lkml.org 
[lkml]   [2021]   [Jan]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    Subject[PATCH 0/2] capability conversion fixes
    Date
    It turns out overlayfs is actually okay wrt. mutliple conversions, because
    it uses the right context for lower operations. I.e. before calling
    vfs_{set,get}xattr() on underlying fs, it overrides creds with that of the
    mounter, so the current user ns will now match that of
    overlay_sb->s_user_ns, meaning that the caps will be converted to just the
    right format for the next layer

    OTOH ecryptfs, which is the only other one affected by commit 7c03e2cda4a5
    ("vfs: move cap_convert_nscap() call into vfs_setxattr()") needs to be
    fixed up, since it doesn't do the cap override thing that overlayfs does.

    I don't have an ecryptfs setup, so untested, but it's a fairly trivial
    change.

    My other observation was that cap_inode_getsecurity() messes up conversion
    of caps in more than one case. This is independent of the overlayfs user
    ns enablement but affects it as well.

    Maybe we can revisit the infrastructure improvements we discussed, but I
    think these fixes are more appropriate for the current cycle.

    Thanks,
    Miklos

    Miklos Szeredi (2):
    ecryptfs: fix uid translation for setxattr on security.capability
    security.capability: fix conversions on getxattr

    fs/ecryptfs/inode.c | 10 +++++--
    security/commoncap.c | 67 ++++++++++++++++++++++++++++----------------
    2 files changed, 50 insertions(+), 27 deletions(-)

    --
    2.26.2

    \
     
     \ /
      Last update: 2021-01-19 17:29    [W:4.181 / U:0.088 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site