overlayfs: override_creds=off option bypass creator_cred

PATCH In review Mark Salyzyn 3 participants 4 messages Aug 28, 2018

Subsystems (2)

Documentation Overlay filesystem

lore

Share & tools

lore

Mark Salyzyn

author

2018-08-28 16:53 UTC #0 lore raw

PATCH v5 3/3 overlayfs: override_creds=off option bypass creator_cred

By default, all access to the upper, lower and work directories is the recorded mounter's MAC and DAC credentials. The incoming accesses are checked against the caller's credentials.

If the principles of least privilege are applied, the mounter's credentials might not overlap the credentials of the caller's when accessing the overlayfs filesystem. For example, a file that a lower DAC privileged caller can execute, is MAC denied to the generally higher DAC privileged mounter, to prevent an attack vector.

We add the option to turn off override_creds in the mount options; all subsequent operations after mount on the filesystem will be only the caller's credentials. This option default is set in the CONFIG OVERLAY_FS_OVERRIDE_CREDS or in the module option override_creds.

The module boolean parameter and mount option override_creds is also added as a presence check for this "feature" by checking existence of /sys/module/overlay/parameters/overlay_creds. This will allow user space to determine if the option can be supplied successfully to the mount(2) operation.

Signed-off-by Mark Salyzyn <[email protected]>

Cc Miklos Szeredi <[email protected]>

Cc Jonathan Corbet <[email protected]>

Cc Vivek Goyal <[email protected]>

Cc Eric W. Biederman <[email protected]>

Cc Amir Goldstein <[email protected]>

Cc Randy Dunlap <[email protected]>

Cc Stephen Smalley <[email protected]>

Cc [email protected]

v2:
- Forward port changed attr to stat, resulting in a build error.
- altered commit message.

v3:
- Change name from caller_credentials / creator_credentials to the boolean override_creds.
- Changed from creator to mounter credentials.
- Updated and fortified the documentation.
- Added CONFIG_OVERLAY_FS_OVERRIDE_CREDS

v4:
- spelling and grammar errors in text

v5:
- beefed up the caveats in the Documentation
- Is dependent on
"overlayfs: check CAP_DAC_READ_SEARCH before issuing exportfs_decode_fh" "overlayfs: check CAP_MKNOD before issuing vfs_whiteout"
- Added prwarn when override_creds=off

---
 Documentation/filesystems/overlayfs.txt | 29 +++++++++++++++++++++++++
 fs/overlayfs/Kconfig                    | 22 +++++++++++++++++++
 fs/overlayfs/copy_up.c                  |  2 +-
 fs/overlayfs/dir.c                      |  9 ++++----
 fs/overlayfs/inode.c                    | 16 +++++++-------
 fs/overlayfs/namei.c                    |  6 ++---
 fs/overlayfs/overlayfs.h                |  1 +
 fs/overlayfs/ovl_entry.h                |  1 +
 fs/overlayfs/readdir.c                  |  4 ++--
 fs/overlayfs/super.c                    | 23 ++++++++++++++++++++
 fs/overlayfs/util.c                     | 12 ++++++++--
 11 files changed, 105 insertions(+), 20 deletions(-)

Documentation/filesystems/overlayfs.txt +29 -0

index 72615a2c0752..953e52971eb0 100644
@@ -106,6 +106,35 @@ Only the lists of names from directories are merged.  Other content
 such as metadata and extended attributes are reported for the upper
 directory only.  These attributes of the lower directory are hidden.
 
+credentials
+-----------
+
+By default, all access to the upper, lower and work directories is the
+recorded mounter's MAC and DAC credentials.  The incoming accesses are
+checked against the caller's credentials.
+
+If the principles of least privilege are applied, the mounter's
+credentials might not overlap the credentials of the caller's when
+accessing the overlayfs filesystem.  For example, a file that a lower
+DAC privileged caller can execute, but is MAC denied to the
+generally higher DAC privileged mounter, to prevent an attack vector
+executing with the increased privileges of the mounter.  One option is
+to turn off override_creds in the mount options; all subsequent
+operations after mount on the filesystem will be only the caller's
+credentials.  This option default is set in the CONFIG
+OVERLAY_FS_OVERRIDE_CREDS or in the module option override_creds.
+Fundamentally The mounter has privileges, its ability to execute,
+for example, files and grant them these higher privileges is to be
+blocked except to lower privileged and appropriate callers.  This
+option turned off permits this kind of security policy.
+
+With override_creds turned off, several unintended side effects will
+occur.  The caller with a lower privilege will not be able to delete
+files or directories, create nodes, or search some directories.  The
+uneven security model where upperdir and workdir are opened at
+privilege, but accessed without, should only be used with strict
+understanding of the side effects and of the security policies.
+
 whiteouts and opaque directories
 --------------------------------

