From f32417bfc6bf963cb98c6fd4322e8c8d28c53128 Mon Sep 17 00:00:00 2001 From: Thadeu Lima de Souza Cascardo Date: Thu, 6 Jul 2023 17:45:17 -0300 Subject: [PATCH] UBUNTU: SAUCE: overlayfs: default to userxattr when mounted from non initial user namespace Also add a nouserxattr for the cases where it is desirable to mount without userxattr under such namespaces. This allows cases where such xattrs are necessary for certain operations to work out, instead of failing due to not being able to use the trusted.overlay.* xattrs. CVE-2023-2640 CVE-2023-32629 LP: #1531747 Signed-off-by: Thadeu Lima de Souza Cascardo [ arighi: adjust context to support the new mount api ] Signed-off-by: Andrea Righi --- fs/overlayfs/params.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/fs/overlayfs/params.c b/fs/overlayfs/params.c index 112b4b12f825..c3b9c67e9953 100644 --- a/fs/overlayfs/params.c +++ b/fs/overlayfs/params.c @@ -55,6 +55,7 @@ enum ovl_opt { Opt_uuid, Opt_nfs_export, Opt_userxattr, + Opt_nouserxattr, Opt_xino, Opt_metacopy, Opt_verity, @@ -155,6 +156,7 @@ const struct fs_parameter_spec ovl_parameter_spec[] = { fsparam_enum("uuid", Opt_uuid, ovl_parameter_uuid), fsparam_enum("nfs_export", Opt_nfs_export, ovl_parameter_bool), fsparam_flag("userxattr", Opt_userxattr), + fsparam_flag("nouserxattr", Opt_nouserxattr), fsparam_enum("xino", Opt_xino, ovl_parameter_xino), fsparam_enum("metacopy", Opt_metacopy, ovl_parameter_bool), fsparam_enum("verity", Opt_verity, ovl_parameter_verity), @@ -619,6 +621,9 @@ static int ovl_parse_param(struct fs_context *fc, struct fs_parameter *param) case Opt_userxattr: config->userxattr = true; break; + case Opt_nouserxattr: + config->userxattr = false; + break; default: pr_err("unrecognized mount option \"%s\" or missing value\n", param->key); @@ -725,6 +730,8 @@ int ovl_init_fs_context(struct fs_context *fc) ofs->config.nfs_export = ovl_nfs_export_def; ofs->config.xino = ovl_xino_def(); ofs->config.metacopy = ovl_metacopy_def; + if (fc->user_ns != &init_user_ns) + ofs->config.userxattr = true; fc->s_fs_info = ofs; fc->fs_private = ctx; @@ -997,6 +1004,8 @@ int ovl_show_options(struct seq_file *m, struct dentry *dentry) seq_puts(m, ",volatile"); if (ofs->config.userxattr) seq_puts(m, ",userxattr"); + else + seq_puts(m, ",nouserxattr"); if (ofs->config.verity_mode != ovl_verity_mode_def()) seq_printf(m, ",verity=%s", ovl_verity_mode(&ofs->config));