Date: Tue, 6 Apr 2021 19:19:15 GMT From: Mark Johnston <markj@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Subject: git: 4710439ec594 - releng/13.0 - mount: Disallow mounting over a jail root Message-ID: <202104061919.136JJFXW097427@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch releng/13.0 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=4710439ec594a5375657acc403326f868d05a05a commit 4710439ec594a5375657acc403326f868d05a05a Author: Mark Johnston <markj@FreeBSD.org> AuthorDate: 2021-04-05 21:19:15 +0000 Commit: Mark Johnston <markj@FreeBSD.org> CommitDate: 2021-04-06 19:18:59 +0000 mount: Disallow mounting over a jail root Discussed with: jamie Approved by: re (so, implicit) Approved by: so Security: CVE-2020-25584 Security: FreeBSD-SA-21:10.jail_mount (cherry picked from commit 2425f5e9128102c8e6e473567ad6759a55be5b02) (cherry picked from commit 3ae17faa370491d7ce1fcfc4d5b9cd1ed0117b67) --- sys/kern/vfs_mount.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/sys/kern/vfs_mount.c b/sys/kern/vfs_mount.c index b3870e46c5e9..59000728efcc 100644 --- a/sys/kern/vfs_mount.c +++ b/sys/kern/vfs_mount.c @@ -918,10 +918,10 @@ vfs_domount_first( /* * If the jail of the calling thread lacks permission for this type of - * file system, deny immediately. + * file system, or is trying to cover its own root, deny immediately. */ - if (jailed(td->td_ucred) && !prison_allow(td->td_ucred, - vfsp->vfc_prison_flag)) { + if (jailed(td->td_ucred) && (!prison_allow(td->td_ucred, + vfsp->vfc_prison_flag) || vp == td->td_ucred->cr_prison->pr_root)) { vput(vp); return (EPERM); }
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202104061919.136JJFXW097427>