fs/overlayfs/Kconfig +22 -0

index 9384164253ac..b55bb0d48415 100644
@@ -103,3 +103,25 @@ config OVERLAY_FS_XINO_AUTO
 	  For more information, see Documentation/filesystems/overlayfs.txt
 
 	  If unsure, say N.
+
+config OVERLAY_FS_OVERRIDE_CREDS
+	bool "Overlay filesystem override credentials"
+	depends on OVERLAY_FS
+	default y
+	help
+	  If set, all access to the upper, lower and work directories is the
+	  recorded mounter's MAC and DAC credentials.  The incoming accesses
+	  are checked against the caller's credentials.
+
+	  If the principles of least privilege are applied, the mounter's
+	  credentials might not overlap the credentials of the caller's when
+	  accessing the overlayfs filesystem.  The mount option
+	  "override_creds=off" drops the mounter's credential check, so that
+	  all subsequent operations, after mount, on the filesystem will only
+	  be the caller's credentials.  This option sets the default for the
+	  module option override_creds, and thus the default for all mounts
+	  that do not specify this option.
+
+	  For more information see Documentation/filesystems/overlayfs.txt
+
+	  If unsure, say Y.

fs/overlayfs/copy_up.c +1 -1

index ddaddb4ce4c3..7a841718ff2e 100644
@@ -790,7 +790,7 @@ int ovl_copy_up_flags(struct dentry *dentry, int flags)
 		dput(parent);
 		dput(next);
 	}
-	revert_creds(old_cred);
+	ovl_revert_creds(old_cred);
 
 	return err;
 }

fs/overlayfs/dir.c +5 -4

index f480b1a2cd2e..a9f10cd38e32 100644
@@ -561,7 +561,8 @@ static int ovl_create_or_link(struct dentry *dentry, struct inode *inode,
 		override_cred->fsgid = inode->i_gid;
 		if (!attr->hardlink) {
 			err = security_dentry_create_files_as(dentry,
-					attr->mode, &dentry->d_name, old_cred,
+					attr->mode, &dentry->d_name,
+					old_cred ? old_cred : current_cred(),
 					override_cred);
 			if (err) {
 				put_cred(override_cred);

@@ -577,7 +578,7 @@ static int ovl_create_or_link(struct dentry *dentry, struct inode *inode,
 			err = ovl_create_over_whiteout(dentry, inode, attr);
 	}
 out_revert_creds:
-	revert_creds(old_cred);
+	ovl_revert_creds(old_cred);
 	return err;
 }

@@ -824,7 +825,7 @@ static int ovl_do_remove(struct dentry *dentry, bool is_dir)
 		err = ovl_remove_upper(dentry, is_dir, &list);
 	else
 		err = ovl_remove_and_whiteout(dentry, &list);
-	revert_creds(old_cred);
+	ovl_revert_creds(old_cred);
 	if (!err) {
 		if (is_dir)
 			clear_nlink(dentry->d_inode);

@@ -1150,7 +1151,7 @@ static int ovl_rename(struct inode *olddir, struct dentry *old,
 out_unlock:
 	unlock_rename(new_upperdir, old_upperdir);
 out_revert_creds:
-	revert_creds(old_cred);
+	ovl_revert_creds(old_cred);
 	ovl_nlink_end(new, locked);
 out_drop_write:
 	ovl_drop_write(old);

fs/overlayfs/inode.c +8 -8

index ed16a898caeb..afb0af1a24e9 100644
@@ -49,7 +49,7 @@ int ovl_setattr(struct dentry *dentry, struct iattr *attr)
 		inode_lock(upperdentry->d_inode);
 		old_cred = ovl_override_creds(dentry->d_sb);
 		err = notify_change(upperdentry, attr, NULL);
-		revert_creds(old_cred);
+		ovl_revert_creds(old_cred);
 		if (!err)
 			ovl_copyattr(upperdentry->d_inode, dentry->d_inode);
 		inode_unlock(upperdentry->d_inode);

