Date: Tue, 6 Apr 2021 19:20:24 GMT From: Mark Johnston <markj@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Subject: git: e59bfcaa37fc - releng/11.4 - mount: Disallow mounting over a jail root Message-ID: <202104061920.136JKOtx006557@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch releng/11.4 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=e59bfcaa37fc8fe5c6e200e53aa6daa841751cb7 commit e59bfcaa37fc8fe5c6e200e53aa6daa841751cb7 Author: Mark Johnston <markj@FreeBSD.org> AuthorDate: 2021-04-06 19:09:43 +0000 Commit: Mark Johnston <markj@FreeBSD.org> CommitDate: 2021-04-06 19:10:21 +0000 mount: Disallow mounting over a jail root Discussed with: jamie Approved by: so Security: CVE-2020-25584 Security: FreeBSD-SA-21:10.jail_mount (cherry picked from commit 6f7815083ad66c34bad0dfa08c7033ff670b3be1) --- sys/kern/vfs_mount.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/sys/kern/vfs_mount.c b/sys/kern/vfs_mount.c index 3e5ebe715a42..c88f2be54d02 100644 --- a/sys/kern/vfs_mount.c +++ b/sys/kern/vfs_mount.c @@ -830,6 +830,11 @@ vfs_domount_first( ASSERT_VOP_ELOCKED(vp, __func__); KASSERT((fsflags & MNT_UPDATE) == 0, ("MNT_UPDATE shouldn't be here")); + if (vp == td->td_ucred->cr_prison->pr_root) { + vput(vp); + return (EPERM); + } + /* * If the user is not root, ensure that they own the directory * onto which we are attempting to mount.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202104061920.136JKOtx006557>