xfs
[Top] [All Lists]

Re: [PATCH v7 3/7] xfs: ioctl check for capabilities in the current user

To: Dwight Engen <dwight.engen@xxxxxxxxxx>
Subject: Re: [PATCH v7 3/7] xfs: ioctl check for capabilities in the current user namespace
From: Gao feng <gaofeng@xxxxxxxxxxxxxx>
Date: Wed, 31 Jul 2013 12:16:02 +0800
Cc: xfs@xxxxxxxxxxx
Delivered-to: xfs@xxxxxxxxxxx
In-reply-to: <20130729230650.5db8228a@xxxxxxxxxx>
References: <20130729230650.5db8228a@xxxxxxxxxx>
User-agent: Mozilla/5.0 (X11; Linux x86_64; rv:17.0) Gecko/20130625 Thunderbird/17.0.7
On 07/30/2013 11:06 AM, Dwight Engen wrote:
> Use inode_capable() to check if SUID|SGID bits should be cleared to match
> similar check in inode_change_ok().
> 
> The check for CAP_LINUX_IMMUTABLE was not modified since all other file
> systems also check against init_user_ns rather than current_user_ns.
> 
> Reviewed-by: Dave Chinner <dchinner@xxxxxxxxxx>
> Signed-off-by: Dwight Engen <dwight.engen@xxxxxxxxxx>
> ---
>  fs/xfs/xfs_ioctl.c  | 4 ++--
>  kernel/capability.c | 1 +
>  2 files changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/fs/xfs/xfs_ioctl.c b/fs/xfs/xfs_ioctl.c
> index 6e2bca5..8edc780 100644
> --- a/fs/xfs/xfs_ioctl.c
> +++ b/fs/xfs/xfs_ioctl.c
> @@ -981,7 +981,7 @@ xfs_ioctl_setattr(
>        * to the file owner ID, except in cases where the
>        * CAP_FSETID capability is applicable.
>        */
> -     if (current_fsuid() != ip->i_d.di_uid && !capable(CAP_FOWNER)) {
> +     if (!inode_owner_or_capable(VFS_I(ip))) {

Though the user in container can get his quota limit info which is configured 
on host,
but he has no rights to modify it, so this patch looks good to me.

Thanks

Reviewed-by: Gao feng <gaofeng@xxxxxxxxxxxxxx>


>               code = XFS_ERROR(EPERM);
>               goto error_return;
>       }
> @@ -1103,7 +1103,7 @@ xfs_ioctl_setattr(
>                * cleared upon successful return from chown()
>                */
>               if ((ip->i_d.di_mode & (S_ISUID|S_ISGID)) &&
> -                 !capable(CAP_FSETID))
> +                 !inode_capable(VFS_I(ip), CAP_FSETID))
>                       ip->i_d.di_mode &= ~(S_ISUID|S_ISGID);
>  
>               /*
> diff --git a/kernel/capability.c b/kernel/capability.c
> index f6c2ce5..a4b6744 100644
> --- a/kernel/capability.c
> +++ b/kernel/capability.c
> @@ -464,3 +464,4 @@ bool inode_capable(const struct inode *inode, int cap)
>  
>       return ns_capable(ns, cap) && kuid_has_mapping(ns, inode->i_uid);
>  }
> +EXPORT_SYMBOL(inode_capable);
> 

<Prev in Thread] Current Thread [Next in Thread>