Messages in this thread Patch in this message | | | From | Christian Brauner <> | Subject | [PATCH v3 12/25] capability: privileged_wrt_inode_uidgid(): handle fsid mappings | Date | Tue, 18 Feb 2020 15:33:58 +0100 |
| |
Switch privileged_wrt_inode_uidgid() to lookup fsids in the fsid mappings. If no fsid mappings are setup the behavior is unchanged, i.e. fsids are looked up in the id mappings.
Filesystems that share a superblock in all user namespaces they are mounted in will retain their old semantics even with the introduction of fsid mappings.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com> --- /* v2 */ unchanged
/* v3 */ unchanged --- kernel/capability.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/kernel/capability.c b/kernel/capability.c index 1444f3954d75..2b0c1dc992e2 100644 --- a/kernel/capability.c +++ b/kernel/capability.c @@ -19,6 +19,8 @@ #include <linux/pid_namespace.h> #include <linux/user_namespace.h> #include <linux/uaccess.h> +#include <linux/fsuidgid.h> +#include <linux/fs.h> /* * Leveraged for setting/resetting capabilities @@ -486,8 +488,12 @@ EXPORT_SYMBOL(file_ns_capable); */ bool privileged_wrt_inode_uidgid(struct user_namespace *ns, const struct inode *inode) { - return kuid_has_mapping(ns, inode->i_uid) && - kgid_has_mapping(ns, inode->i_gid); + if (is_userns_visible(inode->i_sb->s_iflags)) + return kuid_has_mapping(ns, inode->i_uid) && + kgid_has_mapping(ns, inode->i_gid); + + return kfsuid_has_mapping(ns, inode->i_uid) && + kfsgid_has_mapping(ns, inode->i_gid); } /** -- 2.25.0
| |