The branch releng/11.4 has been updated by markj:
URL:
https://cgit.FreeBSD.org/src/commit/?id=e59bfcaa37fc8fe5c6e200e53aa6daa841751cb7
commit e59bfcaa37fc8fe5c6e200e53aa6daa841751cb7
Author: Mark Johnston <ma...@freebsd.org>
AuthorDate: 2021-04-06 19:09:43 +0000
Commit: Mark Johnston <ma...@freebsd.org>
CommitDate: 2021-04-06 19:10:21 +0000
mount: Disallow mounting over a jail root
Discussed with: jamie
Approved by: so
Security: CVE-2020-25584
Security: FreeBSD-SA-21:10.jail_mount
(cherry picked from commit 6f7815083ad66c34bad0dfa08c7033ff670b3be1)
---
sys/kern/vfs_mount.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/sys/kern/vfs_mount.c b/sys/kern/vfs_mount.c
index 3e5ebe715a42..c88f2be54d02 100644
--- a/sys/kern/vfs_mount.c
+++ b/sys/kern/vfs_mount.c
@@ -830,6 +830,11 @@ vfs_domount_first(
ASSERT_VOP_ELOCKED(vp, __func__);
KASSERT((fsflags & MNT_UPDATE) == 0, ("MNT_UPDATE shouldn't be here"));
+ if (vp == td->td_ucred->cr_prison->pr_root) {
+ vput(vp);
+ return (EPERM);
+ }
+
/*
* If the user is not root, ensure that they own the directory
* onto which we are attempting to mount.
_______________________________________________
dev-commits-src-all@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/dev-commits-src-all
To unsubscribe, send any mail to "dev-commits-src-all-unsubscr...@freebsd.org"
