From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 55C43C55179 for ; Thu, 29 Oct 2020 12:46:17 +0000 (UTC) Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [63.128.21.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id A7AE720825 for ; Thu, 29 Oct 2020 12:46:16 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org A7AE720825 Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=ubuntu.com Authentication-Results: mail.kernel.org; spf=tempfail smtp.mailfrom=linux-audit-bounces@redhat.com Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-586-2PMxjE5kO7qJVQLqyQDdDg-1; Thu, 29 Oct 2020 08:46:12 -0400 X-MC-Unique: 2PMxjE5kO7qJVQLqyQDdDg-1 Received: from smtp.corp.redhat.com (int-mx07.intmail.prod.int.phx2.redhat.com [10.5.11.22]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 48924809DEE; Thu, 29 Oct 2020 12:46:07 +0000 (UTC) Received: from colo-mx.corp.redhat.com (colo-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.20]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 3042D10027AA; Thu, 29 Oct 2020 12:46:07 +0000 (UTC) Received: from lists01.pubmisc.prod.ext.phx2.redhat.com (lists01.pubmisc.prod.ext.phx2.redhat.com [10.5.19.33]) by colo-mx.corp.redhat.com (Postfix) with ESMTP id 100B6181A872; Thu, 29 Oct 2020 12:46:07 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx03.intmail.prod.int.rdu2.redhat.com [10.11.54.3]) by lists01.pubmisc.prod.ext.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id 09T0saAa023607 for ; Wed, 28 Oct 2020 20:54:36 -0400 Received: by smtp.corp.redhat.com (Postfix) id A871F114F0AE; Thu, 29 Oct 2020 00:54:36 +0000 (UTC) Received: from mimecast-mx02.redhat.com (mimecast04.extmail.prod.ext.rdu2.redhat.com [10.11.55.20]) by smtp.corp.redhat.com (Postfix) with ESMTPS id A4AFB114F0AD for ; Thu, 29 Oct 2020 00:54:34 +0000 (UTC) Received: from us-smtp-1.mimecast.com (us-smtp-1.mimecast.com [207.211.31.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 7FD01101A540 for ; Thu, 29 Oct 2020 00:54:34 +0000 (UTC) Received: from youngberry.canonical.com (youngberry.canonical.com [91.189.89.112]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-67-6wdzwjdWP32K8GdOyLQ0jw-1; Wed, 28 Oct 2020 20:54:32 -0400 X-MC-Unique: 6wdzwjdWP32K8GdOyLQ0jw-1 Received: from ip5f5af0a0.dynamic.kabel-deutschland.de ([95.90.240.160] helo=wittgenstein.fritz.box) by youngberry.canonical.com with esmtpsa (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1kXvuU-0008Ep-1v; Thu, 29 Oct 2020 00:35:22 +0000 From: Christian Brauner To: Alexander Viro , Christoph Hellwig , linux-fsdevel@vger.kernel.org Subject: [PATCH 06/34] fs: add id translation helpers Date: Thu, 29 Oct 2020 01:32:24 +0100 Message-Id: <20201029003252.2128653-7-christian.brauner@ubuntu.com> In-Reply-To: <20201029003252.2128653-1-christian.brauner@ubuntu.com> References: <20201029003252.2128653-1-christian.brauner@ubuntu.com> MIME-Version: 1.0 X-Mimecast-Impersonation-Protect: Policy=CLT - Impersonation Protection Definition; Similar Internal Domain=false; Similar Monitored External Domain=false; Custom External Domain=false; Mimecast External Domain=false; Newly Observed Domain=false; Internal User Name=false; Custom Display Name List=false; Reply-to Address Mismatch=false; Targeted Threat Dictionary=false; Mimecast Threat Dictionary=false; Custom Threat Dictionary=false X-Scanned-By: MIMEDefang 2.78 on 10.11.54.3 X-loop: linux-audit@redhat.com X-Mailman-Approved-At: Thu, 29 Oct 2020 08:45:20 -0400 Cc: Phil Estes , Lennart Poettering , Amir Goldstein , Mimi Zohar , James Bottomley , Andreas Dilger , containers@lists.linux-foundation.org, Christian Brauner , Tycho Andersen , Miklos Szeredi , James Morris , smbarber@chromium.org, linux-ext4@vger.kernel.org, Mrunal Patel , Serge Hallyn , Arnd Bergmann , Jann Horn , selinux@vger.kernel.org, Josh Triplett , Seth Forshee , Aleksa Sarai , Andy Lutomirski , OGAWA Hirofumi , Geoffrey Thomas , David Howells , John Johansen , Theodore Tso , Dmitry Kasatkin , Jonathan Corbet , linux-unionfs@vger.kernel.org, linux-security-module@vger.kernel.org, linux-audit@redhat.com, "Eric W. Biederman" , linux-api@vger.kernel.org, Alban Crequy , linux-integrity@vger.kernel.org, =?UTF-8?q?St=C3=A9phane=20Graber?