@@ -208,7 +208,7 @@ int ovl_getattr(const struct path *path, struct kstat *stat,
 		stat->nlink = dentry->d_inode->i_nlink;
 
 out:
-	revert_creds(old_cred);
+	ovl_revert_creds(old_cred);
 
 	return err;
 }

@@ -242,7 +242,7 @@ int ovl_permission(struct inode *inode, int mask)
 		mask |= MAY_READ;
 	}
 	err = inode_permission(realinode, mask);
-	revert_creds(old_cred);
+	ovl_revert_creds(old_cred);
 
 	return err;
 }

@@ -259,7 +259,7 @@ static const char *ovl_get_link(struct dentry *dentry,
 
 	old_cred = ovl_override_creds(dentry->d_sb);
 	p = vfs_get_link(ovl_dentry_real(dentry), done);
-	revert_creds(old_cred);
+	ovl_revert_creds(old_cred);
 	return p;
 }

@@ -302,7 +302,7 @@ int ovl_xattr_set(struct dentry *dentry, struct inode *inode, const char *name,
 		WARN_ON(flags != XATTR_REPLACE);
 		err = vfs_removexattr(realdentry, name);
 	}
-	revert_creds(old_cred);
+	ovl_revert_creds(old_cred);
 
 out_drop_write:
 	ovl_drop_write(dentry);

@@ -320,7 +320,7 @@ int ovl_xattr_get(struct dentry *dentry, struct inode *inode, const char *name,
 
 	old_cred = ovl_override_creds(dentry->d_sb);
 	res = vfs_getxattr(realdentry, name, value, size);
-	revert_creds(old_cred);
+	ovl_revert_creds(old_cred);
 	return res;
 }

@@ -344,7 +344,7 @@ ssize_t ovl_listxattr(struct dentry *dentry, char *list, size_t size)
 
 	old_cred = ovl_override_creds(dentry->d_sb);
 	res = vfs_listxattr(realdentry, list, size);
-	revert_creds(old_cred);
+	ovl_revert_creds(old_cred);
 	if (res <= 0 || size == 0)
 		return res;

@@ -379,7 +379,7 @@ struct posix_acl *ovl_get_acl(struct inode *inode, int type)
 
 	old_cred = ovl_override_creds(inode->i_sb);
 	acl = get_acl(realinode, type);
-	revert_creds(old_cred);
+	ovl_revert_creds(old_cred);
 
 	return acl;
 }

fs/overlayfs/namei.c +3 -3

index 84982b6525fb..6c03add65a33 100644
@@ -1029,7 +1029,7 @@ struct dentry *ovl_lookup(struct inode *dir, struct dentry *dentry,
 		OVL_I(inode)->redirect = upperredirect;
 	}
 
-	revert_creds(old_cred);
+	ovl_revert_creds(old_cred);
 	dput(index);
 	kfree(stack);
 	kfree(d.redirect);

@@ -1048,7 +1048,7 @@ struct dentry *ovl_lookup(struct inode *dir, struct dentry *dentry,
 	kfree(upperredirect);
 out:
 	kfree(d.redirect);
-	revert_creds(old_cred);
+	ovl_revert_creds(old_cred);
 	return ERR_PTR(err);
 }

@@ -1102,7 +1102,7 @@ bool ovl_lower_positive(struct dentry *dentry)
 			dput(this);
 		}
 	}
-	revert_creds(old_cred);
+	ovl_revert_creds(old_cred);
 
 	return positive;
 }

fs/overlayfs/overlayfs.h +1 -0

index bf3a80157d42..ef81b1958d01 100644
@@ -195,6 +195,7 @@ int ovl_want_write(struct dentry *dentry);
 void ovl_drop_write(struct dentry *dentry);
 struct dentry *ovl_workdir(struct dentry *dentry);
 const struct cred *ovl_override_creds(struct super_block *sb);
+void ovl_revert_creds(const struct cred *oldcred);
 struct super_block *ovl_same_sb(struct super_block *sb);
 int ovl_can_decode_fh(struct super_block *sb);
 struct dentry *ovl_indexdir(struct super_block *sb);

