| Message ID | 20200218143411.2389182-12-christian.brauner@ubuntu.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | user_namespace: introduce fsid mappings | expand |
On Tue, Feb 18, 2020 at 03:33:57PM +0100, Christian Brauner wrote: > + if (is_userns_visible(inode->i_sb->s_iflags)) { > + if (kuid_has_mapping(ns, inode->i_uid) && ns_capable(ns, CAP_FOWNER)) > + return true; > + } else if (kfsuid_has_mapping(ns, inode->i_uid) && ns_capable(ns, CAP_FOWNER)) { This adds some crazy long unreadable lines..
On Tue, Feb 18, 2020 at 02:25:23PM -0800, Christoph Hellwig wrote: > On Tue, Feb 18, 2020 at 03:33:57PM +0100, Christian Brauner wrote: > > + if (is_userns_visible(inode->i_sb->s_iflags)) { > > + if (kuid_has_mapping(ns, inode->i_uid) && ns_capable(ns, CAP_FOWNER)) > > + return true; > > + } else if (kfsuid_has_mapping(ns, inode->i_uid) && ns_capable(ns, CAP_FOWNER)) { > > This adds some crazy long unreadable lines.. I'll ad a helper in the next version or wrap those lines depending on what makes more sense.
diff --git a/fs/inode.c b/fs/inode.c index 7d57068b6b7a..81d7a30b381d 100644 --- a/fs/inode.c +++ b/fs/inode.c @@ -21,6 +21,7 @@ #include <linux/ratelimit.h> #include <linux/list_lru.h> #include <linux/iversion.h> +#include <linux/fsuidgid.h> #include <trace/events/writeback.h> #include "internal.h" @@ -2087,8 +2088,12 @@ bool inode_owner_or_capable(const struct inode *inode) return true; ns = current_user_ns(); - if (kuid_has_mapping(ns, inode->i_uid) && ns_capable(ns, CAP_FOWNER)) + if (is_userns_visible(inode->i_sb->s_iflags)) { + if (kuid_has_mapping(ns, inode->i_uid) && ns_capable(ns, CAP_FOWNER)) + return true; + } else if (kfsuid_has_mapping(ns, inode->i_uid) && ns_capable(ns, CAP_FOWNER)) { return true; + } return false; } EXPORT_SYMBOL(inode_owner_or_capable);
Switch inode_owner_or_capable() to lookup fsids in the fsid mappings. If no fsid mappings are setup the behavior is unchanged, i.e. fsids are looked up in the id mappings. Filesystems that share a superblock in all user namespaces they are mounted in will retain their old semantics even with the introduction of fsid mappings. Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com> --- /* v2 */ unchanged /* v3 */ unchanged --- fs/inode.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)