** Description changed: [Impact] + - Multiple secpolicy checks did not check for root user permissions on execution, which allows for non-privileged user access to zpool events + + [Fix] + - Stonking: update to zfs 2.4.4 + - Resolute: backport the following upstream OpenZFS patches: + - c937ebd8bd29: "ZTS: test secpolicy_sys_config correctly limits namespace access" + - f8962de2eb4c: "ZTS: test secpolicy_zinject correctly limits namespace access" + - ceab561032ac: "secpolicy_nfs: remove, not used" + - 077e959daf28: "secpolicy_zinject: only permit a global zone credential" + - aa99598276f6: "secpolicy_sys_config: only permit a global zone credential" + - b2c98cf0b079: "secpolicy_zfs: add a note about the power of CAP_SYS_ADMIN" + - Noble: backport the following upstream OpenZFS patches: + - c937ebd8bd29: "ZTS: test secpolicy_sys_config correctly limits namespace access" + - f8962de2eb4c: "ZTS: test secpolicy_zinject correctly limits namespace access" + - ceab561032ac: "secpolicy_nfs: remove, not used" + - 077e959daf28: "secpolicy_zinject: only permit a global zone credential" + - aa99598276f6: "secpolicy_sys_config: only permit a global zone credential" + - b2c98cf0b079: "secpolicy_zfs: add a note about the power of CAP_SYS_ADMIN" + - Jammy: backport the following upstream OpenZFS patches: + - ceab561032ac: "secpolicy_nfs: remove, not used" + - 077e959daf28: "secpolicy_zinject: only permit a global zone credential" + - aa99598276f6: "secpolicy_sys_config: only permit a global zone credential" + - b2c98cf0b079: "secpolicy_zfs: add a note about the power of CAP_SYS_ADMIN" + - Focal: backport the following upstream OpenZFS patches: + - ceab561032ac: "secpolicy_nfs: remove, not used" + - 077e959daf28: "secpolicy_zinject: only permit a global zone credential" + - aa99598276f6: "secpolicy_sys_config: only permit a global zone credential" + - b2c98cf0b079: "secpolicy_zfs: add a note about the power of CAP_SYS_ADMIN" [Test Plan] + - In a VM, with currently released ZFS, simply run the following commands: + + $ zpool events + + This should return the following: + + TIME CLASS + cannot get event: permission denied + + Disable apparmor restriction for unprivileged userns: + $ sudo sysctl kernel.apparmor_restrict_unprivileged_userns=0 + + Then run the following command: + $ unshare -Ur zpool events + + This will return the following when it should return some form of + "permission denied": + + TIME CLASS + + Using the updated ZFS, perform all of the above. The last command should + now return: + + TIME CLASS + cannot get event: permission denied [Where problems could occur] - - [Other info]
** Description changed: [Impact] - Multiple secpolicy checks did not check for root user permissions on execution, which allows for non-privileged user access to zpool events [Fix] - Stonking: update to zfs 2.4.4 - Resolute: backport the following upstream OpenZFS patches: - - c937ebd8bd29: "ZTS: test secpolicy_sys_config correctly limits namespace access" - - f8962de2eb4c: "ZTS: test secpolicy_zinject correctly limits namespace access" - - ceab561032ac: "secpolicy_nfs: remove, not used" - - 077e959daf28: "secpolicy_zinject: only permit a global zone credential" - - aa99598276f6: "secpolicy_sys_config: only permit a global zone credential" - - b2c98cf0b079: "secpolicy_zfs: add a note about the power of CAP_SYS_ADMIN" + - c937ebd8bd29: "ZTS: test secpolicy_sys_config correctly limits namespace access" + - f8962de2eb4c: "ZTS: test secpolicy_zinject correctly limits namespace access" + - ceab561032ac: "secpolicy_nfs: remove, not used" + - 077e959daf28: "secpolicy_zinject: only permit a global zone credential" + - aa99598276f6: "secpolicy_sys_config: only permit a global zone credential" + - b2c98cf0b079: "secpolicy_zfs: add a note about the power of CAP_SYS_ADMIN" - Noble: backport the following upstream OpenZFS patches: - - c937ebd8bd29: "ZTS: test secpolicy_sys_config correctly limits namespace access" - - f8962de2eb4c: "ZTS: test secpolicy_zinject correctly limits namespace access" - - ceab561032ac: "secpolicy_nfs: remove, not used" - - 077e959daf28: "secpolicy_zinject: only permit a global zone credential" - - aa99598276f6: "secpolicy_sys_config: only permit a global zone credential" - - b2c98cf0b079: "secpolicy_zfs: add a note about the power of CAP_SYS_ADMIN" + - c937ebd8bd29: "ZTS: test secpolicy_sys_config correctly limits namespace access" + - f8962de2eb4c: "ZTS: test secpolicy_zinject correctly limits namespace access" + - ceab561032ac: "secpolicy_nfs: remove, not used" + - 077e959daf28: "secpolicy_zinject: only permit a global zone credential" + - aa99598276f6: "secpolicy_sys_config: only permit a global zone credential" + - b2c98cf0b079: "secpolicy_zfs: add a note about the power of CAP_SYS_ADMIN" - Jammy: backport the following upstream OpenZFS patches: - - ceab561032ac: "secpolicy_nfs: remove, not used" - - 077e959daf28: "secpolicy_zinject: only permit a global zone credential" - - aa99598276f6: "secpolicy_sys_config: only permit a global zone credential" - - b2c98cf0b079: "secpolicy_zfs: add a note about the power of CAP_SYS_ADMIN" + - ceab561032ac: "secpolicy_nfs: remove, not used" + - 077e959daf28: "secpolicy_zinject: only permit a global zone credential" + - aa99598276f6: "secpolicy_sys_config: only permit a global zone credential" + - b2c98cf0b079: "secpolicy_zfs: add a note about the power of CAP_SYS_ADMIN" - Focal: backport the following upstream OpenZFS patches: - - ceab561032ac: "secpolicy_nfs: remove, not used" - - 077e959daf28: "secpolicy_zinject: only permit a global zone credential" - - aa99598276f6: "secpolicy_sys_config: only permit a global zone credential" - - b2c98cf0b079: "secpolicy_zfs: add a note about the power of CAP_SYS_ADMIN" + - ceab561032ac: "secpolicy_nfs: remove, not used" + - 077e959daf28: "secpolicy_zinject: only permit a global zone credential" + - aa99598276f6: "secpolicy_sys_config: only permit a global zone credential" + - b2c98cf0b079: "secpolicy_zfs: add a note about the power of CAP_SYS_ADMIN" [Test Plan] - In a VM, with currently released ZFS, simply run the following commands: $ zpool events This should return the following: - TIME CLASS - cannot get event: permission denied + TIME CLASS + cannot get event: permission denied Disable apparmor restriction for unprivileged userns: $ sudo sysctl kernel.apparmor_restrict_unprivileged_userns=0 Then run the following command: $ unshare -Ur zpool events This will return the following when it should return some form of "permission denied": - TIME CLASS + TIME CLASS Using the updated ZFS, perform all of the above. The last command should now return: - TIME CLASS - cannot get event: permission denied + TIME CLASS + cannot get event: permission denied [Where problems could occur] + - Regression risk should be quite low. The patches modifying tests are only adding test code, run to validate new ZFS versions. One patch removes an unused function, another modifies a code comment. The relevant changes gating the secpolicy_sys_config() and secpolicy_zinject() functions could potentially have some use in workflows that a user could have depended on without root access, but this is a valid reason to sew that up. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2164774 Title: OpenZFS Linux open zpool manipulation and escapes via unprivileged userns To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/zfs-linux/+bug/2164774/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
