From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: From: ebiederm@xmission.com (Eric W. Biederman) To: Kamal Mostafa Cc: Dave Chinner , linux-kernel@vger.kernel.org, stable@vger.kernel.org, kernel-team@lists.ubuntu.com, Dwight Engen , Ben Myers References: <1406067727-19683-1-git-send-email-kamal@canonical.com> <1406067727-19683-77-git-send-email-kamal@canonical.com> <20140722231257.GT4453@dastard> <1406149558.3612.37.camel@fourier> Date: Wed, 23 Jul 2014 18:51:23 -0700 In-Reply-To: <1406149558.3612.37.camel@fourier> (Kamal Mostafa's message of "Wed, 23 Jul 2014 14:05:58 -0700") Message-ID: <87iomnle1w.fsf@x220.int.ebiederm.org> MIME-Version: 1.0 Content-Type: text/plain Subject: Re: [PATCH 3.8 076/116] xfs: ioctl check for capabilities in the current user namespace Sender: linux-kernel-owner@vger.kernel.org List-ID: Kamal Mostafa writes: > On Wed, 2014-07-23 at 09:12 +1000, Dave Chinner wrote: >> On Tue, Jul 22, 2014 at 03:21:27PM -0700, Kamal Mostafa wrote: >> > 3.8.13.27 -stable review patch. If anyone has any objections, please let me know. >> > >> > ------------------ >> > >> > From: Dwight Engen >> > >> > commit fd5e2aa8653665ae1cc60f7aca1069abdbcad3f6 upstream. >> > >> > Use inode_capable() to check if SUID|SGID bits should be cleared to match >> > [...] >> >> Why are you backporting this to 3.8? namespace support didn't come >> along until much later, so grabbing one patch out of themiddle of a >> patch series to allow userns support in XFS is likely to cause >> problems because there's no supporting code in XFS it. >> >> Please don't randomly cherry pick userns support patches that change >> permission checks back into kernels that don't have userns support. > > Yup, that's why we ask for reviews all right! I've dropped these from > the 3.8-stable queue: > > fs,userns: Change inode_capable to capable_wrt_inode_uidgid The fs,userns: Chage inode_capable to capable_wrt_inode_uidgid is appropriate for 3.8. I think that one is applicable all of the way back to 3.4 I don't know if xfs in 3.8 called inode_capable in xfs and if it didn't you can remove that hunk. To keep things very simple you could just skip the rename of inode_capable to capable_wrt_uidgid and just include the one line change to add kgid_has_mapping. But that bug fix is very much applicable to older kernels. Eric