Message ID | 1461699396-33000-21-git-send-email-seth.forshee@canonical.com (mailing list archive) |
---|---|
State | New, archived |
Headers | show
Return-Path: <selinux-bounces@tycho.nsa.gov> X-Original-To: patchwork-selinux@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork2.web.kernel.org (Postfix) with ESMTP id 28C5FBF29F for <patchwork-selinux@patchwork.kernel.org>; Tue, 26 Apr 2016 20:14:02 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 65F5320138 for <patchwork-selinux@patchwork.kernel.org>; Tue, 26 Apr 2016 20:14:01 +0000 (UTC) Received: from emsm-gh1-uea11.nsa.gov (smtp.nsa.gov [8.44.101.9]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 390692014A for <patchwork-selinux@patchwork.kernel.org>; Tue, 26 Apr 2016 20:14:00 +0000 (UTC) X-IronPort-AV: E=Sophos;i="5.24,538,1454976000"; d="scan'208";a="15644230" IronPort-PHdr: =?us-ascii?q?9a23=3AbJUTfB0/GFqfyeq7smDT+DRfVm0co7zxezQtwd8Z?= =?us-ascii?q?sekUIvad9pjvdHbS+e9qxAeQG96Lu7Qb2qGP6P6ocFdDyKjCmUhKSIZLWR4BhJ?= =?us-ascii?q?detC0bK+nBN3fGKuX3ZTcxBsVIWQwt1Xi6NU9IBJS2PAWK8TWM5DIfUi/yKRBy?= =?us-ascii?q?brysXNWC34LohqvroMObSj4LrQT+SIs6FA+xowTVu5teqqpZAYF19CH0pGBVcf?= =?us-ascii?q?9d32JiKAHbtR/94sCt4MwrqHwI6LoJvvRNWqTifqk+UacQTHF/azh0t4XXskyJ?= =?us-ascii?q?YBGO7TMjFC08kxdEDhLA5RewFsP8uCr3uudn3QGKOMztVrEzX3Kp6KI9DFfNiS?= =?us-ascii?q?QDMCVxy3PakMF8jeoPpROioxtk65XGbZuYOPs4fr6LLv0AQm8UZctNV2RvBZmn?= =?us-ascii?q?b4YCR74aMPpY6Yf6vUAOoBaWDgCqA+XuwTZMwHTx2PtpgKwaDQja0Vl4TJo1u3?= =?us-ascii?q?POoYCwbf9KXA=3D=3D?= X-IPAS-Result: =?us-ascii?q?A2EJBQBiyx9X/wHyM5BeHAGCcCuBULtyJIF2hUVMAQEBAQE?= =?us-ascii?q?BAgJiJ4ItfVs9AQEBAwECDxUTBgEBDCALAQIDCQEBFykICAMBLQMBBQELEQYBB?= =?us-ascii?q?wsFGAQBiAgBpVGBMT4xik+FKAEEjEcBAQEHAQEBARYGCoQNggqIWAIRAYV0AY5?= =?us-ascii?q?MiUiBVYxEiSolhUBFjS0wgQ5iggUbFoFTTgGHbwkXgR4BAQE?= Received: from unknown (HELO tarius.tycho.ncsc.mil) ([144.51.242.1]) by emsm-gh1-uea11.nsa.gov with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 26 Apr 2016 20:13:37 +0000 Received: from prometheus.infosec.tycho.ncsc.mil (prometheus [192.168.25.40]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id u3QKDaA9022420; Tue, 26 Apr 2016 16:13:37 -0400 Received: from tarius.tycho.ncsc.mil (tarius.infosec.tycho.ncsc.mil [144.51.242.1]) by prometheus.infosec.tycho.ncsc.mil (8.15.2/8.15.2) with ESMTP id u3QJbIBa172339 for <selinux@prometheus.infosec.tycho.ncsc.mil>; Tue, 26 Apr 2016 15:37:18 -0400 Received: from goalie.tycho.ncsc.mil (goalie [144.51.242.250]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id u3QJak09011587 for <selinux@tycho.nsa.gov>; Tue, 26 Apr 2016 15:37:18 -0400 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: A0A+BQD9wR9X/yQp0ApeHYJwK4FQt3CEEYYPAoFATAEBAQEBAWYnhEIBAQEDEhUZAQE3AQ9RNAEFARwGARIiiAgBpVeBMT4xik+FKAEEjEoBAQEBAQEBAwIBFwYKhA2CCohYhgiOTYlIgVWMRIkqhWVFjS0wgQ5igXgNGxaBU04Bh2+BPgEBAQ X-IPAS-Result: A0A+BQD9wR9X/yQp0ApeHYJwK4FQt3CEEYYPAoFATAEBAQEBAWYnhEIBAQEDEhUZAQE3AQ9RNAEFARwGARIiiAgBpVeBMT4xik+FKAEEjEoBAQEBAQEBAwIBFwYKhA2CCohYhgiOTYlIgVWMRIkqhWVFjS0wgQ5igXgNGxaBU04Bh2+BPgEBAQ X-IronPort-AV: E=Sophos;i="5.24,537,1454994000"; d="scan'208";a="5410395" Received: from emsm-gh1-uea10.corp.nsa.gov (HELO emsm-gh1-uea10.nsa.gov) ([10.208.41.36]) by goalie.tycho.ncsc.mil with ESMTP; 26 Apr 2016 15:37:18 -0400 IronPort-PHdr: =?us-ascii?q?9a23=3AHlhH4RBVkd6ZS8eNM4V7UyQJP3N1i/DPJgcQr6Af?