fs/overlayfs/ovl_entry.h +1 -0

index 41655a7d6894..ee4cc3802147 100644
@@ -19,6 +19,7 @@ struct ovl_config {
 	bool index;
 	bool nfs_export;
 	int xino;
+	bool override_creds;
 };
 
 struct ovl_sb {

fs/overlayfs/readdir.c +2 -2

index ef1fe42ff7bb..150c7ee2f7f7 100644
@@ -289,7 +289,7 @@ static int ovl_check_whiteouts(struct dentry *dir, struct ovl_readdir_data *rdd)
 		}
 		inode_unlock(dir->d_inode);
 	}
-	revert_creds(old_cred);
+	ovl_revert_creds(old_cred);
 
 	return err;
 }

@@ -906,7 +906,7 @@ int ovl_check_empty_dir(struct dentry *dentry, struct list_head *list)
 
 	old_cred = ovl_override_creds(dentry->d_sb);
 	err = ovl_dir_read_merged(dentry, list, &root);
-	revert_creds(old_cred);
+	ovl_revert_creds(old_cred);
 	if (err)
 		return err;

fs/overlayfs/super.c +23 -0

index 704b37311467..a3637a84cc8d 100644
@@ -56,6 +56,12 @@ module_param_named(xino_auto, ovl_xino_auto_def, bool, 0644);
 MODULE_PARM_DESC(ovl_xino_auto_def,
 		 "Auto enable xino feature");
 
+static bool __read_mostly ovl_default_override_creds =
+	IS_ENABLED(CONFIG_OVERLAY_FS_OVERRIDE_CREDS);
+module_param_named(override_creds, ovl_default_override_creds, bool, 0644);
+MODULE_PARM_DESC(ovl_default_override_creds,
+		 "Use mounter's credentials for accesses");
+
 static void ovl_entry_stack_free(struct ovl_entry *oe)
 {
 	unsigned int i;

@@ -376,6 +382,8 @@ static int ovl_show_options(struct seq_file *m, struct dentry *dentry)
 						"on" : "off");
 	if (ofs->config.xino != ovl_xino_def())
 		seq_printf(m, ",xino=%s", ovl_xino_str[ofs->config.xino]);
+	seq_show_option(m, "override_creds",
+			ofs->config.override_creds ? "on" : "off");
 	return 0;
 }

@@ -413,6 +421,8 @@ enum {
 	OPT_XINO_ON,
 	OPT_XINO_OFF,
 	OPT_XINO_AUTO,
+	OPT_OVERRIDE_CREDS_ON,
+	OPT_OVERRIDE_CREDS_OFF,
 	OPT_ERR,
 };

@@ -429,6 +439,8 @@ static const match_table_t ovl_tokens = {
 	{OPT_XINO_ON,			"xino=on"},
 	{OPT_XINO_OFF,			"xino=off"},
 	{OPT_XINO_AUTO,			"xino=auto"},
+	{OPT_OVERRIDE_CREDS_ON,		"override_creds=on"},
+	{OPT_OVERRIDE_CREDS_OFF,	"override_creds=off"},
 	{OPT_ERR,			NULL}
 };

@@ -485,6 +497,7 @@ static int ovl_parse_opt(char *opt, struct ovl_config *config)
 	config->redirect_mode = kstrdup(ovl_redirect_mode_def(), GFP_KERNEL);
 	if (!config->redirect_mode)
 		return -ENOMEM;
+	config->override_creds = ovl_default_override_creds;
 
 	while ((p = ovl_next_opt(&opt)) != NULL) {
 		int token;

@@ -555,6 +568,14 @@ static int ovl_parse_opt(char *opt, struct ovl_config *config)
 			config->xino = OVL_XINO_AUTO;
 			break;
 
+		case OPT_OVERRIDE_CREDS_ON:
+			config->override_creds = true;
+			break;
+
+		case OPT_OVERRIDE_CREDS_OFF:
+			config->override_creds = false;
+			break;
+
 		default:
 			pr_err("overlayfs: unrecognized mount option \"%s\" or missing value\n", p);
 			return -EINVAL;

