From: Dave Hansen <haveblue@us.ibm.com>
To: linux-kernel@vger.kernel.org
Cc: viro@ftp.linux.org.uk, herbert@13thfloor.at, hch@infradead.org,
Dave Hansen <haveblue@us.ibm.com>
Subject: [PATCH 15/28] elevate mount count for extended attributes
Date: Tue, 01 Aug 2006 16:52:51 -0700 [thread overview]
Message-ID: <20060801235251.D026F240@localhost.localdomain> (raw)
In-Reply-To: <20060801235240.82ADCA42@localhost.localdomain>
This basically audits the callers of xattr_permission(), which
calls permission() and can perform writes to the filesystem.
Signed-off-by: Dave Hansen <haveblue@us.ibm.com>
---
lxc-dave/fs/nfsd/nfs4proc.c | 7 ++++++-
lxc-dave/fs/xattr.c | 14 ++++++++++++++
2 files changed, 20 insertions(+), 1 deletion(-)
diff -puN fs/nfsd/nfs4proc.c~C-xattr fs/nfsd/nfs4proc.c
--- lxc/fs/nfsd/nfs4proc.c~C-xattr 2006-08-01 16:35:09.000000000 -0700
+++ lxc-dave/fs/nfsd/nfs4proc.c 2006-08-01 16:35:25.000000000 -0700
@@ -604,13 +604,18 @@ nfsd4_setattr(struct svc_rqst *rqstp, st
return status;
}
}
+ status = mnt_want_write(current_fh->fh_export->ex_mnt);
+ if (status)
+ return status;
status = nfs_ok;
if (setattr->sa_acl != NULL)
status = nfsd4_set_nfs4_acl(rqstp, current_fh, setattr->sa_acl);
if (status)
- return status;
+ goto out;
status = nfsd_setattr(rqstp, current_fh, &setattr->sa_iattr,
0, (time_t)0);
+out:
+ mnt_drop_write(current_fh->fh_export->ex_mnt);
return status;
}
diff -puN fs/xattr.c~C-xattr fs/xattr.c
--- lxc/fs/xattr.c~C-xattr 2006-08-01 16:35:09.000000000 -0700
+++ lxc-dave/fs/xattr.c 2006-08-01 16:35:25.000000000 -0700
@@ -12,6 +12,7 @@
#include <linux/smp_lock.h>
#include <linux/file.h>
#include <linux/xattr.h>
+#include <linux/mount.h>
#include <linux/namei.h>
#include <linux/security.h>
#include <linux/syscalls.h>
@@ -210,7 +211,11 @@ sys_setxattr(char __user *path, char __u
error = user_path_walk(path, &nd);
if (error)
return error;
+ error = mnt_want_write(nd.mnt);
+ if (error)
+ return error;
error = setxattr(nd.dentry, name, value, size, flags);
+ mnt_drop_write(nd.mnt);
path_release(&nd);
return error;
}
@@ -225,7 +230,11 @@ sys_lsetxattr(char __user *path, char __
error = user_path_walk_link(path, &nd);
if (error)
return error;
+ error = mnt_want_write(nd.mnt);
+ if (error)
+ return error;
error = setxattr(nd.dentry, name, value, size, flags);
+ mnt_drop_write(nd.mnt);
path_release(&nd);
return error;
}
@@ -241,9 +250,14 @@ sys_fsetxattr(int fd, char __user *name,
f = fget(fd);
if (!f)
return error;
+ error = mnt_want_write(f->f_vfsmnt);
+ if (error)
+ goto out_fput;
dentry = f->f_dentry;
audit_inode(NULL, dentry->d_inode);
error = setxattr(dentry, name, value, size, flags);
+ mnt_drop_write(f->f_vfsmnt);
+out_fput:
fput(f);
return error;
}
_
next prev parent reply other threads:[~2006-08-02 0:01 UTC|newest]
Thread overview: 43+ messages / expand[flat|nested] mbox.gz Atom feed top
2006-08-01 23:52 [PATCH 00/28] Mount writer count and read-only bind mounts (v5) Dave Hansen
2006-08-01 23:52 ` [PATCH 01/28] prepare for write access checks: collapse if() Dave Hansen
2006-08-03 14:32 ` Christoph Hellwig
