[PATCH 1/2] security check for LOOP_SET_CAPACITY
From: J. R. Okajima <hidden>
Date: 2009-01-07 06:14:14
Subsystem:
block layer, the rest · Maintainers:
Jens Axboe, Linus Torvalds
Respoding the comment from Linus Torvalds, LOOP_SET_CAPACITY now requires the device file to be opened for write or CAP_SYS_ADMIN. Signed-off-by: J. R. Okajima <hooanon05-/E1597aS9LR3+QwDJ9on6Q@public.gmane.org> --- drivers/block/loop.c | 4 +++- 1 files changed, 3 insertions(+), 1 deletions(-)
diff --git a/drivers/block/loop.c b/drivers/block/loop.c
index 80e523e..fcd28a7 100644
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c@@ -1210,7 +1210,9 @@ static int lo_ioctl(struct block_device *bdev, fmode_t mode, err = loop_get_status64(lo, (struct loop_info64 __user *) arg); break; case LOOP_SET_CAPACITY: - err = loop_set_capacity(lo, bdev); + err = -EPERM; + if ((mode & FMODE_WRITE) || capable(CAP_SYS_ADMIN)) + err = loop_set_capacity(lo, bdev); break; default: err = lo->ioctl ? lo->ioctl(lo, cmd, arg) : -EINVAL;
--
1.5.5.4.dirty
--
To unsubscribe from this list: send the line "unsubscribe linux-api" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at http://vger.kernel.org/majordomo-info.html