=work,upperdir=upper,redirect_dir=on none merged
  17 $ cd merged
  18 $ mv foo foo-renamed
  19 $ umount merged
  20
  21 # mount again. This time with redirect_dir=nofollow
  22 $ mount -t overlay -o lowerdir=lower1:lower0,workdir=work,upperdir=upper,redirect_dir=nofollow none merged
  23 $ ls merged/foo-renamed/
  24 # This lists lower-file.txt, while it should not have.
  25
  26 Basically, we are doing redirect check after we check for d.stop. And
  27 if this is not last lower, and we find an opaque lower, d.stop will be
  28 set.
  29
  30 ovl_lookup_single()
  31         if (!d->last && ovl_is_opaquedir(this)) {
  32                 d->stop = d->opaque = true;
  33                 goto out;
  34         }
  35
  36 To fix this, first check redirect is allowed. And after that check if
  37 d.stop has been set or not.
  38
  39 Signed-off-by: Vivek Goyal <vgoyal@redhat.com>
  40 Fixes: 438c84c2f0c7 ("ovl: don't follow redirects if redirect_dir=off")
  41 Cc: <stable@vger.kernel.org> #v4.15
  42 Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
  43 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  44
  45 ---
  46  fs/overlayfs/namei.c |    6 +++---
  47  1 file changed, 3 insertions(+), 3 deletions(-)
  48
  49 --- a/fs/overlayfs/namei.c
  50 +++ b/fs/overlayfs/namei.c
  51 @@ -678,9 +678,6 @@ struct dentry *ovl_lookup(struct inode *
  52                 stack[ctr].layer = lower.layer;
  53                 ctr++;
  54
  55 -               if (d.stop)
  56 -                       break;
  57 -
  58                 /*
  59                  * Following redirects can have security consequences: it's like
  60                  * a symlink into the lower layer without the permission checks.
  61 @@ -697,6 +694,9 @@ struct dentry *ovl_lookup(struct inode *
  62                         goto out_put;
  63                 }
  64
  65 +               if (d.stop)
  66 +                       break;
  67 +
  68                 if (d.redirect && d.redirect[0] == '/' && poe != roe) {
  69                         poe = roe;
  70