]> granicus.if.org Git - zfs/commit
Project dnode should be protected by local MAC
authorTom Caputi <tcaputi@datto.com>
Tue, 20 Feb 2018 17:41:07 +0000 (12:41 -0500)
committerBrian Behlendorf <behlendorf1@llnl.gov>
Tue, 20 Feb 2018 17:41:07 +0000 (09:41 -0800)
commit7b30ee6bafe91ebd3b34433ef3b943fd07a98cea
treedf1e0d46ed28d62cfb7efef1c38ce104228d30b3
parente921f6508b212c61fcedd0eeb2f9cf9da1abc4d1
Project dnode should be protected by local MAC

This patch corrects a small security issue with 9c5167d1. When the
project dnode was added to the objset_phys_t, it was not included
in the local MAC for cryptographic protection, allowing an attacker
to modify this data without the consent of the key holder. This
patch does represent an on-disk format change for anyone using
project dnodes on an encrypted dataset.

Signed-off-by: Tom Caputi <tcaputi@datto.com>
Signed-off-by: Brian Behlendorf <behlendorf1@llnl.gov>
Closes #7177
module/zfs/zio_crypt.c