From nobody Sun Sep 21 21:45:50 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 82B7EC0502C for ; Mon, 29 Aug 2022 11:38:02 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232817AbiH2Lh7 (ORCPT ); Mon, 29 Aug 2022 07:37:59 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42104 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232428AbiH2LhB (ORCPT ); Mon, 29 Aug 2022 07:37:01 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 90F766DF9E; Mon, 29 Aug 2022 04:21:28 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 2137DB80EF5; Mon, 29 Aug 2022 11:09:47 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7267DC433D6; Mon, 29 Aug 2022 11:09:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661771385; bh=aw/3zNij5f5EZVoU20NAljEgXvZHzpu7ZFU2j+Zl8Uo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=P3EHVlYkRWME5GIDBECg3mfTmOZEO6+JCrw0pPzlsSJifvlxdTSri1pkRTkIxHVQR U7dqWHpePdM8DzLoNJ5Z1pPPI66MVNJvmEFF/J7j8ZMYNFUB5MUVUdjYBrF1yIkkDX wLmbis0gGYADSVfdSZ52K9/M1CPpzPNsoIHbpstg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Qu Wenruo , Filipe Manana , Goldwyn Rodrigues , David Sterba Subject: [PATCH 5.15 098/136] btrfs: check if root is readonly while setting security xattr Date: Mon, 29 Aug 2022 12:59:25 +0200 Message-Id: <20220829105808.695855923@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220829105804.609007228@linuxfoundation.org> References: <20220829105804.609007228@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Goldwyn Rodrigues commit b51111271b0352aa596c5ae8faf06939e91b3b68 upstream. For a filesystem which has btrfs read-only property set to true, all write operations including xattr should be denied. However, security xattr can still be changed even if btrfs ro property is true. This happens because xattr_permission() does not have any restrictions on security.*, system.* and in some cases trusted.* from VFS and the decision is left to the underlying filesystem. See comments in xattr_permission() for more details. This patch checks if the root is read-only before performing the set xattr operation. Testcase: DEV=3D/dev/vdb MNT=3D/mnt mkfs.btrfs -f $DEV mount $DEV $MNT echo "file one" > $MNT/f1 setfattr -n "security.one" -v 2 $MNT/f1 btrfs property set /mnt ro true setfattr -n "security.one" -v 1 $MNT/f1 umount $MNT CC: stable@vger.kernel.org # 4.9+ Reviewed-by: Qu Wenruo Reviewed-by: Filipe Manana Signed-off-by: Goldwyn Rodrigues Reviewed-by: David Sterba Signed-off-by: David Sterba Signed-off-by: Greg Kroah-Hartman --- fs/btrfs/xattr.c | 3 +++ 1 file changed, 3 insertions(+) --- a/fs/btrfs/xattr.c +++ b/fs/btrfs/xattr.c @@ -391,6 +391,9 @@ static int btrfs_xattr_handler_set(const const char *name, const void *buffer, size_t size, int flags) { + if (btrfs_root_readonly(BTRFS_I(inode)->root)) + return -EROFS; + name =3D xattr_full_name(handler, name); return btrfs_setxattr_trans(inode, name, buffer, size, flags); }