Commit c7c7a1a1 authored by Tycho Andersen's avatar Tycho Andersen Committed by Christian Brauner

xattr: handle idmapped mounts

When interacting with extended attributes the vfs verifies that the
caller is privileged over the inode with which the extended attribute is
associated. For posix access and posix default extended attributes a uid
or gid can be stored on-disk. Let the functions handle posix extended
attributes on idmapped mounts. If the inode is accessed through an
idmapped mount we need to map it according to the mount's user
namespace. Afterwards the checks are identical to non-idmapped mounts.
This has no effect for e.g. security xattrs since they don't store uids
or gids and don't perform permission checks on them like posix acls do.

Link: https://lore.kernel.org/r/20210121131959.646623-10-christian.brauner@ubuntu.com
Cc: Christoph Hellwig <hch@lst.de>
Cc: David Howells <dhowells@redhat.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: linux-fsdevel@vger.kernel.org
Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
Reviewed-by: default avatarJames Morris <jamorris@linux.microsoft.com>
Signed-off-by: default avatarTycho Andersen <tycho@tycho.pizza>
Signed-off-by: default avatarChristian Brauner <christian.brauner@ubuntu.com>
parent e65ce2a5
...@@ -39,8 +39,8 @@ int cachefiles_check_object_type(struct cachefiles_object *object) ...@@ -39,8 +39,8 @@ int cachefiles_check_object_type(struct cachefiles_object *object)
_enter("%p{%s}", object, type); _enter("%p{%s}", object, type);
/* attempt to install a type label directly */ /* attempt to install a type label directly */
ret = vfs_setxattr(dentry, cachefiles_xattr_cache, type, 2, ret = vfs_setxattr(&init_user_ns, dentry, cachefiles_xattr_cache, type,
XATTR_CREATE); 2, XATTR_CREATE);
if (ret == 0) { if (ret == 0) {
_debug("SET"); /* we succeeded */ _debug("SET"); /* we succeeded */
goto error; goto error;
...@@ -54,7 +54,8 @@ int cachefiles_check_object_type(struct cachefiles_object *object) ...@@ -54,7 +54,8 @@ int cachefiles_check_object_type(struct cachefiles_object *object)
} }
/* read the current type label */ /* read the current type label */
ret = vfs_getxattr(dentry, cachefiles_xattr_cache, xtype, 3); ret = vfs_getxattr(&init_user_ns, dentry, cachefiles_xattr_cache, xtype,
3);
if (ret < 0) { if (ret < 0) {
if (ret == -ERANGE) if (ret == -ERANGE)
goto bad_type_length; goto bad_type_length;
...@@ -110,9 +111,8 @@ int cachefiles_set_object_xattr(struct cachefiles_object *object, ...@@ -110,9 +111,8 @@ int cachefiles_set_object_xattr(struct cachefiles_object *object,
_debug("SET #%u", auxdata->len); _debug("SET #%u", auxdata->len);
clear_bit(FSCACHE_COOKIE_AUX_UPDATED, &object->fscache.cookie->flags); clear_bit(FSCACHE_COOKIE_AUX_UPDATED, &object->fscache.cookie->flags);
ret = vfs_setxattr(dentry, cachefiles_xattr_cache, ret = vfs_setxattr(&init_user_ns, dentry, cachefiles_xattr_cache,
&auxdata->type, auxdata->len, &auxdata->type, auxdata->len, XATTR_CREATE);
XATTR_CREATE);
if (ret < 0 && ret != -ENOMEM) if (ret < 0 && ret != -ENOMEM)
cachefiles_io_error_obj( cachefiles_io_error_obj(
object, object,
...@@ -140,9 +140,8 @@ int cachefiles_update_object_xattr(struct cachefiles_object *object, ...@@ -140,9 +140,8 @@ int cachefiles_update_object_xattr(struct cachefiles_object *object,
_debug("SET #%u", auxdata->len); _debug("SET #%u", auxdata->len);
clear_bit(FSCACHE_COOKIE_AUX_UPDATED, &object->fscache.cookie->flags); clear_bit(FSCACHE_COOKIE_AUX_UPDATED, &object->fscache.cookie->flags);
ret = vfs_setxattr(dentry, cachefiles_xattr_cache, ret = vfs_setxattr(&init_user_ns, dentry, cachefiles_xattr_cache,
&auxdata->type, auxdata->len, &auxdata->type, auxdata->len, XATTR_REPLACE);
XATTR_REPLACE);
