From patchwork Mon Feb 13 16:18:34 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Vivek Goyal X-Patchwork-Id: 9570211 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 249C660442 for ; Mon, 13 Feb 2017 16:18:37 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 0D0C126E1A for ; Mon, 13 Feb 2017 16:18:37 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id F3C5626E76; Mon, 13 Feb 2017 16:18:36 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 9542E26E1A for ; Mon, 13 Feb 2017 16:18:36 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752049AbdBMQSf (ORCPT ); Mon, 13 Feb 2017 11:18:35 -0500 Received: from mx1.redhat.com ([209.132.183.28]:58456 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751472AbdBMQSf (ORCPT ); Mon, 13 Feb 2017 11:18:35 -0500 Received: from int-mx14.intmail.prod.int.phx2.redhat.com (int-mx14.intmail.prod.int.phx2.redhat.com [10.5.11.27]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 6851CC04B332; Mon, 13 Feb 2017 16:18:35 +0000 (UTC) Received: from horse.redhat.com (dhcp-25-229.bos.redhat.com [10.18.25.229]) by int-mx14.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id v1DGIZd0004333; Mon, 13 Feb 2017 11:18:35 -0500 Received: by horse.redhat.com (Postfix, from userid 10451) id 9B3EE204463; Mon, 13 Feb 2017 11:18:34 -0500 (EST) Date: Mon, 13 Feb 2017 11:18:34 -0500 From: Vivek Goyal To: linux-fsdevel@vger.kernel.org Cc: "Eric W. Biederman" , Al Viro , James Bottomley , Miklos Szeredi Subject: [PATCH] vfs: Use upper filesystem inode in bprm_fill_uid() Message-ID: <20170213161834.GA2065@redhat.com> MIME-Version: 1.0 Content-Disposition: inline User-Agent: Mutt/1.7.1 (2016-10-04) X-Scanned-By: MIMEDefang 2.68 on 10.5.11.27 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.31]); Mon, 13 Feb 2017 16:18:35 +0000 (UTC) Sender: linux-fsdevel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-fsdevel@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Right now bprm_fill_uid() uses inode fetched from file_inode(bprm->file). This in turn returns inode of lower filesystem (in a stacked filesystem setup). I was playing with modified patches of shiftfs posted by james bottomley and realized that through shiftfs setuid bit does not take effect. And reason being that we fetch uid/gid from inode of lower fs (and not from shiftfs inode). And that results in following checks failing. /* We ignore suid/sgid if there are no mappings for them in the ns */ if (!kuid_has_mapping(bprm->cred->user_ns, uid) || !kgid_has_mapping(bprm->cred->user_ns, gid)) return; uid/gid fetched from lower fs inode might not be mapped inside the user namespace of container. So we need to look at uid/gid fetched from upper filesystem (shiftfs in this particular case) and these should be mapped and setuid bit can take affect. Signed-off-by: Vivek Goyal --- fs/exec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) Index: rhvgoyal-linux/fs/exec.c =================================================================== --- rhvgoyal-linux.orig/fs/exec.c 2017-02-10 09:20:31.058642923 -0500 +++ rhvgoyal-linux/fs/exec.c 2017-02-13 10:51:52.155751128 -0500 @@ -1479,7 +1479,7 @@ static void bprm_fill_uid(struct linux_b if (task_no_new_privs(current)) return; - inode = file_inode(bprm->file); + inode = d_backing_inode(bprm->file->f_path.dentry); mode = READ_ONCE(inode->i_mode); if (!(mode & (S_ISUID|S_ISGID))) return;