From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-io0-f177.google.com ([209.85.223.177]:32779 "EHLO mail-io0-f177.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752247AbcADSE0 (ORCPT ); Mon, 4 Jan 2016 13:04:26 -0500 Received: by mail-io0-f177.google.com with SMTP id q21so161965730iod.0 for ; Mon, 04 Jan 2016 10:04:26 -0800 (PST) From: Seth Forshee To: "Eric W. Biederman" , Alexander Viro Cc: Serge Hallyn , Richard Weinberger , Austin S Hemmelgarn , Miklos Szeredi , linux-kernel@vger.kernel.org, linux-bcache@vger.kernel.org, dm-devel@redhat.com, linux-raid@vger.kernel.org, linux-mtd@lists.infradead.org, linux-fsdevel@vger.kernel.org, fuse-devel@lists.sourceforge.net, linux-security-module@vger.kernel.org, selinux@tycho.nsa.gov, Seth Forshee Subject: [PATCH RESEND v2 09/18] fs: Refuse uid/gid changes which don't map into s_user_ns Date: Mon, 4 Jan 2016 12:03:48 -0600 Message-Id: <1451930639-94331-10-git-send-email-seth.forshee@canonical.com> In-Reply-To: <1451930639-94331-1-git-send-email-seth.forshee@canonical.com> References: <1451930639-94331-1-git-send-email-seth.forshee@canonical.com> Sender: linux-fsdevel-owner@vger.kernel.org List-ID: Add checks to inode_change_ok to verify that uid and gid changes will map into the superblock's user namespace. If they do not fail with -EOVERFLOW. This cannot be overriden with ATTR_FORCE. Signed-off-by: Seth Forshee Acked-by: Serge Hallyn --- fs/attr.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/fs/attr.c b/fs/attr.c index 6530ced19697..55b46e3aa888 100644 --- a/fs/attr.c +++ b/fs/attr.c @@ -42,6 +42,17 @@ int inode_change_ok(const struct inode *inode, struct iattr *attr) return error; } + /* + * Verify that uid/gid changes are valid in the target namespace + * of the superblock. This cannot be overriden using ATTR_FORCE. + */ + if (ia_valid & ATTR_UID && + from_kuid(inode->i_sb->s_user_ns, attr->ia_uid) == (uid_t)-1) + return -EOVERFLOW; + if (ia_valid & ATTR_GID && + from_kgid(inode->i_sb->s_user_ns, attr->ia_gid) == (gid_t)-1) + return -EOVERFLOW; + /* If force is set do it anyway. */ if (ia_valid & ATTR_FORCE) return 0; -- 1.9.1