Re: [PATCH v3 06/25] user_namespace: make map_write() support fsid mappings

On Tue, Feb 18, 2020 at 3:35 PM Christian Brauner
[off-list ref] wrote:

Based on discussions with Jann we decided in order to cleanly handle nested
user namespaces that fsid mappings can only be written before the corresponding
id mappings have been written. Writing id mappings before writing the
corresponding fsid mappings causes fsid mappings to mirror id mappings.

Consider creating a user namespace NS1 with the initial user namespace as
parent. Assume NS1 receives id mapping 0 100000 100000 and fsid mappings 0
300000 100000. Files that root in NS1 will create will map to kfsuid=300000 and
kfsgid=300000 and will hence be owned by uid=300000 and gid 300000 on-disk in
the initial user namespace.
Now assume user namespace NS2 is created in user namespace NS1. Assume that NS2
receives id mapping 0 10000 65536 and an fsid mapping of 0 10000 65536. Files
that root in NS2 will create will map to kfsuid=10000 and kfsgid=10000 in NS1.
hence, files created by NS2 will hence be appear to be be owned by uid=10000
and gid=10000 on-disk in NS1. Looking at the initial user namespace, files
created by NS2 will map to kfsuid=310000 and kfsgid=310000 and hence will be
owned by uid=310000 and gid=310000 on-disk.

[...]

 static bool new_idmap_permitted(const struct file *file,
                                struct user_namespace *ns, int cap_setid,
-                               struct uid_gid_map *new_map)
+                               struct uid_gid_map *new_map,
+                               enum idmap_type idmap_type)
 {
        const struct cred *cred = file->f_cred;
+
+       /* Don't allow writing fsuid maps when uid maps have been written. */
+       if (idmap_type == FSUID_MAP && idmap_exists(&ns->uid_map))
+               return false;
+
+       /* Don't allow writing fsgid maps when gid maps have been written. */
+       if (idmap_type == FSGID_MAP && idmap_exists(&ns->gid_map))
+               return false;

Why are these checks necessary? Shouldn't an fs*id map have already
been implicitly created?