rpms/udisks2
7
0
Fork 1
Code Issues Pull Requests Releases Activity
a10s
udisks2/udisks2-2.11.1-CVE-2026-7867.patch
RHEL Packaging Agent 2377271ea0 Fix CVE-2026-7867: as-user caller identity handling in udisks2 
Backport fix for CVE-2026-7867 to udisks2-2.11.1. The patch
addresses improper caller identity handling when the 'as-user'
option is used in filesystem mount/unmount operations. Four
upstream commits are cherry-picked: separating real caller
identity from the as-user target, using real caller identity
for mount authorization and unmount checks, and adding an
authorization check for the as-user option.

CVE: CVE-2026-7867
Upstream patches:
 - 39891417ff.patch
 - fef8dbc465.patch
 - 5d14b3846c.patch
 - a76016c118.patch
Resolves: RHEL-173438

This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.

Assisted-by: Ymir
2026-08-13 14:41:55 +00:00

538 lines
24 KiB
Diff
Raw Permalink Blame History

From d8357ec9ac59f1e4991eeb797ff33ca00255f3ef Mon Sep 17 00:00:00 2001
From: Tomas Bzatek <tbzatek@redhat.com>
Date: Tue, 28 Apr 2026 19:10:09 +0200
Subject: [PATCH 1/4] udiskslinuxfilesystem: Separate real caller identity from
as-user target
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
When the 'as-user' option is specified in Filesystem.Mount(), the code
previously overwrote caller_uid/caller_gid with the target user's identity.
This meant downstream functions received a uid they believed was the
D-Bus caller's, but was actually the target's.
Introduce effective_uid/effective_gid/effective_user_name to hold the
as-user target identity (or the caller's identity when as-user is not
set). The real D-Bus caller identity is now always resolved into
caller_uid/caller_gid and used for authorization-related decisions
(setup_by_user, on_user_seat checks), while effective_* is used for
mount point calculation, run_as_uid/run_as_gid, and state tracking.
Reported-by: Azizcan Daştan <azizcan.dastan5@gmail.com>
Reported-by: Özlem Ozan <oozan1725@gmail.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
(cherry picked from commit 397eea88d58f77f6e02d537c4c961201b9245943)
---
src/udiskslinuxfilesystem.c | 93 +++++++++++++++++++++----------------
1 file changed, 53 insertions(+), 40 deletions(-)
diff --git a/src/udiskslinuxfilesystem.c b/src/udiskslinuxfilesystem.c
index 4f03c17e..41bdc317 100644
--- a/src/udiskslinuxfilesystem.c
+++ b/src/udiskslinuxfilesystem.c
@@ -906,7 +906,8 @@ handle_mount_fstab (UDisksDaemon *daemon,
UDisksObject *object,
uid_t caller_uid,
gid_t caller_gid,
- gboolean mount_other_user,
+ uid_t effective_uid,
+ gid_t effective_gid,
const gchar *mount_point_to_use,
const gchar *fstab_mount_options,
GDBusMethodInvocation *invocation,
@@ -937,7 +938,7 @@ handle_mount_fstab (UDisksDaemon *daemon,
* will be replaced by the name of the drive/device in question
*/
message = N_("Authentication is required to mount $(drive)");
- if (mount_other_user)
+ if (caller_uid != effective_uid)
{
action_id = "org.freedesktop.udisks2.filesystem-mount-other-user";
}
@@ -982,15 +983,15 @@ handle_mount_fstab (UDisksDaemon *daemon,
job = udisks_daemon_launch_simple_job (daemon,
UDISKS_OBJECT (object),
"filesystem-mount",
- mount_fstab_as_root ? 0 : caller_uid,
