Commit c7031c14 authored by Julius Hemanth Pitti's avatar Julius Hemanth Pitti Committed by Andrew Morton
Browse files

proc/sysctl: make protected_* world readable 

protected_* files have 600 permissions which prevents non-superuser from
reading them.

Container like "AWS greengrass" refuse to launch unless
protected_hardlinks and protected_symlinks are set.  When containers like
these run with "userns-remap" or "--user" mapping container's root to
non-superuser on host, they fail to run due to denied read access to these
files.

As these protections are hardly a secret, and do not possess any security
risk, making them world readable.

Though above greengrass usecase needs read access to only
protected_hardlinks and protected_symlinks files, setting all other
protected_* files to 644 to keep consistency.

Link: http://lkml.kernel.org/r/20200709235115.56954-1-jpitti@cisco.com


Fixes: 800179c9 ("fs: add link restrictions")
Signed-off-by: default avatarJulius Hemanth Pitti <jpitti@cisco.com>
Acked-by: default avatarKees Cook <keescook@chromium.org>
Acked-by: default avatarLuis Chamberlain <mcgrof@kernel.org>
Cc: Iurii Zaikin <yzaikin@google.com>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
parent 25d97678

fs/namei.c

+4 −4
Original line number Diff line number Diff line
@@ -1031,7 +1031,7 @@ static struct ctl_table namei_sysctls[] = { 
		.procname	= "protected_symlinks",

		.data		= &sysctl_protected_symlinks,

		.maxlen		= sizeof(int),

		.mode		= 0600,

		.mode		= 0644,

		.proc_handler	= proc_dointvec_minmax,

		.extra1		= SYSCTL_ZERO,

		.extra2		= SYSCTL_ONE,
@@ -1040,7 +1040,7 @@ static struct ctl_table namei_sysctls[] = { 
		.procname	= "protected_hardlinks",

		.data		= &sysctl_protected_hardlinks,

		.maxlen		= sizeof(int),

		.mode		= 0600,

		.mode		= 0644,

		.proc_handler	= proc_dointvec_minmax,

		.extra1		= SYSCTL_ZERO,

		.extra2		= SYSCTL_ONE,
@@ -1049,7 +1049,7 @@ static struct ctl_table namei_sysctls[] = { 
		.procname	= "protected_fifos",

		.data		= &sysctl_protected_fifos,

		.maxlen		= sizeof(int),

		.mode		= 0600,

		.mode		= 0644,

		.proc_handler	= proc_dointvec_minmax,

		.extra1		= SYSCTL_ZERO,

		.extra2		= SYSCTL_TWO,
@@ -1058,7 +1058,7 @@ static struct ctl_table namei_sysctls[] = { 
		.procname	= "protected_regular",

		.data		= &sysctl_protected_regular,

		.maxlen		= sizeof(int),

		.mode		= 0600,

		.mode		= 0644,

		.proc_handler	= proc_dointvec_minmax,

		.extra1		= SYSCTL_ZERO,

		.extra2		= SYSCTL_TWO,