David Howells 4c0c03ca54 CIFS: Fix a malicious redirect problem in the DNS lookup code ... Fix the security problem in the CIFS filesystem DNS lookup code in which a malicious redirect could be installed by a random user by simply adding a result record into one of their keyrings with add_key() and then invoking a CIFS CFS lookup [CVE-2010-2524]. This is done by creating an internal keyring specifically for the caching of DNS lookups. To enforce the use of this keyring, the module init routine creates a set of override credentials with the keyring installed as the thread keyring and instructs request_key() to only install lookup result keys in that keyring. The override is then applied around the call to request_key(). This has some additional benefits when a kernel service uses this module to request a key: (1) The result keys are owned by root, not the user that caused the lookup. (2) The result keys don't pop up in the user's keyrings. (3) The result keys don't come out of the quota of the user that caused the lookup. The keyring can be viewed as root by doing cat /proc/keys: 2a0ca6c3 I----- 1 perm 1f030000 0 0 keyring .dns_resolver: 1/4 It can then be listed with 'keyctl list' by root. # keyctl list 0x2a0ca6c3 1 key in keyring: 726766307: --alswrv 0 0 dns_resolver: foo.bar.com Signed-off-by: David Howells <dhowells@redhat.com> Reviewed-and-Tested-by: Jeff Layton <jlayton@redhat.com> Acked-by: Steve French <smfrench@gmail.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>		2010-07-22 09:42:40 -07:00
..
9p	drop unused dentry argument to ->fsync	2010-05-27 22:05:02 -04:00
adfs	kill spurious reference to vmtruncate	2010-05-27 22:15:42 -04:00
affs	drop unused dentry argument to ->fsync	2010-05-27 22:05:02 -04:00
afs	writeback: remove writeback_inodes_wbc	2010-07-06 08:54:03 +02:00
autofs	fs/: do not fallback to default_llseek() when readdir() uses BKL	2010-05-27 09:12:56 -07:00
autofs4	fs/autofs4: use memdup_user	2010-05-27 09:12:41 -07:00
befs	…
bfs	rename the generic fsync implementations	2010-05-27 22:06:06 -04:00
btrfs	Merge git://git.kernel.org/pub/scm/linux/kernel/git/mason/btrfs-unstable	2010-07-19 19:33:02 -07:00
cachefiles	…
ceph	ceph: do not include cap/dentry releases in replayed messages	2010-07-16 10:30:18 -07:00
cifs	CIFS: Fix a malicious redirect problem in the DNS lookup code	2010-07-22 09:42:40 -07:00
coda	drop unused dentry argument to ->fsync	2010-05-27 22:05:02 -04:00
configfs	fix setattr error handling in sysfs, configfs	2010-06-04 17:16:29 -04:00
cramfs	…
debugfs	Add x64 support to debugfs	2010-05-19 22:41:57 -04:00
devpts	Simplify devpts_get_sb() failure exits	2010-05-21 18:31:12 -04:00
dlm	…
ecryptfs	kill spurious reference to vmtruncate	2010-05-27 22:15:42 -04:00
efs	…
exofs	drop unused dentry argument to ->fsync	2010-05-27 22:05:02 -04:00
exportfs	…
ext2	ext2: update ctime when changing the file's permission by setfacl	2010-06-25 01:20:37 +02:00
ext3	ext3: update ctime when changing the file's permission by setfacl	2010-06-25 01:20:37 +02:00
ext4	ext4: Fix remaining racy updates of EXT4_I(inode)->i_flags	2010-06-05 11:51:27 -04:00
fat	fat: convert to use the new truncate convention.	2010-05-27 22:16:02 -04:00
freevxfs	fs/: do not fallback to default_llseek() when readdir() uses BKL	2010-05-27 09:12:56 -07:00
fscache	FS-Cache: Remove unneeded null checks	2010-06-01 13:32:11 -07:00
fuse	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse	2010-05-30 09:16:14 -07:00
gfs2	mm: add context argument to shrinker callback	2010-07-19 14:56:17 +10:00
hfs	…
hfsplus	…
hostfs	drop unused dentry argument to ->fsync	2010-05-27 22:05:02 -04:00
hpfs	drop unused dentry argument to ->fsync	2010-05-27 22:05:02 -04:00
hppfs	drop unused dentry argument to ->fsync	2010-05-27 22:05:02 -04:00
hugetlbfs	rename the generic fsync implementations	2010-05-27 22:06:06 -04:00
isofs	fs/: do not fallback to default_llseek() when readdir() uses BKL	2010-05-27 09:12:56 -07:00
jbd	ext3: Fix waiting on transaction during fsync	2010-05-21 19:30:41 +02:00
jbd2	jbd2/ocfs2: Fix block checksumming when a buffer is used in several transactions	2010-07-15 15:17:47 -07:00
jffs2	Fix up trivial spelling errors ('taht' -> 'that')	2010-07-21 09:25:42 -07:00
jfs	Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs-2.6	2010-05-30 09:11:11 -07:00
lockd	…
logfs	drop unused dentry argument to ->fsync	2010-05-27 22:05:02 -04:00
minix	Minix: Clean up left over label	2010-06-04 17:16:30 -04:00
ncpfs	drop unused dentry argument to ->fsync	2010-05-27 22:05:02 -04:00
nfs	mm: add context argument to shrinker callback	2010-07-19 14:56:17 +10:00
nfs_common	…
nfsd	Merge branch 'for-2.6.35' of git://linux-nfs.org/~bfields/linux	2010-06-09 12:43:04 -07:00
nilfs2	nilfs2: remove obsolete declarations of cache constructor and destructor	2010-05-31 20:50:29 +09:00
nls	…
notify	Saner locking around deactivate_super()	2010-05-21 18:31:14 -04:00
ntfs	drop unused dentry argument to ->fsync	2010-05-27 22:05:02 -04:00
ocfs2	Merge branch 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jlbec/ocfs2	2010-07-18 10:09:25 -07:00
omfs	rename the generic fsync implementations	2010-05-27 22:06:06 -04:00
openpromfs	…
partitions	[S390] dasd: use correct label location for diag fba disks	2010-07-19 09:22:50 +02:00
proc	nommu: add '[stack]' label to /proc/pid/maps output	2010-06-29 15:29:30 -07:00
qnx4	rename the generic fsync implementations	2010-05-27 22:06:06 -04:00
quota	mm: add context argument to shrinker callback	2010-07-19 14:56:17 +10:00
ramfs	fs: convert simple fs to new truncate	2010-05-27 22:15:47 -04:00
reiserfs	Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs-2.6	2010-05-30 09:11:11 -07:00
romfs	…
smbfs	kill spurious reference to vmtruncate	2010-05-27 22:15:42 -04:00
squashfs	squashfs: fix name reading in squashfs_xattr_get	2010-05-23 08:27:42 +01:00
sysfs	fix setattr error handling in sysfs, configfs	2010-06-04 17:16:29 -04:00
sysv	sysvfs: fix NULL deref. when allocating new inode	2010-06-29 15:29:32 -07:00
ubifs	mm: add context argument to shrinker callback	2010-07-19 14:56:17 +10:00
udf	Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs-2.6	2010-05-30 09:11:11 -07:00
ufs	Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs-2.6	2010-05-30 09:11:11 -07:00
xfs	xfs: track AGs with reclaimable inodes in per-ag radix tree	2010-07-20 09:43:39 +10:00
Kconfig	…
Kconfig.binfmt	…
Makefile	Take statfs variants to fs/statfs.c	2010-05-21 18:31:17 -04:00
aio.c	get rid of the magic around f_count in aio	2010-05-27 22:03:07 -04:00
anon_inodes.c	Revert "anon_inode: set S_IFREG on the anon_inode"	2010-05-27 22:03:05 -04:00
attr.c	fs: introduce new truncate sequence	2010-05-27 22:15:33 -04:00
bad_inode.c	drop unused dentry argument to ->fsync	2010-05-27 22:05:02 -04:00
binfmt_aout.c	…
binfmt_elf.c	…
binfmt_elf_fdpic.c	binfmt_elf_fdpic: Fix clear_user() error handling	2010-06-01 08:11:06 -07:00
binfmt_em86.c	…
binfmt_flat.c	flat: tweak default stack alignment	2010-06-29 15:29:31 -07:00
binfmt_misc.c	…
binfmt_script.c	…
binfmt_som.c	…
bio-integrity.c	…
bio.c	…
block_dev.c	block: remove duplicate BUG_ON() in bd_finish_claiming()	2010-06-10 19:08:34 +02:00
buffer.c	fs: introduce new truncate sequence	2010-05-27 22:15:33 -04:00
char_dev.c	…
compat.c	fs/compat_rw_copy_check_uvector: add missing compat_ptr call	2010-06-04 15:21:44 -07:00
compat_binfmt_elf.c	…
compat_ioctl.c	…
dcache.c	mm: add context argument to shrinker callback	2010-07-19 14:56:17 +10:00
dcookies.c	…
direct-io.c	fs: introduce new truncate sequence	2010-05-27 22:15:33 -04:00
drop_caches.c	new helper: iterate_supers()	2010-05-21 18:31:16 -04:00
eventfd.c	…
eventpoll.c	…
exec.c	exit: avoid sig->count in de_thread/__exit_signal synchronization	2010-05-27 09:12:46 -07:00
fcntl.c	fs/fcntl.c:kill_fasync_rcu() fa_lock must be IRQ-safe	2010-06-29 15:29:32 -07:00
fifo.c	…
file.c	…
file_table.c	get rid of the magic around f_count in aio	2010-05-27 22:03:07 -04:00
filesystems.c	…
fs-writeback.c	writeback: simplify the write back thread queue	2010-07-06 08:59:53 +02:00
fs_struct.c	…
generic_acl.c	fs: xattr_handler table should be const	2010-05-21 18:31:18 -04:00
inode.c	mm: add context argument to shrinker callback	2010-07-19 14:56:17 +10:00
internal.h	Bury __put_super_and_need_restart()	2010-05-21 18:31:16 -04:00
ioctl.c	Introduce freeze_super and thaw_super for the fsfreeze ioctl	2010-05-21 18:31:18 -04:00
ioprio.c	…
libfs.c	wrong type for 'magic' argument in simple_fill_super()	2010-06-04 17:16:28 -04:00
locks.c	…
mbcache.c	mm: add context argument to shrinker callback	2010-07-19 14:56:17 +10:00
mpage.c	…
namei.c	VFS: fix recent breakage of FS_REVAL_DOT	2010-05-27 22:03:06 -04:00
namespace.c	Merge branch 'next' into for-linus	2010-05-18 08:57:00 +10:00
nfsctl.c	…
no-block.c	…
open.c	Take statfs variants to fs/statfs.c	2010-05-21 18:31:17 -04:00
pipe.c	pipe: fix check in "set size" fcntl	2010-06-10 19:08:34 +02:00
pnode.c	…
pnode.h	…
posix_acl.c	…
read_write.c	vfs: introduce noop_llseek()	2010-05-27 09:12:56 -07:00
read_write.h	…
readdir.c	…
select.c	…
seq_file.c	…
signalfd.c	…
splice.c	splice: check f_mode for seekable file	2010-06-30 08:12:37 +02:00
stack.c	…
stat.c	…
statfs.c	Take statfs variants to fs/statfs.c	2010-05-21 18:31:17 -04:00
super.c	fs: fix superblock iteration race	2010-06-29 10:38:22 -07:00
sync.c	Merge branch 'master' into for-linus	2010-06-01 12:42:12 +02:00
timerfd.c	fs/timerfd.c: make use of wait_event_interruptible_locked_irq()	2010-05-20 13:21:42 -07:00
utimes.c	…
xattr.c	fs: xattr_handler table should be const	2010-05-21 18:31:18 -04:00
xattr_acl.c	…