From: Vivek Goyal <vgoyal@redhat.com>
To: miklos@szeredi.hu, sds@tycho.nsa.gov, pmoore@redhat.com,
casey@schaufler-ca.com, linux-kernel@vger.kernel.org,
linux-unionfs@vger.kernel.org,
linux-security-module@vger.kernel.org
Cc: dwalsh@redhat.com, dhowells@redhat.com, viro@ZenIV.linux.org.uk,
vgoyal@redhat.com, linux-fsdevel@vger.kernel.org
Subject: [PATCH 8/9] overlayfs: Dilute permission checks on lower only if not special file
Date: Wed, 13 Jul 2016 10:44:54 -0400 [thread overview]
Message-ID: <1468421095-22322-9-git-send-email-vgoyal@redhat.com> (raw)
In-Reply-To: <1468421095-22322-1-git-send-email-vgoyal@redhat.com>
Right now if file is on lower/, we remove MAY_WRITE/MAY_APPEND bits from
mask as lower/ will never be written and file will be copied up. But this
is not true for special files. These files are not copied up and are
opened in place. So don't dilute the checks for these types of files.
Reported-by: Dan Walsh <dwalsh@redhat.com>
Signed-off-by: Vivek Goyal <vgoyal@redhat.com>
---
fs/overlayfs/inode.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c
index 66f42f5..6d9d86e 100644
--- a/fs/overlayfs/inode.c
+++ b/fs/overlayfs/inode.c
@@ -140,7 +140,7 @@ int ovl_permission(struct inode *inode, int mask)
return err;
old_cred = ovl_override_creds(inode->i_sb);
- if (!is_upper)
+ if (!is_upper && !special_file(realinode->i_mode))
mask &= ~(MAY_WRITE | MAY_APPEND);
err = inode_permission(realinode, mask);
revert_creds(old_cred);
--
2.7.4
next prev parent reply other threads:[~2016-07-13 14:45 UTC|newest]
Thread overview: 37+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-07-13 14:44 [RFC PATCH 0/9][V3] Overlayfs SELinux Support Vivek Goyal
2016-07-13 14:44 ` [PATCH 1/9] security, overlayfs: provide copy up security hook for unioned files Vivek Goyal
2016-07-13 14:52 ` Stephen Smalley
2016-07-13 14:56 ` Vivek Goyal
2016-07-13 15:13 ` Vivek Goyal
2016-07-14 14:32 ` Stephen Smalley
2016-07-13 14:44 ` [PATCH 2/9] selinux: Implementation for inode_copy_up() hook Vivek Goyal
2016-07-13 14:53 ` Stephen Smalley
2016-07-13 14:44 ` [PATCH 3/9] security,overlayfs: Provide security hook for copy up of xattrs for overlay file Vivek Goyal
2016-07-14 14:20 ` Stephen Smalley
2016-07-13 14:44 ` [PATCH 4/9] selinux: Implementation for inode_copy_up_xattr() hook Vivek Goyal
2016-07-13 14:54 ` Stephen Smalley
2016-07-13 14:44 ` [PATCH 5/9] selinux: Pass security pointer to determine_inode_label() Vivek Goyal
2016-07-13 14:56 ` Stephen Smalley
2016-07-13 14:44 ` [PATCH 6/9] security, overlayfs: Provide hook to correctly label newly created files Vivek Goyal
2016-07-13 14:57 ` Stephen Smalley
2016-07-13 14:59 ` Stephen Smalley
2016-07-14 14:29 ` Stephen Smalley
2016-07-13 14:44 ` [PATCH 7/9] selinux: Implement dentry_create_files_as() hook Vivek Goyal
2016-07-13 14:59 ` Stephen Smalley
2016-07-13 14:44 ` Vivek Goyal [this message]
2016-07-14 6:51 ` [PATCH 8/9] overlayfs: Dilute permission checks on lower only if not special file Miklos Szeredi
2016-07-13 14:44 ` [PATCH 9/9] overlayfs: Append MAY_READ when diluting write checks Vivek Goyal
2016-07-14 6:49 ` Miklos Szeredi
2016-07-21 21:16 ` [RFC PATCH 0/9][V3] Overlayfs SELinux Support Paul Moore
2016-07-21 23:09 ` James Morris
2016-07-22 7:05 ` Miklos Szeredi
2016-07-22 15:33 ` Paul Moore
2016-08-08 12:46 ` Miklos Szeredi
2016-08-08 13:18 ` Paul Moore
2016-08-09 1:19 ` Paul Moore
2016-08-10 9:11 ` Miklos Szeredi
2016-08-10 12:32 ` Paul Moore
2016-08-10 12:52 ` Daniel J Walsh
2016-08-11 12:36 ` Paul Moore
2016-08-11 12:39 ` Daniel J Walsh
2016-08-11 14:06 ` Daniel J Walsh
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1468421095-22322-9-git-send-email-vgoyal@redhat.com \
--to=vgoyal@redhat.com \
--cc=casey@schaufler-ca.com \
--cc=dhowells@redhat.com \
--cc=dwalsh@redhat.com \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=linux-unionfs@vger.kernel.org \
--cc=miklos@szeredi.hu \
--cc=pmoore@redhat.com \
--cc=sds@tycho.nsa.gov \
--cc=viro@ZenIV.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).