diff options
| author | Christian Brauner <brauner@kernel.org> | 2025-02-20 09:13:57 +0100 |
|---|---|---|
| committer | Christian Brauner <brauner@kernel.org> | 2025-02-20 09:13:57 +0100 |
| commit | 58c6cbd97cd51738cb231940c00519dd2b7ace2d (patch) | |
| tree | 18a68864fdbfdc88e759840a4fea29b132a2c00e | |
| parent | 2014c95afecee3e76ca4a56956a936e23283f05b (diff) | |
| parent | 540dcf0f44042fd9c6e14ae863efb67780ae0084 (diff) | |
Merge patch series "nsfs: validate ioctls"
Christian Brauner <brauner@kernel.org> says:
This series ensures that nsfs protects against ioctl overloading.
* patches from https://lore.kernel.org/r/20250219-work-nsfs-v1-0-21128d73c5e8@kernel.org:
selftests/nsfs: add ioctl validation tests
nsfs: validate ioctls
Link: https://lore.kernel.org/r/20250219-work-nsfs-v1-0-21128d73c5e8@kernel.org
Signed-off-by: Christian Brauner <brauner@kernel.org>
| -rw-r--r-- | fs/nsfs.c | 32 | ||||
| -rw-r--r-- | tools/testing/selftests/filesystems/nsfs/iterate_mntns.c | 14 |
2 files changed, 45 insertions, 1 deletions
diff --git a/fs/nsfs.c b/fs/nsfs.c index 663f8656158d..1ab705bb9386 100644 --- a/fs/nsfs.c +++ b/fs/nsfs.c @@ -152,19 +152,49 @@ static int copy_ns_info_to_user(const struct mnt_namespace *mnt_ns, return 0; } +static bool nsfs_ioctl_valid(unsigned int cmd) +{ + switch (cmd) { + case NS_GET_USERNS: + case NS_GET_PARENT: + case NS_GET_NSTYPE: + case NS_GET_OWNER_UID: + case NS_GET_MNTNS_ID: + case NS_GET_PID_FROM_PIDNS: + case NS_GET_TGID_FROM_PIDNS: + case NS_GET_PID_IN_PIDNS: + case NS_GET_TGID_IN_PIDNS: + return (_IOC_TYPE(cmd) == _IOC_TYPE(cmd)); + } + + /* Extensible ioctls require some extra handling. */ + switch (_IOC_NR(cmd)) { + case _IOC_NR(NS_MNT_GET_INFO): + case _IOC_NR(NS_MNT_GET_NEXT): + case _IOC_NR(NS_MNT_GET_PREV): + return (_IOC_TYPE(cmd) == _IOC_TYPE(cmd)); + } + + return false; +} + static long ns_ioctl(struct file *filp, unsigned int ioctl, unsigned long arg) { struct user_namespace *user_ns; struct pid_namespace *pid_ns; struct task_struct *tsk; - struct ns_common *ns = get_proc_ns(file_inode(filp)); + struct ns_common *ns; struct mnt_namespace *mnt_ns; bool previous = false; uid_t __user *argp; uid_t uid; int ret; + if (!nsfs_ioctl_valid(ioctl)) + return -ENOIOCTLCMD; + + ns = get_proc_ns(file_inode(filp)); switch (ioctl) { case NS_GET_USERNS: return open_related_ns(ns, ns_get_owner); diff --git a/tools/testing/selftests/filesystems/nsfs/iterate_mntns.c b/tools/testing/selftests/filesystems/nsfs/iterate_mntns.c index 457cf76f3c5f..a3d8015897e9 100644 --- a/tools/testing/selftests/filesystems/nsfs/iterate_mntns.c +++ b/tools/testing/selftests/filesystems/nsfs/iterate_mntns.c @@ -3,6 +3,8 @@ #define _GNU_SOURCE #include <fcntl.h> +#include <linux/auto_dev-ioctl.h> +#include <linux/errno.h> #include <sched.h> #include <stdio.h> #include <string.h> @@ -146,4 +148,16 @@ TEST_F(iterate_mount_namespaces, iterate_backward) } } +TEST_F(iterate_mount_namespaces, nfs_valid_ioctl) +{ + ASSERT_NE(ioctl(self->fd_mnt_ns[0], AUTOFS_DEV_IOCTL_OPENMOUNT, NULL), 0); + ASSERT_EQ(errno, ENOTTY); + + ASSERT_NE(ioctl(self->fd_mnt_ns[0], AUTOFS_DEV_IOCTL_CLOSEMOUNT, NULL), 0); + ASSERT_EQ(errno, ENOTTY); + + ASSERT_NE(ioctl(self->fd_mnt_ns[0], AUTOFS_DEV_IOCTL_READY, NULL), 0); + ASSERT_EQ(errno, ENOTTY); +} + TEST_HARNESS_MAIN |