+ mount_fstab_as_root ? 0 : effective_uid,
FALSE,
NULL /* cancellable */);
/* XXX: using run_as_uid for root doesn't work even if the caller is already root */
- if (!mount_fstab_as_root && caller_uid != 0)
+ if (!mount_fstab_as_root && effective_uid != 0)
{
- BDExtraArg uid_arg = { g_strdup ("run_as_uid"), g_strdup_printf ("%d", caller_uid) };
- BDExtraArg gid_arg = { g_strdup ("run_as_gid"), g_strdup_printf ("%d", caller_gid) };
+ BDExtraArg uid_arg = { g_strdup ("run_as_uid"), g_strdup_printf ("%d", effective_uid) };
+ BDExtraArg gid_arg = { g_strdup ("run_as_gid"), g_strdup_printf ("%d", effective_gid) };
const BDExtraArg *extra_args[3] = { &uid_arg, &gid_arg, NULL };
success = bd_fs_mount (NULL, mount_point_to_use, NULL, NULL, extra_args, &error);
@@ -1068,8 +1069,9 @@ handle_mount_dynamic (UDisksDaemon *daemon,
UDisksObject *object,
uid_t caller_uid,
gid_t caller_gid,
- const gchar *caller_user_name,
- gboolean mount_other_user,
+ uid_t effective_uid,
+ gid_t effective_gid,
+ const gchar *effective_user_name,
gchar **mount_point_to_use,
gboolean *mpoint_persistent,
GDBusMethodInvocation *invocation,
@@ -1129,7 +1131,7 @@ handle_mount_dynamic (UDisksDaemon *daemon,
* will be replaced by the name of the drive/device in question
*/
message = N_("Authentication is required to mount $(drive)");
- if (mount_other_user)
+ if (caller_uid != effective_uid)
{
action_id = "org.freedesktop.udisks2.filesystem-mount-other-user";
}
@@ -1163,9 +1165,9 @@ handle_mount_dynamic (UDisksDaemon *daemon,
/* Calculate mount point (guaranteed to be valid UTF-8) */
*mount_point_to_use = calculate_mount_point (daemon,
block,
- caller_uid,
- caller_gid,
- caller_user_name,
+ effective_uid,
+ effective_gid,
+ effective_user_name,
fs_type_to_use,
mpoint_persistent,
&error);
@@ -1180,7 +1182,7 @@ handle_mount_dynamic (UDisksDaemon *daemon,
/* Calculate mount options (guaranteed to be valid UTF-8) */
mount_options = udisks_linux_calculate_mount_options (daemon,
block,
- caller_uid,
+ effective_uid,
fs_signature,
fs_type_to_use,
options,
@@ -1261,14 +1263,16 @@ handle_mount (UDisksFilesystem *filesystem,
UDisksBlock *block;
UDisksDaemon *daemon;
UDisksState *state = NULL;
- gchar *opt_as_user = NULL;
+ const gchar *opt_as_user = NULL;
uid_t caller_uid;
gid_t caller_gid;
+ uid_t effective_uid = 0;
+ gid_t effective_gid = 0;
+ gchar *effective_user_name = NULL;
const gchar * const *existing_mount_points;
gchar *mount_point_to_use = NULL;
gboolean mpoint_persistent = TRUE;
gchar *fstab_mount_options = NULL;
- gchar *caller_user_name = NULL;
GError *error = NULL;
gboolean system_managed = FALSE;
gchar *device = NULL;
@@ -1326,35 +1330,42 @@ handle_mount (UDisksFilesystem *filesystem,
goto out;
}
+ /* Always resolve the real D-Bus caller identity */
+ if (!udisks_daemon_util_get_caller_uid_sync (daemon,
+ invocation,
+ NULL /* GCancellable */,
+ &caller_uid,
+ &error))
+ {
+ g_dbus_method_invocation_return_gerror (invocation, error);
+ g_clear_error (&error);
+ goto out;
+ }
+
+ if (!udisks_daemon_util_get_user_info (caller_uid,
+ &caller_gid,
+ opt_as_user ? NULL : &effective_user_name,
+ &error))
+ {
+ g_dbus_method_invocation_return_gerror (invocation, error);
