From mboxrd@z Thu Jan 1 00:00:00 1970 From: Serge Hallyn Subject: Re: [PATCH 3/4] fs: allow mknod in user namespaces Date: Fri, 15 Mar 2013 10:14:15 -0500 Message-ID: <20130315151415.GA24305@sergelap> References: <1363338823-25292-1-git-send-email-glommer@parallels.com> <1363338823-25292-4-git-send-email-glommer@parallels.com> <20130315143741.GE3782@sergelap> <51433511.1020808@parallels.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: cgroups-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, Andrew Morton , mtk.manpages-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org, "Eric W. Biederman" , Serge Hallyn , linux-fsdevel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, containers-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org, Aristeu Rozanski To: Glauber Costa Return-path: Content-Disposition: inline In-Reply-To: <51433511.1020808-bzQdu9zFT3WakBO8gow8eQ@public.gmane.org> Sender: cgroups-owner-u79uwXL29TY76Z2rM5mHXA@public.gmane.org List-Id: linux-fsdevel.vger.kernel.org Quoting Glauber Costa (glommer-bzQdu9zFT3WakBO8gow8eQ@public.gmane.org): > On 03/15/2013 06:37 PM, Serge Hallyn wrote: > > Quoting Glauber Costa (glommer-bzQdu9zFT3WakBO8gow8eQ@public.gmane.org): > >> Since we have strict control on who access the devices, it should be > >> no problem to allow the device to appear. > >> > >> Signed-off-by: Glauber Costa > >> Cc: Aristeu Rozanski > >> Cc: Eric Biederman > >> Cc: Serge Hallyn > >> --- > >> fs/namei.c | 2 +- > >> 1 file changed, 1 insertion(+), 1 deletion(-) > >> > >> diff --git a/fs/namei.c b/fs/namei.c > >> index 8a34d79..d0b4549 100644 > >> --- a/fs/namei.c > >> +++ b/fs/namei.c > >> @@ -3126,7 +3126,7 @@ int vfs_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev) > >> if (error) > >> return error; > >> > >> - if ((S_ISCHR(mode) || S_ISBLK(mode)) && !capable(CAP_MKNOD)) > >> + if ((S_ISCHR(mode) || S_ISBLK(mode)) && !nsown_capable(CAP_MKNOD)) > > > > I realize you're arguing that devicens is enough, but how about > > doing inode_capable(dir, CAP_MKNOD) instead? > > > I see no reason not to do it. Cool, with that Acked-by: Serge E. Hallyn thanks. -serge