[PATCH 09/24] capability: privileged_wrt_inode_uidgid(): handle fsid mappings
From: Christian Brauner <hidden>
Date: 2020-02-11 17:01:11
Also in:
linux-api, linux-fsdevel, lkml
Subsystem:
capabilities, the rest · Maintainers:
Serge Hallyn, Linus Torvalds
Switch privileged_wrt_inode_uidgid() to lookup fsids in the fsid mappings. If no fsid mappings are setup the behavior is unchanged, i.e. fsids are looked up in the id mappings. Filesystems that share a superblock in all user namespaces they are mounted in will retain their old semantics even with the introduction of fsidmappings. Signed-off-by: Christian Brauner <redacted> --- kernel/capability.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-)
diff --git a/kernel/capability.c b/kernel/capability.c
index 1444f3954d75..de7edd5c9900 100644
--- a/kernel/capability.c
+++ b/kernel/capability.c@@ -19,6 +19,8 @@ #include <linux/pid_namespace.h> #include <linux/user_namespace.h> #include <linux/uaccess.h> +#include <linux/fsuidgid.h> +#include <linux/fs.h> /* * Leveraged for setting/resetting capabilities
@@ -484,10 +486,15 @@ EXPORT_SYMBOL(file_ns_capable); * * Return true if the inode uid and gid are within the namespace. */ -bool privileged_wrt_inode_uidgid(struct user_namespace *ns, const struct inode *inode) +bool privileged_wrt_inode_uidgid(struct user_namespace *ns, + const struct inode *inode) { - return kuid_has_mapping(ns, inode->i_uid) && - kgid_has_mapping(ns, inode->i_gid); + if (is_userns_visible(inode->i_sb->s_iflags)) + return kuid_has_mapping(ns, inode->i_uid) && + kgid_has_mapping(ns, inode->i_gid); + + return kfsuid_has_mapping(ns, inode->i_uid) && + kfsgid_has_mapping(ns, inode->i_gid); } /**
--
2.25.0