+ g_clear_error (&error);
+ goto out;
+ }
+
if (opt_as_user)
{
- if (!udisks_daemon_util_get_user_info_by_name (opt_as_user, &caller_uid, &caller_gid, &error))
+ if (!udisks_daemon_util_get_user_info_by_name (opt_as_user, &effective_uid, &effective_gid, &error))
{
g_dbus_method_invocation_return_gerror (invocation, error);
g_clear_error (&error);
goto out;
}
- caller_user_name = g_strdup (opt_as_user);
+ effective_user_name = g_strdup (opt_as_user);
}
else
{
- if (!udisks_daemon_util_get_caller_uid_sync (daemon,
- invocation,
- NULL /* GCancellable */,
- &caller_uid,
- &error))
- {
- g_dbus_method_invocation_return_gerror (invocation, error);
- g_clear_error (&error);
- goto out;
- }
-
- if (!udisks_daemon_util_get_user_info (caller_uid, &caller_gid, &caller_user_name, &error))
- {
- g_dbus_method_invocation_return_gerror (invocation, error);
- g_clear_error (&error);
- goto out;
- }
+ effective_uid = caller_uid;
+ effective_gid = caller_gid;
}
/* Mount it */
@@ -1364,7 +1375,8 @@ handle_mount (UDisksFilesystem *filesystem,
object,
caller_uid,
caller_gid,
- opt_as_user != NULL,
+ effective_uid,
+ effective_gid,
mount_point_to_use,
fstab_mount_options,
invocation,
@@ -1377,8 +1389,9 @@ handle_mount (UDisksFilesystem *filesystem,
object,
caller_uid,
caller_gid,
- caller_user_name,
- opt_as_user != NULL,
+ effective_uid,
+ effective_gid,
+ effective_user_name,
&mount_point_to_use,
&mpoint_persistent,
invocation,
@@ -1390,7 +1403,7 @@ handle_mount (UDisksFilesystem *filesystem,
udisks_state_add_mounted_fs (state,
mount_point_to_use,
udisks_block_get_device_number (block),
- caller_uid,
+ effective_uid,
system_managed,
system_managed ? FALSE : mpoint_persistent);
@@ -1398,7 +1411,7 @@ handle_mount (UDisksFilesystem *filesystem,
device,
system_managed ? " (system)" : "",
mount_point_to_use,
- caller_uid);
+ effective_uid);
udisks_linux_block_object_trigger_uevent_sync (UDISKS_LINUX_BLOCK_OBJECT (object),
UDISKS_DEFAULT_WAIT_TIMEOUT);
@@ -1412,7 +1425,7 @@ handle_mount (UDisksFilesystem *filesystem,
udisks_state_check (state);
g_free (mount_point_to_use);
g_free (fstab_mount_options);
- g_free (caller_user_name);
+ g_free (effective_user_name);
g_free (device);
g_clear_object (&object);
From dd2841b9999d98df5919b030f2e1883eae323b5f Mon Sep 17 00:00:00 2001
From: Tomas Bzatek <tbzatek@redhat.com>
Date: Tue, 28 Apr 2026 19:29:14 +0200
Subject: [PATCH 2/4] udiskslinuxfilesystem: Rework fstab mount authorization
for as-user
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
The polkit authorization logic in handle_mount_fstab() had two problems
when 'as-user' was combined with fstab entries containing 'user',
'users' or 'x-udisks-auth' mount options:
1. The 'filesystem-mount-other-user' polkit check was inside the code
block that is skipped when 'user'/'users'/'x-udisks-auth' options
are present, allowing an unprivileged caller to mount on behalf of
another user without any authorization.
2. When 'user' or 'users' fstab options were present and the initial
mount attempt failed with a permission error, the code would fall
back to mounting as root. This fallback should only be available
when 'x-udisks-auth' is explicitly specified.
