kpriv/linux-hardened
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

ovl: add config to disable unprivileged user namespace mounts

Browse source 
When disabled, unprivileged users will not be able to create
new overlayfs mounts. This cuts the attack surface if no
unprivileged user namespace mounts are required like for
running rootless containers.

Signed-off-by: Levente Polyak <levente@leventepolyak.net>
This commit is contained in:
Levente Polyak 2021-03-11 23:09:50 +01:00
parent 74bb8af8fa
commit 7ba8c9d673
No known key found for this signature in database
GPG key ID: FC1B547C8D8172C8
2 changed files with 18 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
fs/overlayfs/Kconfig
View file

@ -124,3 +124,19 @@ config OVERLAY_FS_METACOPY
that doesn't support this feature will have unexpected results.
If unsure, say N.
config OVERLAY_FS_UNPRIVILEGED
bool "Overlayfs: turn on unprivileged user namespace mounts"
default n
depends on OVERLAY_FS
help
When disabled, unprivileged users will not be able to create
new overlayfs mounts. This cuts the attack surface if no
unprivileged user namespace mounts are required like for
running rootless containers.
Overlayfs has been part of several recent local privilege
escalation exploits, so if you are security-conscious
you want to disable this.
If unsure, say N.

2
fs/overlayfs/super.c
View file

@ -2189,7 +2189,9 @@ static struct dentry *ovl_mount(struct file_system_type *fs_type, int flags,
static struct file_system_type ovl_fs_type = {
.owner = THIS_MODULE,
.name = "overlay",
#ifdef CONFIG_OVERLAY_FS_UNPRIVILEGED
.fs_flags = FS_USERNS_MOUNT,
#endif
.mount = ovl_mount,
.kill_sb = kill_anon_super,
};