The branch main has been updated by markj:
URL:
https://cgit.FreeBSD.org/src/commit/?id=2425f5e9128102c8e6e473567ad6759a55be5b02
commit 2425f5e9128102c8e6e473567ad6759a55be5b02
Author: Mark Johnston <ma...@freebsd.org>
AuthorDate: 2021-04-05 21:19:15 +0000
Commit: Mark Johnston <ma...@freebsd.org>
CommitDate: 2021-04-06 18:49:36 +0000
mount: Disallow mounting over a jail root
Discussed with: jamie
Approved by: so
Security: CVE-2020-25584
Security: FreeBSD-SA-21:10.jail_mount
---
sys/kern/vfs_mount.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/sys/kern/vfs_mount.c b/sys/kern/vfs_mount.c
index e20e1520f677..7dc6b795eefd 100644
--- a/sys/kern/vfs_mount.c
+++ b/sys/kern/vfs_mount.c
@@ -956,10 +956,10 @@ vfs_domount_first(
/*
* If the jail of the calling thread lacks permission for this type of
- * file system, deny immediately.
+ * file system, or is trying to cover its own root, deny immediately.
*/
- if (jailed(td->td_ucred) && !prison_allow(td->td_ucred,
- vfsp->vfc_prison_flag)) {
+ if (jailed(td->td_ucred) && (!prison_allow(td->td_ucred,
+ vfsp->vfc_prison_flag) || vp == td->td_ucred->cr_prison->pr_root)) {
vput(vp);
return (EPERM);
}
_______________________________________________
dev-commits-src-main@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/dev-commits-src-main
To unsubscribe, send any mail to "dev-commits-src-main-unsubscr...@freebsd.org"