Restructure the authorization flow so that:
- The 'filesystem-mount-other-user' check is evaluated first,
independently of fstab mount options, and is always enforced
when caller_uid != effective_uid.
- The root fallback on BD_FS_ERROR_AUTH is gated on 'x-udisks-auth'
being present, not just any of the user-level mount options.
- When root uses 'as-user' without 'user'/'users' fstab options,
the root fallback is implicitly enabled.
- Regular polkit checks (filesystem-mount, mount-system,
mount-other-seat) only apply for same-user mounts without
'user'/'users'/'x-udisks-auth'.
Update the D-Bus API documentation to reflect the new behavior.
Reported-by: Azizcan Daştan <azizcan.dastan5@gmail.com>
Reported-by: Özlem Ozan <oozan1725@gmail.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
(cherry picked from commit 68108081aa9049cf3bb2fb0044cb4de83f962390)
---
data/org.freedesktop.UDisks2.xml | 24 ++++++-----
src/udiskslinuxfilesystem.c | 73 ++++++++++++++++++++++++--------
2 files changed, 70 insertions(+), 27 deletions(-)
diff --git a/data/org.freedesktop.UDisks2.xml b/data/org.freedesktop.UDisks2.xml
index 184340ac..ab9e848d 100644
--- a/data/org.freedesktop.UDisks2.xml
+++ b/data/org.freedesktop.UDisks2.xml
@@ -2711,7 +2711,8 @@
filesystem is mounted on behalf of the specified user instead
of the calling one. This has usually an effect on the returned
@mount_path and it also allows that user to unmount the
- filesystem later. This option expects a user name, not a UID.
+ filesystem later. This option expects a user name, not a UID
+ and always performs an authorization check.
If the device in question is referenced in the
<filename>/etc/fstab</filename> file, the
@@ -2719,15 +2720,18 @@
and the given options or filesystem type given in @options are
ignored.
- If <literal>x-udisks-auth</literal> is specified as an option
- for the device in the <filename>/etc/fstab</filename> file,
- then the <command>mount</command> command is run as the
- calling user, without performing any authorization check
- mentioned above. If this fails because of insufficient
- permissions, an authorization check is performed (which
- typically results in the user having to authenticate as an
- administrator). If authorized, the <command>mount</command>
- command is then run as root.
+ If <literal>x-udisks-auth</literal>, <literal>user</literal> or
+ <literal>users</literal> are specified as options for the
+ device in the <filename>/etc/fstab</filename> file, then the
+ <command>mount</command> command is run as the calling user
+ (or the effective user of the <parameter>as-user</parameter>
+ option respectively), without performing any authorization check
+ mentioned above. If this fails because of insufficient permissions
+ and <literal>x-udisks-auth</literal> is specified, an
+ authorization check is performed (which typically results in
+ the user having to authenticate as an administrator). If
+ authorized, the <command>mount</command> command is then run
+ as root.
The filesystem should be unmounted using the
org.freedesktop.UDisks2.Filesystem.Unmount() method.
diff --git a/src/udiskslinuxfilesystem.c b/src/udiskslinuxfilesystem.c
index 41bdc317..42caf2e0 100644
--- a/src/udiskslinuxfilesystem.c
+++ b/src/udiskslinuxfilesystem.c
@@ -919,30 +919,60 @@ handle_mount_fstab (UDisksDaemon *daemon,
const gchar *message = NULL;
gboolean success = FALSE;
gboolean mount_fstab_as_root = FALSE;
+ gboolean x_udisks_auth = FALSE;
+ gboolean user_mount = FALSE;
UDisksBaseJob *job = NULL;
GError *error = NULL;
block = udisks_object_peek_block (object);
device = udisks_block_get_device (block);
- if (!has_option (fstab_mount_options, "x-udisks-auth") &&
- !has_option (fstab_mount_options, "user") &&
- !has_option (fstab_mount_options, "users"))
+ x_udisks_auth = has_option (fstab_mount_options, "x-udisks-auth");
+ user_mount = x_udisks_auth ||
+ has_option (fstab_mount_options, "user") ||
+ has_option (fstab_mount_options, "users");
+
+ /* 'as-user' rules:
+ * - when caller is root:
+ * - if 'user'/'users' present, do not fall back to mounting as root, unless 'x-udisks-auth' is specified
+ * - if 'user'/'users' not present, try as effective user first and allow fallback to mounting as root (implies 'x-udisks-auth')
+ * - when caller is unprivileged:
+ * - always require polkit auth to prevent identity spoofing
+ * - do not fall back to mounting as root, unless 'x-udisks-auth' is specified
+ * - if neither 'user'/'users'/'x-udisks-auth' present, failure is expected by nature (unless 'as-user=root')
+ *
+ * general fstab mounting rules:
+ * - when caller is root, mount as root, allow anything
+ * - when caller is unprivileged:
+ * - if 'user'/'users' present, do not fall back to mounting as root, unless 'x-udisks-auth' is specified
+ * - if only 'x-udisks-auth' present, mount as user and fall back to mounting as root if not successful
+ * - if neither 'user'/'users'/'x-udisks-auth' present, require polkit auth and mount as root
+ *
+ * Further assumptions:
+ * - when 'user'/'users' not present and mounting as unprivileged, this typically fails but it is still beneficial to try that e.g. for FUSE mounts
+ * - assuming libblockdev mount error code mapping works reliably (for the BD_FS_ERROR_AUTH check)
+ */
+
+ if (caller_uid != effective_uid)
+ {
+ /* Always require authorization when mounting on behalf of another user,
+ * regardless of fstab mount options.
+ */
+ action_id = "org.freedesktop.udisks2.filesystem-mount-other-user";
+
+ /* When 'user'/'users' not present and the caller is root, allow
+ * fallback mounting as root.
+ */
+ if (caller_uid == 0 && !user_mount)
+ x_udisks_auth = TRUE;
+ }
+ else
+ if (!user_mount)
{
mount_fstab_as_root = TRUE;
+
action_id = "org.freedesktop.udisks2.filesystem-mount";
- /* Translators: Shown in authentication dialog when the user
- * requests mounting a filesystem.
- *
- * Do not translate $(drive), it's a placeholder and
- * will be replaced by the name of the drive/device in question
- */
- message = N_("Authentication is required to mount $(drive)");
- if (caller_uid != effective_uid)
- {
- action_id = "org.freedesktop.udisks2.filesystem-mount-other-user";
- }
- else if (!udisks_daemon_util_setup_by_user (daemon, object, caller_uid))
+ if (!udisks_daemon_util_setup_by_user (daemon, object, caller_uid))
{
if (udisks_block_get_hint_system (block))
{
@@ -953,7 +983,17 @@ handle_mount_fstab (UDisksDaemon *daemon,
action_id = "org.freedesktop.udisks2.filesystem-mount-other-seat";
}
}
+ }
+ if (action_id)
+ {
+ /* Translators: Shown in authentication dialog when the user
+ * requests mounting a filesystem.
+ *
+ * Do not translate $(drive), it's a placeholder and
+ * will be replaced by the name of the drive/device in question
+ */
+ message = N_("Authentication is required to mount $(drive)");
if (!udisks_daemon_util_check_authorization_sync (daemon,
object,
action_id,
@@ -963,7 +1003,6 @@ handle_mount_fstab (UDisksDaemon *daemon,
return FALSE;
}
-
if (!g_file_test (mount_point_to_use, G_FILE_TEST_IS_DIR))
{
if (g_mkdir_with_parents (mount_point_to_use, 0755) != 0)
@@ -1013,7 +1052,7 @@ handle_mount_fstab (UDisksDaemon *daemon,
if (!success)
{
- if (!mount_fstab_as_root && g_error_matches (error, BD_FS_ERROR, BD_FS_ERROR_AUTH))
+ if (!mount_fstab_as_root && g_error_matches (error, BD_FS_ERROR, BD_FS_ERROR_AUTH) && x_udisks_auth)
{
g_clear_error (&error);
action_id = "org.freedesktop.udisks2.filesystem-fstab";
From 0e308d4423057f85941caee4870a4afe65af574f Mon Sep 17 00:00:00 2001
From: Tomas Bzatek <tbzatek@redhat.com>
Date: Sun, 3 May 2026 14:00:01 +0200
Subject: [PATCH 3/4] udiskslinuxfilesystem: Log real caller uid for as-user
mounts
When a mount is performed with the as-user option targeting a different
user, log both the effective (target) uid and the real caller uid to
provide an audit trail of who authorized the operation.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
(cherry picked from commit 98e5a76c155640d155280cdb642791f00def736a)
---
src/udiskslinuxfilesystem.c | 22 +++++++++++++++++-----
1 file changed, 17 insertions(+), 5 deletions(-)
diff --git a/src/udiskslinuxfilesystem.c b/src/udiskslinuxfilesystem.c
index 42caf2e0..afb41923 100644
--- a/src/udiskslinuxfilesystem.c
+++ b/src/udiskslinuxfilesystem.c
@@ -1446,11 +1446,23 @@ handle_mount (UDisksFilesystem *filesystem,
system_managed,
system_managed ? FALSE : mpoint_persistent);
- udisks_info ("Mounted %s%s at %s on behalf of uid %u",
- device,
- system_managed ? " (system)" : "",
- mount_point_to_use,
- effective_uid);
+ if (effective_uid != caller_uid)
+ {
+ udisks_info ("Mounted %s%s at %s on behalf of uid %u (requested by uid %u)",
+ device,
+ system_managed ? " (system)" : "",
+ mount_point_to_use,
+ effective_uid,
+ caller_uid);
+ }
+ else
+ {
+ udisks_info ("Mounted %s%s at %s on behalf of uid %u",
+ device,
+ system_managed ? " (system)" : "",
+ mount_point_to_use,
+ effective_uid);
+ }
udisks_linux_block_object_trigger_uevent_sync (UDISKS_LINUX_BLOCK_OBJECT (object),
UDISKS_DEFAULT_WAIT_TIMEOUT);
From 7ab6e2526d5b03a2c19cc41331932ad6166cd087 Mon Sep 17 00:00:00 2001
From: Tomas Bzatek <tbzatek@redhat.com>
Date: Tue, 28 Apr 2026 19:10:38 +0200
Subject: [PATCH 4/4] udisksdaemonutil: Pass as-user target to polkit details
When the 'as-user' D-Bus method option is present, propagate the
target username to polkit details as 'mount.as-user'. This allows
polkit rules to make fine-grained authorization decisions based on
who the mount is being performed for.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
(cherry picked from commit 681d58a76f6aaa5045eb43e665c65f497d35b810)
---
src/udisksdaemonutil.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/src/udisksdaemonutil.c b/src/udisksdaemonutil.c
index e19e1500..33f51e1d 100644
--- a/src/udisksdaemonutil.c
+++ b/src/udisksdaemonutil.c
@@ -797,6 +797,14 @@ udisks_daemon_util_check_authorization_sync_with_error (UDisksDaemon *
polkit_details_insert (details, "polkit.message", message);
polkit_details_insert (details, "polkit.gettext_domain", "udisks2");
+ if (options != NULL &&
+ g_strcmp0 (action_id, "org.freedesktop.udisks2.filesystem-mount-other-user") == 0)
+ {
+ const gchar *as_user = NULL;
+ g_variant_lookup (options, "as-user", "&s", &as_user);
+ _safe_polkit_details_insert (details, "mount.as-user", as_user);
+ }
+
/* Find drive associated with the block device, if any */
if (object != NULL)
{
Reference in New Issue View Git Blame Copy Permalink