@@ -1478,6 +1499,8 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent)
 		       ovl_dentry_lower(root_dentry));
 
 	sb->s_root = root_dentry;
+	if (!ofs->config.override_creds)
+		pr_warn("overlayfs: override_creds=off, uneven security model where mounter privileges do not overlap caller.\n");
 
 	return 0;

fs/overlayfs/util.c +10 -2

index 6f1078028c66..0a59de9b4088 100644
@@ -40,9 +40,17 @@ const struct cred *ovl_override_creds(struct super_block *sb)
 {
 	struct ovl_fs *ofs = sb->s_fs_info;
 
+	if (!ofs->config.override_creds)
+		return NULL;
 	return override_creds(ofs->creator_cred);
 }
 
+void ovl_revert_creds(const struct cred *old_cred)
+{
+	if (old_cred)
+		revert_creds(old_cred);
+}
+
 struct super_block *ovl_same_sb(struct super_block *sb)
 {
 	struct ovl_fs *ofs = sb->s_fs_info;

@@ -630,7 +638,7 @@ int ovl_nlink_start(struct dentry *dentry, bool *locked)
 	 * value relative to the upper inode nlink in an upper inode xattr.
 	 */
 	err = ovl_set_nlink_upper(dentry);
-	revert_creds(old_cred);
+	ovl_revert_creds(old_cred);
 
 out:
 	if (err)

@@ -650,7 +658,7 @@ void ovl_nlink_end(struct dentry *dentry, bool locked)
 
 			old_cred = ovl_override_creds(dentry->d_sb);
 			ovl_cleanup_index(dentry);
-			revert_creds(old_cred);
+			ovl_revert_creds(old_cred);
 		}
 
 		mutex_unlock(&OVL_I(d_inode(dentry))->lock);

Signature · 1 line

2.19.0.rc0.228.g281dcd1b4d0-goog

Randy Dunlap

reviewer

2018-08-28 18:09 UTC #1 lore raw

Quoted 16 lines · Mark Salyzyn

Documentation/filesystems/overlayfs.txt +8 -0

index 72615a2c0752..953e52971eb0 100644
@@ -106,6 +106,35 @@ Only the lists of names from directories are merged.  Other content
 such as metadata and extended attributes are reported for the upper
 directory only.  These attributes of the lower directory are hidden.
 
+credentials
+-----------
+
+By default, all access to the upper, lower and work directories is the
+recorded mounter's MAC and DAC credentials.  The incoming accesses are
+checked against the caller's credentials.
+
+If the principles of least privilege are applied, the mounter's

Documentation/filesystems/overlayfs.txt Only the lists of names from directories are merged. Other content · line 126

Quoted 10 lines

Documentation/filesystems/overlayfs.txt +10 -0

+credentials might not overlap the credentials of the caller's when
+accessing the overlayfs filesystem.  For example, a file that a lower
+DAC privileged caller can execute, but is MAC denied to the
+generally higher DAC privileged mounter, to prevent an attack vector
+executing with the increased privileges of the mounter.  One option is
+to turn off override_creds in the mount options; all subsequent
+operations after mount on the filesystem will be only the caller's
+credentials.  This option default is set in the CONFIG
+OVERLAY_FS_OVERRIDE_CREDS or in the module option override_creds.
+Fundamentally The mounter has privileges, its ability to execute,

the

but this entire sentence is jumbled and awkward and could use some work. I tried to come up with something but I can't quite get what is intended here.

Quoted 13 lines

Documentation/filesystems/overlayfs.txt +11 -0

+for example, files and grant them these higher privileges is to be
+blocked except to lower privileged and appropriate callers.  This
+option turned off permits this kind of security policy.
+
+With override_creds turned off, several unintended side effects will
+occur.  The caller with a lower privilege will not be able to delete
+files or directories, create nodes, or search some directories.  The
+uneven security model where upperdir and workdir are opened at
+privilege, but accessed without, should only be used with strict
+understanding of the side effects and of the security policies.
+
 whiteouts and opaque directories
 --------------------------------

Signature · 1 line

~Randy

Amir Goldstein

maintainer

2018-08-28 21:20 UTC #2 lore raw

Quoted 31 lines · Randy Dunlap

Quoted 16 lines · Mark Salyzyn

Documentation/filesystems/overlayfs.txt +8 -0

index 72615a2c0752..953e52971eb0 100644
@@ -106,6 +106,35 @@ Only the lists of names from directories are merged.  Other content
 such as metadata and extended attributes are reported for the upper
 directory only.  These attributes of the lower directory are hidden.
 
