PL3131 fix: prevent vservers from escaping chroot() barriers

diff --git a/fs/ext2/acl.c b/fs/ext2/acl.c
index 74acc78..d232026 100644 (file)
--- a/fs/ext2/acl.c
+++ b/fs/ext2/acl.c
@@ -9,6 +9,7 @@
 #include <linux/slab.h>
 #include <linux/fs.h>
 #include <linux/namei.h> 
+#include <linux/vs_base.h>
 #include "ext2.h"
 #include "xattr.h"
 #include "acl.h"
@@ -291,6 +292,9 @@ ext2_permission(struct inode *inode, int mask, struct nameidata *nd)
 {
        int mode = inode->i_mode;
 
+       /* Prevent vservers from escaping chroot() barriers */
+       if (IS_BARRIER(inode) && !vx_check(0, VX_ADMIN))
+               return -EACCES;
        /* Nobody gets write access to a read-only fs */
        if ((mask & MAY_WRITE) && (IS_RDONLY(inode) ||
            (nd && MNT_IS_RDONLY(nd->mnt))) &&

diff --git a/fs/namei.c b/fs/namei.c
index 0929e9b..656430d 100644 (file)
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -165,6 +165,10 @@ int vfs_permission(struct inode * inode, int mask)
 {
        umode_t                 mode = inode->i_mode;
 
+       /* Prevent vservers from escaping chroot() barriers */
+       if (IS_BARRIER(inode) && !vx_check(0, VX_ADMIN))
+               return -EACCES;
+
        if (mask & MAY_WRITE) {
                /*
                 * Nobody gets write access to a read-only fs.

diff --git a/fs/reiserfs/xattr.c b/fs/reiserfs/xattr.c
index f8babe6..a70801f 100644 (file)
--- a/fs/reiserfs/xattr.c
+++ b/fs/reiserfs/xattr.c
@@ -1338,6 +1338,10 @@ __reiserfs_permission (struct inode *inode, int mask, struct nameidata *nd,
 {
        umode_t                 mode = inode->i_mode;
 
+       /* Prevent vservers from escaping chroot() barriers */
+       if (IS_BARRIER(inode) && !vx_check(0, VX_ADMIN))
+               return -EACCES;
+
        if (mask & MAY_WRITE) {
                /*
                 * Nobody gets write access to a read-only fs.