if (ret < 0 && ret != -ENOMEM) if (ret < 0 && ret != -ENOMEM)
cachefiles_io_error_obj( cachefiles_io_error_obj(
object, object,
...@@ -171,7 +170,7 @@ int cachefiles_check_auxdata(struct cachefiles_object *object) ...@@ -171,7 +170,7 @@ int cachefiles_check_auxdata(struct cachefiles_object *object)
if (!auxbuf) if (!auxbuf)
return -ENOMEM; return -ENOMEM;
xlen = vfs_getxattr(dentry, cachefiles_xattr_cache, xlen = vfs_getxattr(&init_user_ns, dentry, cachefiles_xattr_cache,
&auxbuf->type, 512 + 1); &auxbuf->type, 512 + 1);
ret = -ESTALE; ret = -ESTALE;
if (xlen < 1 || if (xlen < 1 ||
...@@ -213,7 +212,7 @@ int cachefiles_check_object_xattr(struct cachefiles_object *object, ...@@ -213,7 +212,7 @@ int cachefiles_check_object_xattr(struct cachefiles_object *object,
} }
/* read the current type label */ /* read the current type label */
ret = vfs_getxattr(dentry, cachefiles_xattr_cache, ret = vfs_getxattr(&init_user_ns, dentry, cachefiles_xattr_cache,
&auxbuf->type, 512 + 1); &auxbuf->type, 512 + 1);
if (ret < 0) { if (ret < 0) {
if (ret == -ENODATA) if (ret == -ENODATA)
...@@ -270,9 +269,9 @@ int cachefiles_check_object_xattr(struct cachefiles_object *object, ...@@ -270,9 +269,9 @@ int cachefiles_check_object_xattr(struct cachefiles_object *object,
} }
/* update the current label */ /* update the current label */
ret = vfs_setxattr(dentry, cachefiles_xattr_cache, ret = vfs_setxattr(&init_user_ns, dentry,
&auxdata->type, auxdata->len, cachefiles_xattr_cache, &auxdata->type,
XATTR_REPLACE); auxdata->len, XATTR_REPLACE);
if (ret < 0) { if (ret < 0) {
cachefiles_io_error_obj(object, cachefiles_io_error_obj(object,
"Can't update xattr on %lu" "Can't update xattr on %lu"
...@@ -309,7 +308,7 @@ int cachefiles_remove_object_xattr(struct cachefiles_cache *cache, ...@@ -309,7 +308,7 @@ int cachefiles_remove_object_xattr(struct cachefiles_cache *cache,
{ {
int ret; int ret;
ret = vfs_removexattr(dentry, cachefiles_xattr_cache); ret = vfs_removexattr(&init_user_ns, dentry, cachefiles_xattr_cache);
if (ret < 0) { if (ret < 0) {
if (ret == -ENOENT || ret == -ENODATA) if (ret == -ENOENT || ret == -ENODATA)
ret = 0; ret = 0;
......
...@@ -1110,8 +1110,8 @@ ecryptfs_write_metadata_to_xattr(struct dentry *ecryptfs_dentry, ...@@ -1110,8 +1110,8 @@ ecryptfs_write_metadata_to_xattr(struct dentry *ecryptfs_dentry,
} }
inode_lock(lower_inode); inode_lock(lower_inode);
rc = __vfs_setxattr(lower_dentry, lower_inode, ECRYPTFS_XATTR_NAME, rc = __vfs_setxattr(&init_user_ns, lower_dentry, lower_inode,
page_virt, size, 0); ECRYPTFS_XATTR_NAME, page_virt, size, 0);
if (!rc && ecryptfs_inode) if (!rc && ecryptfs_inode)
fsstack_copy_attr_all(ecryptfs_inode, lower_inode); fsstack_copy_attr_all(ecryptfs_inode, lower_inode);
inode_unlock(lower_inode); inode_unlock(lower_inode);
......
...@@ -1024,7 +1024,8 @@ ecryptfs_setxattr(struct dentry *dentry, struct inode *inode, ...@@ -1024,7 +1024,8 @@ ecryptfs_setxattr(struct dentry *dentry, struct inode *inode,
rc = -EOPNOTSUPP; rc = -EOPNOTSUPP;
goto out; goto out;
} }
rc = vfs_setxattr(lower_dentry, name, value, size, flags); rc = vfs_setxattr(&init_user_ns, lower_dentry, name, value, size,
flags);
if (!rc && inode) if (!rc && inode)
fsstack_copy_attr_all(inode, d_inode(lower_dentry)); fsstack_copy_attr_all(inode, d_inode(lower_dentry));
out: out:
...@@ -1089,7 +1090,7 @@ static int ecryptfs_removexattr(struct dentry *dentry, struct inode *inode, ...@@ -1089,7 +1090,7 @@ static int ecryptfs_removexattr(struct dentry *dentry, struct inode *inode,
goto out; goto out;
} }
inode_lock(lower_inode); inode_lock(lower_inode);
rc = __vfs_removexattr(lower_dentry, name); rc = __vfs_removexattr(&init_user_ns, lower_dentry, name);
inode_unlock(lower_inode); inode_unlock(lower_inode);
out: out:
return rc; return rc;
......
...@@ -426,8 +426,8 @@ static int ecryptfs_write_inode_size_to_xattr(struct inode *ecryptfs_inode) ...@@ -426,8 +426,8 @@ static int ecryptfs_write_inode_size_to_xattr(struct inode *ecryptfs_inode)
if (size < 0) if (size < 0)
size = 8; size = 8;
put_unaligned_be64(i_size_read(ecryptfs_inode), xattr_virt); put_unaligned_be64(i_size_read(ecryptfs_inode), xattr_virt);
rc = __vfs_setxattr(lower_dentry, lower_inode, ECRYPTFS_XATTR_NAME, rc = __vfs_setxattr(&init_user_ns, lower_dentry, lower_inode,
xattr_virt, size, 0); ECRYPTFS_XATTR_NAME, xattr_virt, size, 0);
inode_unlock(lower_inode); inode_unlock(lower_inode);
if (rc) if (rc)
printk(KERN_ERR "Error whilst attempting to write inode size " printk(KERN_ERR "Error whilst attempting to write inode size "
......
...@@ -499,7 +499,8 @@ int nfsd4_is_junction(struct dentry *dentry) ...@@ -499,7 +499,8 @@ int nfsd4_is_junction(struct dentry *dentry)
return 0; return 0;
if (!(inode->i_mode & S_ISVTX)) if (!(inode->i_mode & S_ISVTX))
return 0; return 0;
if (vfs_getxattr(dentry, NFSD_JUNCTION_XATTR_NAME, NULL, 0) <= 0) if (vfs_getxattr(&init_user_ns, dentry, NFSD_JUNCTION_XATTR_NAME,
NULL, 0) <= 0)
return 0; return 0;
return 1; return 1;
} }
...@@ -2149,7 +2150,7 @@ nfsd_getxattr(struct svc_rqst *rqstp, struct svc_fh *fhp, char *name, ...@@ -2149,7 +2150,7 @@ nfsd_getxattr(struct svc_rqst *rqstp, struct svc_fh *fhp, char *name,
inode_lock_shared(inode); inode_lock_shared(inode);
len = vfs_getxattr(dentry, name, NULL, 0); len = vfs_getxattr(&init_user_ns, dentry, name, NULL, 0);
/* /*
* Zero-length attribute, just return. * Zero-length attribute, just return.
...@@ -2176,7 +2177,7 @@ nfsd_getxattr(struct svc_rqst *rqstp, struct svc_fh *fhp, char *name, ...@@ -2176,7 +2177,7 @@ nfsd_getxattr(struct svc_rqst *rqstp, struct svc_fh *fhp, char *name,
goto out; goto out;
} }
len = vfs_getxattr(dentry, name, buf, len); len = vfs_getxattr(&init_user_ns, dentry, name, buf, len);
if (len <= 0) { if (len <= 0) {
kvfree(buf); kvfree(buf);
buf = NULL; buf = NULL;
...@@ -2283,7 +2284,8 @@ nfsd_removexattr(struct svc_rqst *rqstp, struct svc_fh *fhp, char *name) ...@@ -2283,7 +2284,8 @@ nfsd_removexattr(struct svc_rqst *rqstp, struct svc_fh *fhp, char *name)
fh_lock(fhp); fh_lock(fhp);
ret = __vfs_removexattr_locked(fhp->fh_dentry, name, NULL); ret = __vfs_removexattr_locked(&init_user_ns, fhp->fh_dentry,
name, NULL);
fh_unlock(fhp); fh_unlock(fhp);
fh_drop_write(fhp); fh_drop_write(fhp);
...@@ -2307,8 +2309,8 @@ nfsd_setxattr(struct svc_rqst *rqstp, struct svc_fh *fhp, char *name, ...@@ -2307,8 +2309,8 @@ nfsd_setxattr(struct svc_rqst *rqstp, struct svc_fh *fhp, char *name,
return nfserrno(ret); return nfserrno(ret);
fh_lock(fhp); fh_lock(fhp);
ret = __vfs_setxattr_locked(fhp->fh_dentry, name, buf, len, flags, ret = __vfs_setxattr_locked(&init_user_ns, fhp->fh_dentry, name, buf,
NULL); len, flags, NULL);
fh_unlock(fhp); fh_unlock(fhp);
fh_drop_write(fhp); fh_drop_write(fhp);
......
