Commit 98487de3 authored by Jiufei Xue's avatar Jiufei Xue Committed by Miklos Szeredi

ovl: check the capability before cred overridden

We found that it return success when we set IMMUTABLE_FL flag to a file in
docker even though the docker didn't have the capability
CAP_LINUX_IMMUTABLE.

The commit d1d04ef8 ("ovl: stack file ops") and dab5ca8f ("ovl: add
lsattr/chattr support") implemented chattr operations on a regular overlay
file. ovl_real_ioctl() overridden the current process's subjective
credentials with ofs->creator_cred which have the capability
CAP_LINUX_IMMUTABLE so that it will return success in
vfs_ioctl()->cap_capable().

Fix this by checking the capability before cred overridden. And here we
only care about APPEND_FL and IMMUTABLE_FL, so get these information from
inode.

[SzM: move check and call to underlying fs inside inode locked region to
prevent two such calls from racing with each other]
Signed-off-by: default avatarJiufei Xue <jiufei.xue@linux.alibaba.com>
Signed-off-by: default avatarMiklos Szeredi <mszeredi@redhat.com>
parent d9899030
...@@ -11,6 +11,7 @@ ...@@ -11,6 +11,7 @@
#include <linux/mount.h> #include <linux/mount.h>
#include <linux/xattr.h> #include <linux/xattr.h>
#include <linux/uio.h> #include <linux/uio.h>
#include <linux/uaccess.h>
#include "overlayfs.h" #include "overlayfs.h"
static char ovl_whatisit(struct inode *inode, struct inode *realinode) static char ovl_whatisit(struct inode *inode, struct inode *realinode)
...@@ -408,34 +409,76 @@ static long ovl_real_ioctl(struct file *file, unsigned int cmd, ...@@ -408,34 +409,76 @@ static long ovl_real_ioctl(struct file *file, unsigned int cmd,
return ret; return ret;
} }
static long ovl_ioctl(struct file *file, unsigned int cmd, unsigned long arg) static unsigned int ovl_get_inode_flags(struct inode *inode)
{
unsigned int flags = READ_ONCE(inode->i_flags);
unsigned int ovl_iflags = 0;
if (flags & S_SYNC)
ovl_iflags |= FS_SYNC_FL;
if (flags & S_APPEND)
ovl_iflags |= FS_APPEND_FL;
if (flags & S_IMMUTABLE)
ovl_iflags |= FS_IMMUTABLE_FL;
if (flags & S_NOATIME)
ovl_iflags |= FS_NOATIME_FL;
return ovl_iflags;
}
static long ovl_ioctl_set_flags(struct file *file, unsigned long arg)
{ {
long ret; long ret;
struct inode *inode = file_inode(file); struct inode *inode = file_inode(file);
unsigned int flags;
unsigned int old_flags;
switch (cmd) {
case FS_IOC_GETFLAGS:
ret = ovl_real_ioctl(file, cmd, arg);
break;
case FS_IOC_SETFLAGS:
if (!inode_owner_or_capable(inode)) if (!inode_owner_or_capable(inode))
return -EACCES; return -EACCES;
if (get_user(flags, (int __user *) arg))
return -EFAULT;
ret = mnt_want_write_file(file); ret = mnt_want_write_file(file);
if (ret) if (ret)
return ret; return ret;
inode_lock(inode);
/* Check the capability before cred override */
ret = -EPERM;
old_flags = ovl_get_inode_flags(inode);
if (((flags ^ old_flags) & (FS_APPEND_FL | FS_IMMUTABLE_FL)) &&
!capable(CAP_LINUX_IMMUTABLE))
goto unlock;
ret = ovl_maybe_copy_up(file_dentry(file), O_WRONLY); ret = ovl_maybe_copy_up(file_dentry(file), O_WRONLY);
if (!ret) { if (ret)
ret = ovl_real_ioctl(file, cmd, arg); goto unlock;
ret = ovl_real_ioctl(file, FS_IOC_SETFLAGS, arg);
inode_lock(inode);
ovl_copyflags(ovl_inode_real(inode), inode); ovl_copyflags(ovl_inode_real(inode), inode);
unlock:
inode_unlock(inode); inode_unlock(inode);
}
mnt_drop_write_file(file); mnt_drop_write_file(file);
return ret;
}
static long ovl_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
{
long ret;
switch (cmd) {
case FS_IOC_GETFLAGS:
ret = ovl_real_ioctl(file, cmd, arg);
break;
case FS_IOC_SETFLAGS:
ret = ovl_ioctl_set_flags(file, arg);
break; break;
default: default:
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment