[PATCH v5 27/42] notify: handle idmapped mounts
From: Christian Brauner <hidden>
Date: 2021-01-12 22:18:00
Also in:
linux-ext4, linux-fsdevel, linux-integrity, linux-security-module, linux-xfs, selinux
Subsystem:
fanotify, filesystems (vfs and infrastructure), fsnotify: filesystem notification infrastructure, inotify, the rest · Maintainers:
Jan Kara, Alexander Viro, Christian Brauner, Linus Torvalds
Enable notify implementations to handle idmapped mounts by passing down the mount's user namespace. If the initial user namespace is passed nothing changes so non-idmapped mounts will see identical behavior as before. Cc: Christoph Hellwig <hch@lst.de> Cc: David Howells <dhowells@redhat.com> Cc: Al Viro <viro@zeniv.linux.org.uk> Cc: linux-fsdevel@vger.kernel.org Signed-off-by: Christian Brauner <redacted> --- /* v2 */ patch introduced /* v3 */ unchanged /* v4 */ unchanged /* v5 */ base-commit: 7c53f6b671f4aba70ff15e1b05148b10d58c2837 --- fs/notify/fanotify/fanotify_user.c | 2 +- fs/notify/inotify/inotify_user.c | 3 ++- 2 files changed, 3 insertions(+), 2 deletions(-)
diff --git a/fs/notify/fanotify/fanotify_user.c b/fs/notify/fanotify/fanotify_user.c
index 4ca13fb33c7c..c60b8cc1f94d 100644
--- a/fs/notify/fanotify/fanotify_user.c
+++ b/fs/notify/fanotify/fanotify_user.c@@ -702,7 +702,7 @@ static int fanotify_find_path(int dfd, const char __user *filename, } /* you can only watch an inode if you have read permissions on it */ - ret = inode_permission(&init_user_ns, path->dentry->d_inode, MAY_READ); + ret = inode_permission(mnt_user_ns(path->mnt), path->dentry->d_inode, MAY_READ); if (ret) { path_put(path); goto out;
diff --git a/fs/notify/inotify/inotify_user.c b/fs/notify/inotify/inotify_user.c
index 18e7024207a9..cecff22549d7 100644
--- a/fs/notify/inotify/inotify_user.c
+++ b/fs/notify/inotify/inotify_user.c@@ -31,6 +31,7 @@ #include <linux/wait.h> #include <linux/memcontrol.h> #include <linux/security.h> +#include <linux/mount.h> #include "inotify.h" #include "../fdinfo.h"
@@ -352,7 +353,7 @@ static int inotify_find_inode(const char __user *dirname, struct path *path, if (error) return error; /* you can only watch an inode if you have read permissions on it */ - error = inode_permission(&init_user_ns, path->dentry->d_inode, MAY_READ); + error = inode_permission(mnt_user_ns(path->mnt), path->dentry->d_inode, MAY_READ); if (error) { path_put(path); return error;
--
2.30.0