2006-08-01 23:52 ` [PATCH 02/28] r/o bind mount prepwork: move open_namei()'s vfs_create() Dave Hansen
2006-08-03 14:33 ` Christoph Hellwig
2006-08-01 23:52 ` [PATCH 03/28] unlink: monitor i_nlink Dave Hansen
2006-08-03 14:35 ` Christoph Hellwig
2006-08-01 23:52 ` [PATCH 05/28] monitor zeroing of i_nlink Dave Hansen
2006-08-01 23:52 ` [PATCH 04/28] OCFS2 is screwy Dave Hansen
2006-08-02 2:14 ` Mark Fasheh
2006-08-02 3:19 ` [PATCH 04/28] OCFS2 is (not) screwy Dave Hansen
2006-08-02 3:21 ` [PATCH 04/28] OCFS2 is screwy Dave Hansen
2006-08-02 4:34 ` Mark Fasheh
2006-08-03 0:20 ` Mark Fasheh
2006-08-04 21:01 ` [PATCH] clean up OCFS2 nlink handling Dave Hansen
2006-08-04 21:38 ` Mark Fasheh
2006-08-01 23:52 ` [PATCH 06/28] reintroduce list of vfsmounts over superblock Dave Hansen
2006-08-03 14:39 ` Christoph Hellwig
2006-08-04 21:47 ` Dave Hansen
2006-08-01 23:52 ` [PATCH 07/28] Add vfsmount writer count Dave Hansen
2006-08-01 23:52 ` [PATCH 09/28] kill open files traverse on remount ro Dave Hansen
2006-08-01 23:52 ` [PATCH 08/28] record when sb_writer_count elevated for inode Dave Hansen
2006-08-01 23:52 ` [PATCH 10/28] increment sb writer count when nlink hits zero Dave Hansen
2006-08-01 23:52 ` [PATCH 11/28] elevate writer count for chown and friends Dave Hansen
2006-08-01 23:52 ` [PATCH 12/28] elevate mnt writers for callers of vfs_mkdir() Dave Hansen
2006-08-01 23:52 ` [PATCH 13/28] elevate write count during entire ncp_ioctl() Dave Hansen
2006-08-01 23:52 ` [PATCH 14/28] sys_symlinkat() elevate write count around vfs_symlink() Dave Hansen
2006-08-01 23:52 ` Dave Hansen [this message]
2006-08-01 23:52 ` [PATCH 16/28] sys_linkat(): elevate write count around vfs_link() Dave Hansen
2006-08-01 23:52 ` [PATCH 17/28] mount_is_safe(): add comment Dave Hansen
2006-08-01 23:52 ` [PATCH 18/28] unix_find_other() elevate write count for touch_atime() Dave Hansen
2006-08-01 23:52 ` [PATCH 19/28] elevate write count over calls to vfs_rename() Dave Hansen
2006-08-01 23:52 ` [PATCH 20/28] tricky: elevate write count files are open()ed Dave Hansen
2006-08-01 23:52 ` [PATCH 21/28] elevate writer count for do_sys_truncate() Dave Hansen
2006-08-01 23:52 ` [PATCH 22/28] elevate write count for do_utimes() Dave Hansen
2006-08-01 23:52 ` [PATCH 23/28] elevate write count for do_sys_utime() and touch_atime() Dave Hansen
2006-08-01 23:52 ` [PATCH 24/28] sys_mknodat(): elevate write count for vfs_mknod/create() Dave Hansen
2006-08-01 23:52 ` [PATCH 25/28] elevate mnt writers for vfs_unlink() callers Dave Hansen
2006-08-01 23:52 ` [PATCH 26/28] do_rmdir(): elevate write count Dave Hansen
2006-08-01 23:53 ` [PATCH 27/28] elevate writer count for custom 'struct file' Dave Hansen
2006-08-03 14:42 ` Christoph Hellwig
2006-08-11 20:31 ` Dave Hansen
2006-08-01 23:53 ` [PATCH 28/28] honor r/w changes at do_remount() time Dave Hansen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20060801235251.D026F240@localhost.localdomain \
--to=haveblue@us.ibm.com \
--cc=hch@infradead.org \
--cc=herbert@13thfloor.at \
--cc=linux-kernel@vger.kernel.org \
--cc=viro@ftp.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox