Re: [PATCH v3 24/25] sys: handle fsid mappings in set*id() calls
From: Jann Horn <jannh@google.com>
Date: 2020-02-19 15:42:36
Also in:
linux-api, linux-fsdevel, lkml
On Tue, Feb 18, 2020 at 3:37 PM Christian Brauner [off-list ref] wrote:
Switch set*id() calls to lookup fsids in the fsid mappings. If no fsid mappings are setup the behavior is unchanged, i.e. fsids are looked up in the id mappings.
[...]
quoted hunk ↗ jump to hunk
@@ -353,7 +354,7 @@ long __sys_setregid(gid_t rgid, gid_t egid) const struct cred *old; struct cred *new; int retval; - kgid_t krgid, kegid; + kgid_t krgid, kegid, kfsgid; krgid = make_kgid(ns, rgid); kegid = make_kgid(ns, egid);@@ -385,12 +386,20 @@ long __sys_setregid(gid_t rgid, gid_t egid) new->egid = kegid; else goto error; + kfsgid = make_kfsgid(ns, egid); + } else { + kfsgid = kgid_to_kfsgid(new->user_ns, new->egid); + }
Here the "kfsgid" is the new filesystem GID as translated by the special fsgid mapping...
+ if (!gid_valid(kfsgid)) {
+ retval = -EINVAL;
+ goto error;
}
if (rgid != (gid_t) -1 ||
(egid != (gid_t) -1 && !gid_eq(kegid, old->gid)))
new->sgid = new->egid;
- new->fsgid = new->egid;
+ new->kfsgid = new->egid;... but the "kfsgid" of the creds struct is translated by the normal gid mapping...
+ new->fsgid = kfsgid;
... and the local "kfsgid" is stored into the "fsgid" member. This is pretty hard to follow. Can you come up with some naming scheme that is clearer and where one name is always used for the normally-translated fsgid and another name is always used for the specially-translated fsgid? E.g. something like "pfsgid" (with the "p" standing for "process", because it uses the same id mappings as used for process identities) for the IDs translated via the normal gid mapping?