[PATCH 6/6] ioctl eofblocks: require non-privileged users to specify uid/gid match

From: Dwight Engen <dwight.engen@oracle.com>
To: Dave Chinner <david@fromorbit.com>
Cc: Brian Foster <bfoster@redhat.com>,
	Serge Hallyn <serge.hallyn@ubuntu.com>,
	"Eric W. Biederman" <ebiederm@gmail.com>,
	xfs@oss.sgi.com
Subject: [PATCH 6/6] ioctl eofblocks: require non-privileged users to specify uid/gid match
Date: Fri, 28 Jun 2013 11:11:38 -0400	[thread overview]
Message-ID: <20130628111138.68d0b486@oracle.com> (raw)
In-Reply-To: <20130626020924.GD29376@dastard>

Signed-off-by: Dwight Engen <dwight.engen@oracle.com>
---
 fs/xfs/xfs_ioctl.c | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/fs/xfs/xfs_ioctl.c b/fs/xfs/xfs_ioctl.c
index 487dca5..123314e 100644
--- a/fs/xfs/xfs_ioctl.c
+++ b/fs/xfs/xfs_ioctl.c
@@ -1655,6 +1655,23 @@ xfs_file_ioctl(
 		if (error)
 			return -XFS_ERROR(error);
 
+		/* non-privileged users should not be able to trim blocks on
+		 * objects they cannot write to, so require them to specify
+		 * either their own uid, or a group they are a member of
+		 */
+		if (!capable(CAP_SYS_ADMIN)) {
+			if (!(eofb.eof_flags & (XFS_EOF_FLAGS_UID | XFS_EOF_FLAGS_GID)))
+				return -XFS_ERROR(EPERM);
+
+			if ((eofb.eof_flags & XFS_EOF_FLAGS_UID) &&
+			    !uid_eq(current_fsuid(), keofb.eof_uid))
+				return -XFS_ERROR(EPERM);
+
+			if ((eofb.eof_flags & XFS_EOF_FLAGS_GID) &&
+			    !in_group_p(keofb.eof_gid))
+				return -XFS_ERROR(EPERM);
+		}
+
 		error = xfs_icache_free_eofblocks(mp, &keofb);
 		return -error;
 	}
-- 
1.8.1.4

_______________________________________________
xfs mailing list
xfs@oss.sgi.com
http://oss.sgi.com/mailman/listinfo/xfs
