korg/linux
0
0
Fork 0
mirror of https://mirrors.bfsu.edu.cn/git/linux.git synced 2024-11-29 07:04:10 +08:00
Code Issues Packages Projects Releases Wiki Activity

ovl: handle idmappings in ovl_permission()

Browse Source 
Use the previously introduced ovl_i_path_real() helper to retrieve the
relevant upper or lower path and take the mount's idmapping into account
for the lower layer permission check. This is needed to support idmapped
base layers with overlay.

Cc: <linux-unionfs@vger.kernel.org>
Tested-by: Giuseppe Scrivano <gscrivan@redhat.com>
Reviewed-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Christian Brauner (Microsoft) <brauner@kernel.org>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
This commit is contained in:
Christian Brauner 2022-04-04 12:51:55 +02:00 committed by Miklos Szeredi
parent 2878dffc7d
commit 4b7791b2e9
1 changed files with 6 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
fs/overlayfs/inode.c
View File

@ -280,12 +280,14 @@ int ovl_permission(struct user_namespace *mnt_userns,
struct inode *inode, int mask) struct inode *inode, int mask)
{ {
struct inode *upperinode = ovl_inode_upper(inode); struct inode *upperinode = ovl_inode_upper(inode);
struct inode *realinode = upperinode ?: ovl_inode_lower(inode); struct inode *realinode;
struct path realpath;
const struct cred *old_cred; const struct cred *old_cred;
int err; int err;
/* Careful in RCU walk mode */ /* Careful in RCU walk mode */
if (!realinode) { ovl_i_path_real(inode, &realpath);
if (!realpath.dentry) {
WARN_ON(!(mask & MAY_NOT_BLOCK)); WARN_ON(!(mask & MAY_NOT_BLOCK));
return -ECHILD; return -ECHILD;
} }
@ -298,6 +300,7 @@ int ovl_permission(struct user_namespace *mnt_userns,
if (err) if (err)
return err; return err;
realinode = d_inode(realpath.dentry);
old_cred = ovl_override_creds(inode->i_sb); old_cred = ovl_override_creds(inode->i_sb);
if (!upperinode && if (!upperinode &&
!special_file(realinode->i_mode) && mask & MAY_WRITE) { !special_file(realinode->i_mode) && mask & MAY_WRITE) {
@ -305,7 +308,7 @@ int ovl_permission(struct user_namespace *mnt_userns,
/* Make sure mounter can read file for copy up later */ /* Make sure mounter can read file for copy up later */
mask |= MAY_READ; mask |= MAY_READ;
} }
err = inode_permission(&init_user_ns, realinode, mask); err = inode_permission(mnt_user_ns(realpath.mnt), realinode, mask);
revert_creds(old_cred); revert_creds(old_cred);
return err; return err;