+credentials
+-----------
+
+By default, all access to the upper, lower and work directories is the
+recorded mounter's MAC and DAC credentials.  The incoming accesses are
+checked against the caller's credentials.
+
+If the principles of least privilege are applied, the mounter's

Documentation/filesystems/overlayfs.txt Only the lists of names from directories are merged. Other content · line 126

Quoted 10 lines

Documentation/filesystems/overlayfs.txt +10 -0

+credentials might not overlap the credentials of the caller's when
+accessing the overlayfs filesystem.  For example, a file that a lower
+DAC privileged caller can execute, but is MAC denied to the
+generally higher DAC privileged mounter, to prevent an attack vector
+executing with the increased privileges of the mounter.  One option is
+to turn off override_creds in the mount options; all subsequent
+operations after mount on the filesystem will be only the caller's
+credentials.  This option default is set in the CONFIG
+OVERLAY_FS_OVERRIDE_CREDS or in the module option override_creds.
+Fundamentally The mounter has privileges, its ability to execute,

the

Quoted 3 lines

but this entire sentence is jumbled and awkward and could use some work. I tried to come up with something but I can't quite get what is intended here.

I have a very similar feeling - I do not feel any more knowledgeable after reading the above.
My 2 cents - don't try to explain your reasoning for using this feature the use case is too awkward. You may need to rationalize your use case to get the feature merged, but spare the poor user who reads the manual.
Explaining what override_creds=off does is simple - stick to that with a disclaimer about things that may not work well.

Quoted 12 lines

Documentation/filesystems/overlayfs.txt Only the lists of names from directories are merged. Other content · line 137

Quoted 12 lines

Documentation/filesystems/overlayfs.txt +11 -0

+for example, files and grant them these higher privileges is to be
+blocked except to lower privileged and appropriate callers.  This
+option turned off permits this kind of security policy.
+
+With override_creds turned off, several unintended side effects will
+occur.  The caller with a lower privilege will not be able to delete
+files or directories, create nodes, or search some directories.  The
+uneven security model where upperdir and workdir are opened at
+privilege, but accessed without, should only be used with strict
+understanding of the side effects and of the security policies.
+

I like the ending ;-)
Let's go with "The user may not be able to delete..."

Thanks,
Amir.

Amir Goldstein

maintainer

2018-08-28 21:32 UTC #3 lore raw

In reply to Mark Salyzyn

Quoted 125 lines · Mark Salyzyn

By default, all access to the upper, lower and work directories is the recorded mounter's MAC and DAC credentials. The incoming accesses are checked against the caller's credentials.
If the principles of least privilege are applied, the mounter's credentials might not overlap the credentials of the caller's when accessing the overlayfs filesystem. For example, a file that a lower DAC privileged caller can execute, is MAC denied to the generally higher DAC privileged mounter, to prevent an attack vector.
We add the option to turn off override_creds in the mount options; all subsequent operations after mount on the filesystem will be only the caller's credentials. This option default is set in the CONFIG OVERLAY_FS_OVERRIDE_CREDS or in the module option override_creds.
The module boolean parameter and mount option override_creds is also added as a presence check for this "feature" by checking existence of /sys/module/overlay/parameters/overlay_creds. This will allow user space to determine if the option can be supplied successfully to the mount(2) operation.
Signed-off-by Mark Salyzyn <[email protected]>
Cc Miklos Szeredi <[email protected]>
Cc Jonathan Corbet <[email protected]>
Cc Vivek Goyal <[email protected]>
Cc Eric W. Biederman <[email protected]>
Cc Amir Goldstein <[email protected]>
Cc Randy Dunlap <[email protected]>
Cc Stephen Smalley <[email protected]>
Cc [email protected]
Cc [email protected]
Cc [email protected]
v2:
- Forward port changed attr to stat, resulting in a build error.
- altered commit message.
v3:
- Change name from caller_credentials / creator_credentials to the boolean override_creds.
- Changed from creator to mounter credentials.
- Updated and fortified the documentation.
- Added CONFIG_OVERLAY_FS_OVERRIDE_CREDS
v4:
- spelling and grammar errors in text
v5:
- beefed up the caveats in the Documentation
- Is dependent on
"overlayfs: check CAP_DAC_READ_SEARCH before issuing exportfs_decode_fh" "overlayfs: check CAP_MKNOD before issuing vfs_whiteout"
- Added prwarn when override_creds=off
---
 Documentation/filesystems/overlayfs.txt | 29 +++++++++++++++++++++++++
 fs/overlayfs/Kconfig                    | 22 +++++++++++++++++++
 fs/overlayfs/copy_up.c                  |  2 +-
 fs/overlayfs/dir.c                      |  9 ++++----
 fs/overlayfs/inode.c                    | 16 +++++++-------
 fs/overlayfs/namei.c                    |  6 ++---
 fs/overlayfs/overlayfs.h                |  1 +
 fs/overlayfs/ovl_entry.h                |  1 +
 fs/overlayfs/readdir.c                  |  4 ++--
 fs/overlayfs/super.c                    | 23 ++++++++++++++++++++
 fs/overlayfs/util.c                     | 12 ++++++++--
 11 files changed, 105 insertions(+), 20 deletions(-)
Documentation/filesystems/overlayfs.txt +29 -0
index 72615a2c0752..953e52971eb0 100644
@@ -106,6 +106,35 @@ Only the lists of names from directories are merged.  Other content
 such as metadata and extended attributes are reported for the upper
 directory only.  These attributes of the lower directory are hidden.
 
+credentials
+-----------
+
+By default, all access to the upper, lower and work directories is the
+recorded mounter's MAC and DAC credentials.  The incoming accesses are
+checked against the caller's credentials.
+
+If the principles of least privilege are applied, the mounter's
+credentials might not overlap the credentials of the caller's when
+accessing the overlayfs filesystem.  For example, a file that a lower
+DAC privileged caller can execute, but is MAC denied to the
+generally higher DAC privileged mounter, to prevent an attack vector
+executing with the increased privileges of the mounter.  One option is
+to turn off override_creds in the mount options; all subsequent
+operations after mount on the filesystem will be only the caller's
+credentials.  This option default is set in the CONFIG
+OVERLAY_FS_OVERRIDE_CREDS or in the module option override_creds.
+Fundamentally The mounter has privileges, its ability to execute,
+for example, files and grant them these higher privileges is to be
+blocked except to lower privileged and appropriate callers.  This
+option turned off permits this kind of security policy.
+
+With override_creds turned off, several unintended side effects will
+occur.  The caller with a lower privilege will not be able to delete
+files or directories, create nodes, or search some directories.  The
+uneven security model where upperdir and workdir are opened at
+privilege, but accessed without, should only be used with strict
+understanding of the side effects and of the security policies.
+
 whiteouts and opaque directories
 --------------------------------
 
fs/overlayfs/Kconfig +9 -0
index 9384164253ac..b55bb0d48415 100644
@@ -103,3 +103,25 @@ config OVERLAY_FS_XINO_AUTO
          For more information, see Documentation/filesystems/overlayfs.txt
 
          If unsure, say N.
+
+config OVERLAY_FS_OVERRIDE_CREDS
+       bool "Overlay filesystem override credentials"
+       depends on OVERLAY_FS
+       default y
+       help
+         If set, all access to the upper, lower and work directories is the
+         recorded mounter's MAC and DAC credentials.  The incoming accesses
+         are checked against the caller's credentials.

fs/overlayfs/Kconfig config OVERLAY_FS_XINO_AUTO · line 124

Quoted 10 lines

fs/overlayfs/Kconfig +10 -0

+
+         If the principles of least privilege are applied, the mounter's
+         credentials might not overlap the credentials of the caller's when
+         accessing the overlayfs filesystem.  The mount option
+         "override_creds=off" drops the mounter's credential check, so that
+         all subsequent operations, after mount, on the filesystem will only
+         be the caller's credentials.  This option sets the default for the
+         module option override_creds, and thus the default for all mounts
+         that do not specify this option.
+

Was it me that suggested a config option??
because I can't thing of a reason to configure this as the default.
...

fs/overlayfs/Kconfig config OVERLAY_FS_XINO_AUTO

Quoted 5 lines

fs/overlayfs/Kconfig +2 -0

        sb->s_root = root_dentry;
+       if (!ofs->config.override_creds)
+               pr_warn("overlayfs: override_creds=off, uneven security model where mounter privileges do not overlap caller.\n");

This is not what the user needs to be warned about IMO. User should be warned about consequences.

Thanks,
Amir.