Re: [PATCH] fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy()

Re: [PATCH] fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy()

[Eric Biggers]

[+Cc linux-fsdevel@vger.kernel.org]

On Sat, Jul 25, 2026 at 04:00:04PM +0800, Zhan Xusheng wrote:
> From: Zhan Xusheng <zhanxusheng@xiaomi.com>
> 
> fscrypt_ioctl_set_policy() calls inode_owner_or_capable() with
> &nop_mnt_idmap before allowing an encryption policy to be set, instead of
> the idmap of the mount the ioctl was issued on.
> 
> fscrypt is used by filesystems that support idmapped mounts (e.g. ext4,
> f2fs), so on such a mount this compares the caller's fsuid against the
> unmapped on-disk owner rather than the mapped owner: the actual owner can
> be wrongly denied with -EACCES and an unrelated caller wrongly allowed.
> Use file_mnt_idmap(filp) instead.
> 
> Fixes: 01beba7957a2 ("fs: port inode_owner_or_capable() to mnt_idmap")
> Cc: stable@vger.kernel.org
> Signed-off-by: Zhan Xusheng <zhanxusheng@xiaomi.com>
> ---
>  fs/crypto/policy.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/fs/crypto/policy.c b/fs/crypto/policy.c
> index 9915e39362db..c80b24a941ad 100644
> --- a/fs/crypto/policy.c
> +++ b/fs/crypto/policy.c
> @@ -534,7 +534,7 @@ int fscrypt_ioctl_set_policy(struct file *filp, const void __user *arg)
>  		return -EFAULT;
>  	policy.version = version;
>  
> -	if (!inode_owner_or_capable(&nop_mnt_idmap, inode))
> +	if (!inode_owner_or_capable(file_mnt_idmap(filp), inode))
>  		return -EACCES;
>  
>  	ret = mnt_want_write_file(filp);
> -- 
> 2.43.0

Thanks.  I don't think the Fixes commit is quite right: 01beba7957a2
seems to have been a behavior-preserving commit.  It even says that it
was "eliminating the possibility of any bugs" :-)

Really it seems a patch to this function was just missing entirely, but
I would probably use 14f3db5542e6 ("ext4: support idmapped mounts").
That's when the other ext4 ioctls got converted to use
file_mnt_user_ns() and the idmap support was enabled on ext4, but this
was missed.  (And ext4 was the first fscrypt-capable filesystem to get
idmap support.)  As usual, this also needs 'Cc stable'.

I guess I'll plan to take this through the fscrypt tree.  I'll update
the tags when committing if there's no other feedback.

- Eric

Re: [PATCH] fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy()

[Eric Biggers]

On Sat, Jul 25, 2026 at 09:34:06PM -0700, Eric Biggers wrote:
> [+Cc linux-fsdevel@vger.kernel.org]
> 
> On Sat, Jul 25, 2026 at 04:00:04PM +0800, Zhan Xusheng wrote:
> > From: Zhan Xusheng <zhanxusheng@xiaomi.com>
> > 
> > fscrypt_ioctl_set_policy() calls inode_owner_or_capable() with
> > &nop_mnt_idmap before allowing an encryption policy to be set, instead of
> > the idmap of the mount the ioctl was issued on.
> > 
> > fscrypt is used by filesystems that support idmapped mounts (e.g. ext4,
> > f2fs), so on such a mount this compares the caller's fsuid against the
> > unmapped on-disk owner rather than the mapped owner: the actual owner can
> > be wrongly denied with -EACCES and an unrelated caller wrongly allowed.
> > Use file_mnt_idmap(filp) instead.
> > 
> > Fixes: 01beba7957a2 ("fs: port inode_owner_or_capable() to mnt_idmap")
> > Cc: stable@vger.kernel.org
> > Signed-off-by: Zhan Xusheng <zhanxusheng@xiaomi.com>
> > ---
> >  fs/crypto/policy.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> > 
> > diff --git a/fs/crypto/policy.c b/fs/crypto/policy.c
> > index 9915e39362db..c80b24a941ad 100644
> > --- a/fs/crypto/policy.c
> > +++ b/fs/crypto/policy.c
> > @@ -534,7 +534,7 @@ int fscrypt_ioctl_set_policy(struct file *filp, const void __user *arg)
> >  		return -EFAULT;
> >  	policy.version = version;
> >  
> > -	if (!inode_owner_or_capable(&nop_mnt_idmap, inode))
> > +	if (!inode_owner_or_capable(file_mnt_idmap(filp), inode))
> >  		return -EACCES;
> >  
> >  	ret = mnt_want_write_file(filp);
> > -- 
> > 2.43.0
> 
> Thanks.  I don't think the Fixes commit is quite right: 01beba7957a2
> seems to have been a behavior-preserving commit.  It even says that it
> was "eliminating the possibility of any bugs" :-)
> 
> Really it seems a patch to this function was just missing entirely, but
> I would probably use 14f3db5542e6 ("ext4: support idmapped mounts").
> That's when the other ext4 ioctls got converted to use
> file_mnt_user_ns() and the idmap support was enabled on ext4, but this
> was missed.  (And ext4 was the first fscrypt-capable filesystem to get
> idmap support.)  As usual, this also needs 'Cc stable'.
> 
> I guess I'll plan to take this through the fscrypt tree.  I'll update
> the tags when committing if there's no other feedback.

Applied to https://git.kernel.org/pub/scm/fs/fscrypt/linux.git/log/?h=for-current

- Eric