= =?us-ascii?q?oPdwSP/5r8bcNUDSrc9gkEXOFd2CrakU26yJ4uu5AjRIyK3CmU5BWaQEbwUCh8?= =?us-ascii?q?QSkl5oK+++Imq/EsTXaTcnFt9JTl5v8iLzG0FUHMHjew+a+SXqvnYsExnyfTB4?= =?us-ascii?q?Ov7yUtaLyZ/nh6btqtaKOF0ArQH+SI0xBS3+lR/WuMgSjNkqAYcK4TyNnEF1ff?= =?us-ascii?q?9Lz3hjP1OZkkW0zM6x+Jl+73YY4Kp5pIZoGJ/3dKUgTLFeEC9ucyVsvJWq5lH/?= =?us-ascii?q?Sl7Fy2EdWS0p1FJiAgXJ4Qv/V5G7+n/3vOtw1CSAOOXmSLEvQjWl6eFgTxq+zG?= =?us-ascii?q?8iNj0993qfsd59lq9XoVr1oh18x4nPSJqHOeBzcqKbfc5MFkRbWcMEbCFdAsuS?= =?us-ascii?q?aJEUD+cMdbJDopX94VUJtwC+CASED+rpzTlJjXbym6Y91rJyQkn9wAU8EodW4z?= =?us-ascii?q?zvp9LvOfJXCLjtwQ=3D=3D?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0HzAAC5wh9Xj7HVVdFeHYJwgXu3cIQRg?= =?us-ascii?q?g2EAgKBQEwBAQEBAQECAg8BAQEBBwsLCSEvgi19Wz0BAQEDEhUZAQE3AQ9RNAE?= =?us-ascii?q?FARwGARIiiAgBpVeBMT4xik+FKAEEjEoBAQEBAQEBAwIBFwYKhA2CCohYhgiOT?= =?us-ascii?q?YlIgVWMRIkqhWVFjS0wgQ6CWg0RChaBU04Bh2+BPgEBAQ?= X-IPAS-Result: =?us-ascii?q?A0HzAAC5wh9Xj7HVVdFeHYJwgXu3cIQRgg2EAgKBQEwBAQE?= =?us-ascii?q?BAQECAg8BAQEBBwsLCSEvgi19Wz0BAQEDEhUZAQE3AQ9RNAEFARwGARIiiAgBp?= =?us-ascii?q?VeBMT4xik+FKAEEjEoBAQEBAQEBAwIBFwYKhA2CCohYhgiOTYlIgVWMRIkqhWV?= =?us-ascii?q?FjS0wgQ6CWg0RChaBU04Bh2+BPgEBAQ?= X-IronPort-AV: E=Sophos;i="5.24,537,1454976000"; d="scan'208";a="13051026" Received: from mail-ig0-f177.google.com ([209.85.213.177]) by emsm-gh1-uea10.nsa.gov with ESMTP/TLS/AES128-GCM-SHA256; 26 Apr 2016 19:37:17 +0000 Received: by mail-ig0-f177.google.com with SMTP id m9so22488119ige.1 for <selinux@tycho.nsa.gov>; Tue, 26 Apr 2016 12:37:17 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical-com.20150623.gappssmtp.com; s=20150623; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=xVETxp19myjlkr9oWfx2dXb9pOJQfW/T7A25FZmF28w=; b=Ibmdzzi0vCZxWRNsWTlYmiTfaY6ubAsX0D7k9/uJPjNl078Kef0TGKmsxoUYkdNX37 xohnPsrsmsEkVP1HUkXe0Ju9t5CE/p46rP5YofhT0kj5rmMtWjCUshVovzIW1NJi0/bZ ws5lcZo8wK0acYG22OgKIkBJjYTCBAJcUmIam72CGmH3GeLu7iWbXILW+lSkLBZmppoR 3EdkAUfc63r0olvlyffBstvwbuyijCEKu7Uie1Jad4AsvapRRYKeI+UU2/B30maGKoAQ A/3Shm8hqzaLZ6DdljQ/lo0iD/jZMWaACz2Gyl4JLf86SAbjcay+xLKUafcO4qiOne4p FOgg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=xVETxp19myjlkr9oWfx2dXb9pOJQfW/T7A25FZmF28w=; b=CXzMNWcbwi3CdVlWvhht0R4V9Ykiboz30Ey4jRGzl1Um/fXZboE7ctT+0jNU/1J3fV iqRFu47ulFOreCMDyqrUIoc/pfTtewDlQ1WbuQqLKbrIR3rkHVdEVF9l2jkwSg8Kna+N pDTR4u4+AzATSM9PnXk0/w4mheMTnJVeLuk9U5S9jXUwYeHK0skALM2tZYHuVoZbHcYP FAilrw0DZ6t0S9HI4ZBe0n8BUFdgYhv4YmNYftBfP9Btu7Ze1OfiZCu3ij1Ste6kGoO/ HZkoLN65EDpyX5DkKqU3BAYSCdT3NsZg4gt7nJnWA/dYTCrNvKIZFv3C3C0L0rb4pkuS GBGA== X-Gm-Message-State: AOPr4FVRcmcdXzTex2wQoqxrZXM9KkPyKe2UT/XtKeZELZyd/wMhw0qhtgEuQ5xsMChMBIYC X-Received: by 10.50.28.40 with SMTP id y8mr5826094igg.24.1461699437047; Tue, 26 Apr 2016 12:37:17 -0700 (PDT) Received: from localhost ([2605:a601:aab:f920:39a1:5bcf:aa:5b00]) by smtp.gmail.com with ESMTPSA id d5sm2345424igj.18.2016.04.26.12.37.16 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 26 Apr 2016 12:37:16 -0700 (PDT) From: Seth Forshee <seth.forshee@canonical.com> To: "Eric W. Biederman" <ebiederm@xmission.com>, Miklos Szeredi <miklos@szeredi.hu> Subject: [PATCH v4 20/21] fuse: Restrict allow_other to the superblock's namespace or a descendant Date: Tue, 26 Apr 2016 14:36:33 -0500 Message-Id: <1461699396-33000-21-git-send-email-seth.forshee@canonical.com> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1461699396-33000-1-git-send-email-seth.forshee@canonical.com> References: <1461699396-33000-1-git-send-email-seth.forshee@canonical.com> X-Mailman-Approved-At: Tue, 26 Apr 2016 16:11:02 -0400 X-BeenThere: selinux@tycho.nsa.gov X-Mailman-Version: 2.1.20 Precedence: list List-Id: "Security-Enhanced Linux \(SELinux\) mailing list" <selinux.tycho.nsa.gov> List-Post: <mailto:selinux@tycho.nsa.gov> List-Help: <mailto:selinux-request@tycho.nsa.gov?subject=help> Cc: linux-bcache@vger.kernel.org, Serge Hallyn <serge.hallyn@canonical.com>, Seth Forshee <seth.forshee@canonical.com>, dm-devel@redhat.com, Miklos Szeredi <mszeredi@redhat.com>, Richard Weinberger <richard.weinberger@gmail.com>, linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org, linux-raid@vger.kernel.org, fuse-devel@lists.sourceforge.net, Austin S Hemmelgarn <ahferroin7@gmail.com>, linux-mtd@lists.infradead.org, Alexander Viro <viro@zeniv.linux.org.uk>, selinux@tycho.nsa.gov, linux-fsdevel@vger.kernel.org, cgroups@vger.kernel.org, Pavel Tikhomirov <ptikhomirov@virtuozzo.com> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: selinux-bounces@tycho.nsa.gov Sender: "Selinux" <selinux-bounces@tycho.nsa.gov> X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED, RP_MATCHES_RCVD, T_DKIM_INVALID, UNPARSEABLE_RELAY autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP |
diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c index ecba75bf6640..1a6c5af49608 100644 --- a/fs/fuse/dir.c +++ b/fs/fuse/dir.c @@ -1015,7 +1015,7 @@ int fuse_allow_current_process(struct fuse_conn *fc) const struct cred *cred; if (fc->flags & FUSE_ALLOW_OTHER) - return 1; + return current_in_userns(fc->user_ns); cred = current_cred(); if (uid_eq(cred->euid, fc->user_id) && diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c index 68f594212759..fa2294e14b77 100644 --- a/kernel/user_namespace.c +++ b/kernel/user_namespace.c @@ -951,6 +951,7 @@ bool current_in_userns(const struct user_namespace *target_ns) } return false; } +EXPORT_SYMBOL(current_in_userns); static inline struct user_namespace *to_user_ns(struct ns_common *ns) {