...@@ -85,9 +85,9 @@ int ovl_copy_xattr(struct super_block *sb, struct dentry *old, ...@@ -85,9 +85,9 @@ int ovl_copy_xattr(struct super_block *sb, struct dentry *old,
if (ovl_is_private_xattr(sb, name)) if (ovl_is_private_xattr(sb, name))
continue; continue;
retry: retry:
size = vfs_getxattr(old, name, value, value_size); size = vfs_getxattr(&init_user_ns, old, name, value, value_size);
if (size == -ERANGE) if (size == -ERANGE)
size = vfs_getxattr(old, name, NULL, 0); size = vfs_getxattr(&init_user_ns, old, name, NULL, 0);
if (size < 0) { if (size < 0) {
error = size; error = size;
...@@ -114,7 +114,7 @@ int ovl_copy_xattr(struct super_block *sb, struct dentry *old, ...@@ -114,7 +114,7 @@ int ovl_copy_xattr(struct super_block *sb, struct dentry *old,
error = 0; error = 0;
continue; /* Discard */ continue; /* Discard */
} }
error = vfs_setxattr(new, name, value, size, 0); error = vfs_setxattr(&init_user_ns, new, name, value, size, 0);
if (error) { if (error) {
if (error != -EOPNOTSUPP || ovl_must_copy_xattr(name)) if (error != -EOPNOTSUPP || ovl_must_copy_xattr(name))
break; break;
...@@ -795,7 +795,7 @@ static ssize_t ovl_getxattr(struct dentry *dentry, char *name, char **value) ...@@ -795,7 +795,7 @@ static ssize_t ovl_getxattr(struct dentry *dentry, char *name, char **value)
ssize_t res; ssize_t res;
char *buf; char *buf;
res = vfs_getxattr(dentry, name, NULL, 0); res = vfs_getxattr(&init_user_ns, dentry, name, NULL, 0);
if (res == -ENODATA || res == -EOPNOTSUPP) if (res == -ENODATA || res == -EOPNOTSUPP)
res = 0; res = 0;
...@@ -804,7 +804,7 @@ static ssize_t ovl_getxattr(struct dentry *dentry, char *name, char **value) ...@@ -804,7 +804,7 @@ static ssize_t ovl_getxattr(struct dentry *dentry, char *name, char **value)
if (!buf) if (!buf)
return -ENOMEM; return -ENOMEM;
res = vfs_getxattr(dentry, name, buf, res); res = vfs_getxattr(&init_user_ns, dentry, name, buf, res);
if (res < 0) if (res < 0)
kfree(buf); kfree(buf);
else else
...@@ -846,8 +846,8 @@ static int ovl_copy_up_meta_inode_data(struct ovl_copy_up_ctx *c) ...@@ -846,8 +846,8 @@ static int ovl_copy_up_meta_inode_data(struct ovl_copy_up_ctx *c)
* don't want that to happen for normal copy-up operation. * don't want that to happen for normal copy-up operation.
*/ */
if (capability) { if (capability) {
err = vfs_setxattr(upperpath.dentry, XATTR_NAME_CAPS, err = vfs_setxattr(&init_user_ns, upperpath.dentry,
capability, cap_size, 0); XATTR_NAME_CAPS, capability, cap_size, 0);
if (err) if (err)
goto out_free; goto out_free;
} }
......
...@@ -449,7 +449,7 @@ static int ovl_set_upper_acl(struct dentry *upperdentry, const char *name, ...@@ -449,7 +449,7 @@ static int ovl_set_upper_acl(struct dentry *upperdentry, const char *name,
if (err < 0) if (err < 0)
goto out_free; goto out_free;
err = vfs_setxattr(upperdentry, name, buffer, size, XATTR_CREATE); err = vfs_setxattr(&init_user_ns, upperdentry, name, buffer, size, XATTR_CREATE);
out_free: out_free:
kfree(buffer); kfree(buffer);
return err; return err;
......
...@@ -352,7 +352,7 @@ int ovl_xattr_set(struct dentry *dentry, struct inode *inode, const char *name, ...@@ -352,7 +352,7 @@ int ovl_xattr_set(struct dentry *dentry, struct inode *inode, const char *name,
goto out; goto out;
if (!value && !upperdentry) { if (!value && !upperdentry) {
err = vfs_getxattr(realdentry, name, NULL, 0); err = vfs_getxattr(&init_user_ns, realdentry, name, NULL, 0);
if (err < 0) if (err < 0)
goto out_drop_write; goto out_drop_write;
} }
...@@ -367,10 +367,11 @@ int ovl_xattr_set(struct dentry *dentry, struct inode *inode, const char *name, ...@@ -367,10 +367,11 @@ int ovl_xattr_set(struct dentry *dentry, struct inode *inode, const char *name,
old_cred = ovl_override_creds(dentry->d_sb); old_cred = ovl_override_creds(dentry->d_sb);
if (value) if (value)
err = vfs_setxattr(realdentry, name, value, size, flags); err = vfs_setxattr(&init_user_ns, realdentry, name, value, size,
flags);
else { else {
WARN_ON(flags != XATTR_REPLACE); WARN_ON(flags != XATTR_REPLACE);
err = vfs_removexattr(realdentry, name); err = vfs_removexattr(&init_user_ns, realdentry, name);
} }
revert_creds(old_cred); revert_creds(old_cred);
...@@ -392,7 +393,7 @@ int ovl_xattr_get(struct dentry *dentry, struct inode *inode, const char *name, ...@@ -392,7 +393,7 @@ int ovl_xattr_get(struct dentry *dentry, struct inode *inode, const char *name,
ovl_i_dentry_upper(inode) ?: ovl_dentry_lower(dentry); ovl_i_dentry_upper(inode) ?: ovl_dentry_lower(dentry);
old_cred = ovl_override_creds(dentry->d_sb); old_cred = ovl_override_creds(dentry->d_sb);
res = vfs_getxattr(realdentry, name, value, size); res = vfs_getxattr(&init_user_ns, realdentry, name, value, size);
revert_creds(old_cred); revert_creds(old_cred);
return res; return res;
} }
......
...@@ -186,7 +186,7 @@ static inline ssize_t ovl_do_getxattr(struct ovl_fs *ofs, struct dentry *dentry, ...@@ -186,7 +186,7 @@ static inline ssize_t ovl_do_getxattr(struct ovl_fs *ofs, struct dentry *dentry,
size_t size) size_t size)
{ {
const char *name = ovl_xattr(ofs, ox); const char *name = ovl_xattr(ofs, ox);
return vfs_getxattr(dentry, name, value, size); return vfs_getxattr(&init_user_ns, dentry, name, value, size);
} }
static inline int ovl_do_setxattr(struct ovl_fs *ofs, struct dentry *dentry, static inline int ovl_do_setxattr(struct ovl_fs *ofs, struct dentry *dentry,
...@@ -194,7 +194,7 @@ static inline int ovl_do_setxattr(struct ovl_fs *ofs, struct dentry *dentry, ...@@ -194,7 +194,7 @@ static inline int ovl_do_setxattr(struct ovl_fs *ofs, struct dentry *dentry,
size_t size) size_t size)
{ {
const char *name = ovl_xattr(ofs, ox); const char *name = ovl_xattr(ofs, ox);
int err = vfs_setxattr(dentry, name, value, size, 0); int err = vfs_setxattr(&init_user_ns, dentry, name, value, size, 0);
pr_debug("setxattr(%pd2, \"%s\", \"%*pE\", %zu, 0) = %i\n", pr_debug("setxattr(%pd2, \"%s\", \"%*pE\", %zu, 0) = %i\n",
dentry, name, min((int)size, 48), value, size, err); dentry, name, min((int)size, 48), value, size, err);
return err; return err;
...@@ -204,7 +204,7 @@ static inline int ovl_do_removexattr(struct ovl_fs *ofs, struct dentry *dentry, ...@@ -204,7 +204,7 @@ static inline int ovl_do_removexattr(struct ovl_fs *ofs, struct dentry *dentry,
enum ovl_xattr ox) enum ovl_xattr ox)
{ {
const char *name = ovl_xattr(ofs, ox); const char *name = ovl_xattr(ofs, ox);
int err = vfs_removexattr(dentry, name); int err = vfs_removexattr(&init_user_ns, dentry, name);
pr_debug("removexattr(%pd2, \"%s\") = %i\n", dentry, name, err); pr_debug("removexattr(%pd2, \"%s\") = %i\n", dentry, name, err);
return err; return err;
} }
......
...@@ -794,11 +794,13 @@ static struct dentry *ovl_workdir_create(struct ovl_fs *ofs, ...@@ -794,11 +794,13 @@ static struct dentry *ovl_workdir_create(struct ovl_fs *ofs,
* allowed as upper are limited to "normal" ones, where checking * allowed as upper are limited to "normal" ones, where checking
* for the above two errors is sufficient. * for the above two errors is sufficient.
