From fa23638bcb62b217ea6327c61665a975aae83afa Mon Sep 17 00:00:00 2001 From: Sanidhya Kashyap Date: Wed, 8 Apr 2015 09:43:56 +1000 Subject: [PATCH] ocfs2: trusted xattr missing CAP_SYS_ADMIN check The trusted extended attributes are only visible to the process which hvae CAP_SYS_ADMIN capability but the check is missing in ocfs2 xattr_handler trusted list. The check is important because this will be used for implementing mechanisms in the userspace for which other ordinary processes should not have access to. Signed-off-by: Sanidhya Kashyap Cc: Mark Fasheh Cc: Joel Becker Cc: Taesoo kim Signed-off-by: Andrew Morton --- fs/ocfs2/xattr.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c index 4ca7533be479..3db7da000eda 100644 --- a/fs/ocfs2/xattr.c +++ b/fs/ocfs2/xattr.c @@ -7334,6 +7334,9 @@ static size_t ocfs2_xattr_trusted_list(struct dentry *dentry, char *list, const size_t prefix_len = XATTR_TRUSTED_PREFIX_LEN; const size_t total_len = prefix_len + name_len + 1; + if (!capable(CAP_SYS_ADMIN)) + return 0; + if (list && total_len <= list_size) { memcpy(list, XATTR_TRUSTED_PREFIX, prefix_len); memcpy(list + prefix_len, name, name_len); -- 2.39.5