From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-oi0-f48.google.com ([209.85.218.48]:35571 "EHLO mail-oi0-f48.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753348AbcEPONA (ORCPT ); Mon, 16 May 2016 10:13:00 -0400 Received: by mail-oi0-f48.google.com with SMTP id x19so269173361oix.2 for ; Mon, 16 May 2016 07:13:00 -0700 (PDT) Date: Mon, 16 May 2016 09:12:57 -0500 From: Seth Forshee To: "Eric W. Biederman" Cc: James Bottomley , Djalal Harouni , Alexander Viro , Chris Mason , tytso@mit.edu, Serge Hallyn , Josh Triplett , Andy Lutomirski , linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org, Dongsu Park , David Herrmann , Miklos Szeredi , Alban Crequy , Dave Chinner Subject: Re: [RFC v2 PATCH 0/8] VFS:userns: support portable root filesystems Message-ID: <20160516141257.GA58936@ubuntu-hedt> References: <20160505214957.GA3071@dztty> <1462486085.2289.23.camel@HansenPartnership.com> <1462923416.14896.10.camel@HansenPartnership.com> <20160511164247.GA9908@dztty.fritz.box> <1462991618.2356.55.camel@HansenPartnership.com> <20160512195552.GB2859@dztty> <1463091852.2380.72.camel@HansenPartnership.com> <20160514095303.GA3476@dztty> <1463233614.2355.20.camel@HansenPartnership.com> <87twi0giws.fsf@x220.int.ebiederm.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <87twi0giws.fsf@x220.int.ebiederm.org> Sender: linux-fsdevel-owner@vger.kernel.org List-ID: On Sat, May 14, 2016 at 09:21:55PM -0500, Eric W. Biederman wrote: > I have slowly been working with Seth Forshee on these issues as > the last thing I want is to introduce more security bugs right now. > Seth being a braver man than I am has already merged his changes into > the Ubuntu kernel. Maybe not quite so brave as you think. I also threw on a patch to disable the feature unless explicitly enabled by a sys admin. > James I think you are missing the fact that all filesystems already have > the make_kuid and make_kgid calls right where the data comes off disk, > and the from_kuid and from_kgid calls right where the on-disk data is > being created just before it goes on disk. Which means that the actual > impact on filesystems of the translation is trivial. It is fairly simple but a there's bit more that just id conversions to change. With ext4 I found that there were mount options which needed to be restricted, some capability checks to update, and access to external journal devices must be checked. In all it wasn't a whole lot of changes to the filesystem though. Fuse was a bit more involved, but the complexities there won't apply to other filesystems. > Djalal if you could work with Seth I think that would be very useful. I > know I am dragging my heels there but I really hope I can dig in and get > everything reviewed and merged soonish. That would make me very happy :-) I'm happy to look with Djalal for commonalities. I did skim his patches before, and based on that all I really expect to find are things related to permission checks when ids don't map. The rest seems fundamentally different. Seth