From: Gao feng <gaofeng@cn.fujitsu.com>
To: Dwight Engen <dwight.engen@oracle.com>
Cc: xfs@oss.sgi.com
Subject: Re: [PATCH v7 3/7] xfs: ioctl check for capabilities in the current user namespace
Date: Wed, 31 Jul 2013 12:16:02 +0800 [thread overview]
Message-ID: <51F88F82.4090606@cn.fujitsu.com> (raw)
In-Reply-To: <20130729230650.5db8228a@oracle.com>
On 07/30/2013 11:06 AM, Dwight Engen wrote:
> Use inode_capable() to check if SUID|SGID bits should be cleared to match
> similar check in inode_change_ok().
>
> The check for CAP_LINUX_IMMUTABLE was not modified since all other file
> systems also check against init_user_ns rather than current_user_ns.
>
> Reviewed-by: Dave Chinner <dchinner@redhat.com>
> Signed-off-by: Dwight Engen <dwight.engen@oracle.com>
> ---
> fs/xfs/xfs_ioctl.c | 4 ++--
> kernel/capability.c | 1 +
> 2 files changed, 3 insertions(+), 2 deletions(-)
>
> diff --git a/fs/xfs/xfs_ioctl.c b/fs/xfs/xfs_ioctl.c
> index 6e2bca5..8edc780 100644
> --- a/fs/xfs/xfs_ioctl.c
> +++ b/fs/xfs/xfs_ioctl.c
> @@ -981,7 +981,7 @@ xfs_ioctl_setattr(
> * to the file owner ID, except in cases where the
> * CAP_FSETID capability is applicable.
> */
> - if (current_fsuid() != ip->i_d.di_uid && !capable(CAP_FOWNER)) {
> + if (!inode_owner_or_capable(VFS_I(ip))) {
Though the user in container can get his quota limit info which is configured on host,
but he has no rights to modify it, so this patch looks good to me.
Thanks
Reviewed-by: Gao feng <gaofeng@cn.fujitsu.com>
> code = XFS_ERROR(EPERM);
> goto error_return;
> }
> @@ -1103,7 +1103,7 @@ xfs_ioctl_setattr(
> * cleared upon successful return from chown()
> */
> if ((ip->i_d.di_mode & (S_ISUID|S_ISGID)) &&
> - !capable(CAP_FSETID))
> + !inode_capable(VFS_I(ip), CAP_FSETID))
> ip->i_d.di_mode &= ~(S_ISUID|S_ISGID);
>
> /*
> diff --git a/kernel/capability.c b/kernel/capability.c
> index f6c2ce5..a4b6744 100644
> --- a/kernel/capability.c
> +++ b/kernel/capability.c
> @@ -464,3 +464,4 @@ bool inode_capable(const struct inode *inode, int cap)
>
> return ns_capable(ns, cap) && kuid_has_mapping(ns, inode->i_uid);
> }
> +EXPORT_SYMBOL(inode_capable);
>
_______________________________________________
xfs mailing list
xfs@oss.sgi.com
http://oss.sgi.com/mailman/listinfo/xfs
prev parent reply other threads:[~2013-07-31 4:14 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-07-30 3:06 [PATCH v7 3/7] xfs: ioctl check for capabilities in the current user namespace Dwight Engen
2013-07-31 4:16 ` Gao feng [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=51F88F82.4090606@cn.fujitsu.com \
--to=gaofeng@cn.fujitsu.com \
--cc=dwight.engen@oracle.com \
--cc=xfs@oss.sgi.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox