lkml.org 
[lkml]   [2021]   [Mar]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.19 065/120] Revert 95ebabde382c ("capabilities: Dont allow writing ambiguous v3 file capabilities")
    Date
    From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    From: Eric W. Biederman <ebiederm@xmission.com>

    commit 3b0c2d3eaa83da259d7726192cf55a137769012f upstream.

    It turns out that there are in fact userspace implementations that
    care and this recent change caused a regression.

    https://github.com/containers/buildah/issues/3071

    As the motivation for the original change was future development,
    and the impact is existing real world code just revert this change
    and allow the ambiguity in v3 file caps.

    Cc: stable@vger.kernel.org
    Fixes: 95ebabde382c ("capabilities: Don't allow writing ambiguous v3 file capabilities")
    Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    security/commoncap.c | 12 +-----------
    1 file changed, 1 insertion(+), 11 deletions(-)

    --- a/security/commoncap.c
    +++ b/security/commoncap.c
    @@ -506,8 +506,7 @@ int cap_convert_nscap(struct dentry *den
    __u32 magic, nsmagic;
    struct inode *inode = d_backing_inode(dentry);
    struct user_namespace *task_ns = current_user_ns(),
    - *fs_ns = inode->i_sb->s_user_ns,
    - *ancestor;
    + *fs_ns = inode->i_sb->s_user_ns;
    kuid_t rootid;
    size_t newsize;

    @@ -530,15 +529,6 @@ int cap_convert_nscap(struct dentry *den
    if (nsrootid == -1)
    return -EINVAL;

    - /*
    - * Do not allow allow adding a v3 filesystem capability xattr
    - * if the rootid field is ambiguous.
    - */
    - for (ancestor = task_ns->parent; ancestor; ancestor = ancestor->parent) {
    - if (from_kuid(ancestor, rootid) == 0)
    - return -EINVAL;
    - }
    -
    newsize = sizeof(struct vfs_ns_cap_data);
    nscap = kmalloc(newsize, GFP_ATOMIC);
    if (!nscap)

    \
     
     \ /
      Last update: 2021-03-15 15:41    [W:3.538 / U:0.220 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site