*/ */
err = vfs_removexattr(work, XATTR_NAME_POSIX_ACL_DEFAULT); err = vfs_removexattr(&init_user_ns, work,
XATTR_NAME_POSIX_ACL_DEFAULT);
if (err && err != -ENODATA && err != -EOPNOTSUPP) if (err && err != -ENODATA && err != -EOPNOTSUPP)
goto out_dput; goto out_dput;
err = vfs_removexattr(work, XATTR_NAME_POSIX_ACL_ACCESS); err = vfs_removexattr(&init_user_ns, work,
XATTR_NAME_POSIX_ACL_ACCESS);
if (err && err != -ENODATA && err != -EOPNOTSUPP) if (err && err != -ENODATA && err != -EOPNOTSUPP)
goto out_dput; goto out_dput;
......
This diff is collapsed.
...@@ -16,6 +16,7 @@ ...@@ -16,6 +16,7 @@
#include <linux/types.h> #include <linux/types.h>
#include <linux/spinlock.h> #include <linux/spinlock.h>
#include <linux/mm.h> #include <linux/mm.h>
#include <linux/user_namespace.h>
#include <uapi/linux/xattr.h> #include <uapi/linux/xattr.h>
struct inode; struct inode;
...@@ -49,18 +50,26 @@ struct xattr { ...@@ -49,18 +50,26 @@ struct xattr {
}; };
ssize_t __vfs_getxattr(struct dentry *, struct inode *, const char *, void *, size_t); ssize_t __vfs_getxattr(struct dentry *, struct inode *, const char *, void *, size_t);
ssize_t vfs_getxattr(struct dentry *, const char *, void *, size_t); ssize_t vfs_getxattr(struct user_namespace *, struct dentry *, const char *,
void *, size_t);
ssize_t vfs_listxattr(struct dentry *d, char *list, size_t size); ssize_t vfs_listxattr(struct dentry *d, char *list, size_t size);
int __vfs_setxattr(struct dentry *, struct inode *, const char *, const void *, size_t, int); int __vfs_setxattr(struct user_namespace *, struct dentry *, struct inode *,
int __vfs_setxattr_noperm(struct dentry *, const char *, const void *, size_t, int); const char *, const void *, size_t, int);
int __vfs_setxattr_locked(struct dentry *, const char *, const void *, size_t, int, struct inode **); int __vfs_setxattr_noperm(struct user_namespace *, struct dentry *,
int vfs_setxattr(struct dentry *, const char *, const void *, size_t, int); const char *, const void *, size_t, int);
int __vfs_removexattr(struct dentry *, const char *); int __vfs_setxattr_locked(struct user_namespace *, struct dentry *,
int __vfs_removexattr_locked(struct dentry *, const char *, struct inode **); const char *, const void *, size_t, int,
int vfs_removexattr(struct dentry *, const char *); struct inode **);
int vfs_setxattr(struct user_namespace *, struct dentry *, const char *,
const void *, size_t, int);
int __vfs_removexattr(struct user_namespace *, struct dentry *, const char *);
int __vfs_removexattr_locked(struct user_namespace *, struct dentry *,
const char *, struct inode **);
int vfs_removexattr(struct user_namespace *, struct dentry *, const char *);
ssize_t generic_listxattr(struct dentry *dentry, char *buffer, size_t buffer_size); ssize_t generic_listxattr(struct dentry *dentry, char *buffer, size_t buffer_size);
ssize_t vfs_getxattr_alloc(struct dentry *dentry, const char *name, ssize_t vfs_getxattr_alloc(struct user_namespace *mnt_userns,
struct dentry *dentry, const char *name,
char **xattr_value, size_t size, gfp_t flags); char **xattr_value, size_t size, gfp_t flags);
int xattr_supported_namespace(struct inode *inode, const char *prefix); int xattr_supported_namespace(struct inode *inode, const char *prefix);
......
...@@ -324,8 +324,8 @@ static int aa_xattrs_match(const struct linux_binprm *bprm, ...@@ -324,8 +324,8 @@ static int aa_xattrs_match(const struct linux_binprm *bprm,
d = bprm->file->f_path.dentry; d = bprm->file->f_path.dentry;
for (i = 0; i < profile->xattr_count; i++) { for (i = 0; i < profile->xattr_count; i++) {
size = vfs_getxattr_alloc(d, profile->xattrs[i], &value, size = vfs_getxattr_alloc(&init_user_ns, d, profile->xattrs[i],
value_size, GFP_KERNEL); &value, value_size, GFP_KERNEL);
if (size >= 0) { if (size >= 0) {
u32 perm; u32 perm;
......