= , Todd Kjos X-BeenThere: linux-audit@redhat.com X-Mailman-Version: 2.1.12 Precedence: junk List-Id: Linux Audit Discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com X-Scanned-By: MIMEDefang 2.84 on 10.5.11.22 Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CUSA124A263 smtp.mailfrom=linux-audit-bounces@redhat.com X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Add simple helpers to make it easy to map kuids into and from idmapped mounts. We provide simple wrappers that filesystems can use to e.g. initialize inodes similar to i_{uid,gid}_read() and i_{uid,gid}_write(). Accessing an inode through an idmapped mount will require the inode to be mapped according to the mount's user namespace. If the fsids are used to compare against inodes or to initialize inodes they are required to be shifted from the mount's user namespace. Passing the initial user namespace to these helpers makes them a nop and so any non-idmapped paths will not be impacted. Signed-off-by: Christian Brauner --- include/linux/fs.h | 75 ++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 75 insertions(+) diff --git a/include/linux/fs.h b/include/linux/fs.h index 8314cd351673..8a891b80d0b4 100644 --- a/include/linux/fs.h +++ b/include/linux/fs.h @@ -39,6 +39,7 @@ #include #include #include +#include #include #include @@ -1574,6 +1575,80 @@ static inline void i_gid_write(struct inode *inode, gid_t gid) inode->i_gid = make_kgid(inode->i_sb->s_user_ns, gid); } +static inline kuid_t kuid_into_mnt(struct user_namespace *to, kuid_t kuid) +{ +#ifdef CONFIG_IDMAP_MOUNTS + return make_kuid(to, __kuid_val(kuid)); +#else + return kuid; +#endif +} + +static inline kgid_t kgid_into_mnt(struct user_namespace *to, kgid_t kgid) +{ +#ifdef CONFIG_IDMAP_MOUNTS + return make_kgid(to, __kgid_val(kgid)); +#else + return kgid; +#endif +} + +static inline kuid_t i_uid_into_mnt(struct user_namespace *to, + const struct inode *inode) +{ +#ifdef CONFIG_IDMAP_MOUNTS + return kuid_into_mnt(to, inode->i_uid); +#else + return inode->i_uid; +#endif +} + +static inline kgid_t i_gid_into_mnt(struct user_namespace *to, + const struct inode *inode) +{ +#ifdef CONFIG_IDMAP_MOUNTS + return kgid_into_mnt(to, inode->i_gid); +#else + return inode->i_gid; +#endif +} + +static inline kuid_t kuid_from_mnt(struct user_namespace *to, kuid_t kuid) +{ +#ifdef CONFIG_IDMAP_MOUNTS + return KUIDT_INIT(from_kuid(to, kuid)); +#else + return kuid; +#endif +} + +static inline kgid_t kgid_from_mnt(struct user_namespace *to, kgid_t kgid) +{ +#ifdef CONFIG_IDMAP_MOUNTS + return KGIDT_INIT(from_kgid(to, kgid)); +#else + return kgid; +#endif +} + +static inline kuid_t fsuid_into_mnt(struct user_namespace *to) +{ +#ifdef CONFIG_IDMAP_MOUNTS + return kuid_from_mnt(to, current_fsuid()); +#else + return current_fsuid(); +#endif +} + +static inline kgid_t fsgid_into_mnt(struct user_namespace *to) +{ +#ifdef CONFIG_IDMAP_MOUNTS + return kgid_from_mnt(to, current_fsgid()); +#else + return current_fsgid(); +#endif +} + extern struct timespec64 current_time(struct inode *inode); /* -- 2.29.0 -- Linux-audit mailing list Linux-audit@redhat.com https://www.redhat.com/mailman/listinfo/linux-audit