From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-ig0-f178.google.com ([209.85.213.178]:38334 "EHLO mail-ig0-f178.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753165AbbLDPk1 (ORCPT ); Fri, 4 Dec 2015 10:40:27 -0500 Received: by igbxm8 with SMTP id xm8so39362262igb.1 for ; Fri, 04 Dec 2015 07:40:26 -0800 (PST) Date: Fri, 4 Dec 2015 09:38:55 -0600 From: Seth Forshee To: "Eric W. Biederman" , Miklos Szeredi Cc: Alexander Viro , Serge Hallyn , Richard Weinberger , Austin S Hemmelgarn , linux-bcache@vger.kernel.org, dm-devel@redhat.com, linux-raid@vger.kernel.org, linux-kernel@vger.kernel.org, linux-mtd@lists.infradead.org, linux-fsdevel@vger.kernel.org, fuse-devel@lists.sourceforge.net, linux-security-module@vger.kernel.org, selinux@tycho.nsa.gov Subject: Re: [PATCH 17/19] fuse: Support fuse filesystems outside of init_user_ns Message-ID: <20151204153855.GB147214@ubuntu-hedt> References: <1449070821-73820-1-git-send-email-seth.forshee@canonical.com> <1449070821-73820-18-git-send-email-seth.forshee@canonical.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1449070821-73820-18-git-send-email-seth.forshee@canonical.com> Sender: linux-fsdevel-owner@vger.kernel.org List-ID: On Wed, Dec 02, 2015 at 09:40:17AM -0600, Seth Forshee wrote: > @@ -155,11 +155,22 @@ static ino_t fuse_squash_ino(u64 ino64) > return ino; > } > > -void fuse_change_attributes_common(struct inode *inode, struct fuse_attr *attr, > - u64 attr_valid) > +int fuse_change_attributes_common(struct inode *inode, struct fuse_attr *attr, > + u64 attr_valid) > { > struct fuse_conn *fc = get_fuse_conn(inode); > struct fuse_inode *fi = get_fuse_inode(inode); > + kuid_t uid; > + kgid_t gid; > + > + uid = make_kuid(fc->user_ns, attr->uid); > + gid = make_kgid(fc->user_ns, attr->gid); > + if (!uid_valid(uid) || !gid_valid(gid)) { > + make_bad_inode(inode); > + return -EIO; > + } Eric - I had kind of forgotten about this part until just now, but previously with these patches we had discussed how to handle ids from the filesystem that aren't valid in s_user_ns. My intention is to set the kuids in the inode to invalid, and in these patches I've updated the vfs so that it should be safe to do that. But at some point I think you had suggested marking the inodes bad, and I must have added this as a result. I guess we need to decide which way to go. I favor using invalid ids so that a user privileged in s_user_ns can still access the inode, change ownership, etc., but I'm interested to hear your opinion. Thanks, Seth