...@@ -313,7 +313,7 @@ int cap_inode_killpriv(struct dentry *dentry) ...@@ -313,7 +313,7 @@ int cap_inode_killpriv(struct dentry *dentry)
{ {
int error; int error;
error = __vfs_removexattr(dentry, XATTR_NAME_CAPS); error = __vfs_removexattr(&init_user_ns, dentry, XATTR_NAME_CAPS);
if (error == -EOPNOTSUPP) if (error == -EOPNOTSUPP)
error = 0; error = 0;
return error; return error;
...@@ -386,8 +386,8 @@ int cap_inode_getsecurity(struct inode *inode, const char *name, void **buffer, ...@@ -386,8 +386,8 @@ int cap_inode_getsecurity(struct inode *inode, const char *name, void **buffer,
return -EINVAL; return -EINVAL;
size = sizeof(struct vfs_ns_cap_data); size = sizeof(struct vfs_ns_cap_data);
ret = (int) vfs_getxattr_alloc(dentry, XATTR_NAME_CAPS, ret = (int)vfs_getxattr_alloc(&init_user_ns, dentry, XATTR_NAME_CAPS,
&tmpbuf, size, GFP_NOFS); &tmpbuf, size, GFP_NOFS);
dput(dentry); dput(dentry);
if (ret < 0) if (ret < 0)
......
...@@ -222,7 +222,7 @@ static int evm_calc_hmac_or_hash(struct dentry *dentry, ...@@ -222,7 +222,7 @@ static int evm_calc_hmac_or_hash(struct dentry *dentry,
ima_present = true; ima_present = true;
continue; continue;
} }
size = vfs_getxattr_alloc(dentry, xattr->name, size = vfs_getxattr_alloc(&init_user_ns, dentry, xattr->name,
&xattr_value, xattr_size, GFP_NOFS); &xattr_value, xattr_size, GFP_NOFS);
if (size == -ENOMEM) { if (size == -ENOMEM) {
error = -ENOMEM; error = -ENOMEM;
...@@ -275,8 +275,8 @@ static int evm_is_immutable(struct dentry *dentry, struct inode *inode) ...@@ -275,8 +275,8 @@ static int evm_is_immutable(struct dentry *dentry, struct inode *inode)
return 1; return 1;
/* Do this the hard way */ /* Do this the hard way */
rc = vfs_getxattr_alloc(dentry, XATTR_NAME_EVM, (char **)&xattr_data, 0, rc = vfs_getxattr_alloc(&init_user_ns, dentry, XATTR_NAME_EVM,
GFP_NOFS); (char **)&xattr_data, 0, GFP_NOFS);
if (rc <= 0) { if (rc <= 0) {
if (rc == -ENODATA) if (rc == -ENODATA)
return 0; return 0;
...@@ -319,11 +319,12 @@ int evm_update_evmxattr(struct dentry *dentry, const char *xattr_name, ...@@ -319,11 +319,12 @@ int evm_update_evmxattr(struct dentry *dentry, const char *xattr_name,
xattr_value_len, &data); xattr_value_len, &data);
if (rc == 0) { if (rc == 0) {
data.hdr.xattr.sha1.type = EVM_XATTR_HMAC; data.hdr.xattr.sha1.type = EVM_XATTR_HMAC;
rc = __vfs_setxattr_noperm(dentry, XATTR_NAME_EVM, rc = __vfs_setxattr_noperm(&init_user_ns, dentry,
XATTR_NAME_EVM,
&data.hdr.xattr.data[1], &data.hdr.xattr.data[1],
SHA1_DIGEST_SIZE + 1, 0); SHA1_DIGEST_SIZE + 1, 0);
} else if (rc == -ENODATA && (inode->i_opflags & IOP_XATTR)) { } else if (rc == -ENODATA && (inode->i_opflags & IOP_XATTR)) {
rc = __vfs_removexattr(dentry, XATTR_NAME_EVM); rc = __vfs_removexattr(&init_user_ns, dentry, XATTR_NAME_EVM);
} }
return rc; return rc;
} }
......
...@@ -146,8 +146,8 @@ static enum integrity_status evm_verify_hmac(struct dentry *dentry, ...@@ -146,8 +146,8 @@ static enum integrity_status evm_verify_hmac(struct dentry *dentry,
/* if status is not PASS, try to check again - against -ENOMEM */ /* if status is not PASS, try to check again - against -ENOMEM */
/* first need to know the sig type */ /* first need to know the sig type */
rc = vfs_getxattr_alloc(dentry, XATTR_NAME_EVM, (char **)&xattr_data, 0, rc = vfs_getxattr_alloc(&init_user_ns, dentry, XATTR_NAME_EVM,
GFP_NOFS); (char **)&xattr_data, 0, GFP_NOFS);
if (rc <= 0) { if (rc <= 0) {
evm_status = INTEGRITY_FAIL; evm_status = INTEGRITY_FAIL;
if (rc == -ENODATA) { if (rc == -ENODATA) {
......
...@@ -94,7 +94,7 @@ static int ima_fix_xattr(struct dentry *dentry, ...@@ -94,7 +94,7 @@ static int ima_fix_xattr(struct dentry *dentry,
iint->ima_hash->xattr.ng.type = IMA_XATTR_DIGEST_NG; iint->ima_hash->xattr.ng.type = IMA_XATTR_DIGEST_NG;
iint->ima_hash->xattr.ng.algo = algo; iint->ima_hash->xattr.ng.algo = algo;
} }
rc = __vfs_setxattr_noperm(dentry, XATTR_NAME_IMA, rc = __vfs_setxattr_noperm(&init_user_ns, dentry, XATTR_NAME_IMA,
&iint->ima_hash->xattr.data[offset], &iint->ima_hash->xattr.data[offset],
(sizeof(iint->ima_hash->xattr) - offset) + (sizeof(iint->ima_hash->xattr) - offset) +
iint->ima_hash->length, 0); iint->ima_hash->length, 0);
...@@ -215,8 +215,8 @@ int ima_read_xattr(struct dentry *dentry, ...@@ -215,8 +215,8 @@ int ima_read_xattr(struct dentry *dentry,
{ {
ssize_t ret; ssize_t ret;
ret = vfs_getxattr_alloc(dentry, XATTR_NAME_IMA, (char **)xattr_value, ret = vfs_getxattr_alloc(&init_user_ns, dentry, XATTR_NAME_IMA,
0, GFP_NOFS); (char **)xattr_value, 0, GFP_NOFS);
if (ret == -EOPNOTSUPP) if (ret == -EOPNOTSUPP)
ret = 0; ret = 0;
return ret; return ret;
...@@ -520,7 +520,7 @@ void ima_inode_post_setattr(struct dentry *dentry) ...@@ -520,7 +520,7 @@ void ima_inode_post_setattr(struct dentry *dentry)
action = ima_must_appraise(inode, MAY_ACCESS, POST_SETATTR); action = ima_must_appraise(inode, MAY_ACCESS, POST_SETATTR);
if (!action) if (!action)
__vfs_removexattr(dentry, XATTR_NAME_IMA); __vfs_removexattr(&init_user_ns, dentry, XATTR_NAME_IMA);
iint = integrity_iint_find(inode); iint = integrity_iint_find(inode);
if (iint) { if (iint) {
set_bit(IMA_CHANGE_ATTR, &iint->atomic_flags); set_bit(IMA_CHANGE_ATTR, &iint->atomic_flags);
......
...@@ -6526,7 +6526,8 @@ static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen ...@@ -6526,7 +6526,8 @@ static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen
*/ */
static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen) static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
{ {
return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0); return __vfs_setxattr_noperm(&init_user_ns, dentry, XATTR_NAME_SELINUX,
ctx, ctxlen, 0);
} }
static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen) static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
......
...@@ -3425,7 +3425,7 @@ static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode) ...@@ -3425,7 +3425,7 @@ static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode)
*/ */
if (isp->smk_flags & SMK_INODE_CHANGED) { if (isp->smk_flags & SMK_INODE_CHANGED) {
isp->smk_flags &= ~SMK_INODE_CHANGED; isp->smk_flags &= ~SMK_INODE_CHANGED;
rc = __vfs_setxattr(dp, inode, rc = __vfs_setxattr(&init_user_ns, dp, inode,
XATTR_NAME_SMACKTRANSMUTE, XATTR_NAME_SMACKTRANSMUTE,
TRANS_TRUE, TRANS_TRUE_SIZE, TRANS_TRUE, TRANS_TRUE_SIZE,
0); 0);
...@@ -4597,12 +4597,14 @@ static int smack_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid) ...@@ -4597,12 +4597,14 @@ static int smack_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
static int smack_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen) static int smack_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
{ {
return smack_inode_setsecurity(inode, XATTR_SMACK_SUFFIX, ctx, ctxlen, 0); return smack_inode_setsecurity(inode, XATTR_SMACK_SUFFIX, ctx,
ctxlen, 0);
} }
static int smack_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen) static int smack_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
{ {
return __vfs_setxattr_noperm(dentry, XATTR_NAME_SMACK, ctx, ctxlen, 0); return __vfs_setxattr_noperm(&init_user_ns, dentry, XATTR_NAME_SMACK,
ctx, ctxlen, 0);
} }
static int smack_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen) static int smack_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment