From: Seth Forshee <seth.forshee-Z7WLFzj8eWMS+FvcfC7Uqw@public.gmane.org> To: "Eric W. Biederman" <ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org> Cc: linux-fsdevel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, Linux Containers <containers-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org>, linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, Christian Brauner <christian-STijNZzMWpgWenYVfaLwtA@public.gmane.org> Subject: Re: [REVIEW][PATCH 2/6] vfs: Allow userns root to call mknod on owned filesystems. Date: Thu, 24 May 2018 12:22:32 -0500 [thread overview] Message-ID: <20180524172232.GS3401@ubuntu-xps13> (raw) In-Reply-To: <87y3g92dta.fsf-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org> On Thu, May 24, 2018 at 11:55:45AM -0500, Eric W. Biederman wrote: > Seth Forshee <seth.forshee-Z7WLFzj8eWMS+FvcfC7Uqw@public.gmane.org> writes: > > > On Wed, May 23, 2018 at 06:25:34PM -0500, Eric W. Biederman wrote: > >> These filesystems already always set SB_I_NODEV so mknod will not be > >> useful for gaining control of any devices no matter their permissions. > >> This will allow overlayfs and applications to fakeroot to use device > >> nodes to represent things on disk. > >> > >> Signed-off-by: "Eric W. Biederman" <ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org> > > > > For a normal filesystem this does seem safe enough. > > > > However, I'd also like to see us allow unprivileged mounting for > > overlayfs, and there we need to worry about whether this would allow a > > mknod in an underlying filesystem which should not be allowed. That > > mknod will be subject to this same check in the underlying filesystem > > using the credentials of the user that mounted the overaly fs, which > > should be sufficient to ensure that the mknod is permitted. > > Sufficient to ensure the mknod is not permitted on the underlying > filesystem. I believe you mean. Right, or in other words with the relaxed capability check a user still could not use an overlayfs mount in a user namespace to mknod in a filesystem when that user couldn't otherwise mknod in that filesystem. Sorry if I wasn't clear. > > > Thus this looks okay to me. > > > > Acked-by: Seth Forshee <seth.forshee-Z7WLFzj8eWMS+FvcfC7Uqw@public.gmane.org> > > Eric >
WARNING: multiple messages have this Message-ID (diff)
From: Seth Forshee <seth.forshee@canonical.com> To: "Eric W. Biederman" <ebiederm@xmission.com> Cc: Linux Containers <containers@lists.linux-foundation.org>, linux-fsdevel@vger.kernel.org, "Serge E. Hallyn" <serge@hallyn.com>, Christian Brauner <christian@brauner.io>, linux-kernel@vger.kernel.org Subject: Re: [REVIEW][PATCH 2/6] vfs: Allow userns root to call mknod on owned filesystems. Date: Thu, 24 May 2018 12:22:32 -0500 [thread overview] Message-ID: <20180524172232.GS3401@ubuntu-xps13> (raw) In-Reply-To: <87y3g92dta.fsf@xmission.com> On Thu, May 24, 2018 at 11:55:45AM -0500, Eric W. Biederman wrote: > Seth Forshee <seth.forshee@canonical.com> writes: > > > On Wed, May 23, 2018 at 06:25:34PM -0500, Eric W. Biederman wrote: > >> These filesystems already always set SB_I_NODEV so mknod will not be > >> useful for gaining control of any devices no matter their permissions. > >> This will allow overlayfs and applications to fakeroot to use device > >> nodes to represent things on disk. > >> > >> Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com> > > > > For a normal filesystem this does seem safe enough. > > > > However, I'd also like to see us allow unprivileged mounting for > > overlayfs, and there we need to worry about whether this would allow a > > mknod in an underlying filesystem which should not be allowed. That > > mknod will be subject to this same check in the underlying filesystem > > using the credentials of the user that mounted the overaly fs, which > > should be sufficient to ensure that the mknod is permitted. > > Sufficient to ensure the mknod is not permitted on the underlying > filesystem. I believe you mean. Right, or in other words with the relaxed capability check a user still could not use an overlayfs mount in a user namespace to mknod in a filesystem when that user couldn't otherwise mknod in that filesystem. Sorry if I wasn't clear. > > > Thus this looks okay to me. > > > > Acked-by: Seth Forshee <seth.forshee@canonical.com> > > Eric >
next prev parent reply other threads:[~2018-05-24 17:22 UTC|newest] Thread overview: 50+ messages / expand[flat|nested] mbox.gz Atom feed top 2018-05-23 23:22 [REVIEW][PATCH 0/6] Wrapping up the vfs support for unprivileged mounts Eric W. Biederman 2018-05-23 23:25 ` [REVIEW][PATCH 1/6] vfs: Don't allow changing the link count of an inode with an invalid uid or gid Eric W. Biederman 2018-05-24 12:58 ` Seth Forshee 2018-05-24 22:30 ` Christian Brauner [not found] ` <20180523232538.4880-1-ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org> 2018-05-24 12:58 ` Seth Forshee 2018-05-23 23:25 ` [REVIEW][PATCH 2/6] vfs: Allow userns root to call mknod on owned filesystems Eric W. Biederman [not found] ` <20180523232538.4880-2-ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org> 2018-05-24 13:55 ` Seth Forshee 2018-05-24 13:55 ` Seth Forshee 2018-05-24 16:55 ` Eric W. Biederman [not found] ` <87y3g92dta.fsf-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org> 2018-05-24 17:22 ` Seth Forshee [this message] 2018-05-24 17:22 ` Seth Forshee 2018-05-24 16:55 ` Eric W. Biederman 2018-05-24 19:12 ` Christian Brauner 2018-05-23 23:25 ` [REVIEW][PATCH 3/6] fs: Allow superblock owner to replace invalid owners of inodes Eric W. Biederman 2018-05-23 23:41 ` [REVIEW][PATCH v2 " Eric W. Biederman 2018-05-24 22:30 ` Christian Brauner [not found] ` <20180523232538.4880-3-ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org> 2018-05-23 23:41 ` Eric W. Biederman [not found] ` <87o9h6554f.fsf-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org> 2018-05-23 23:25 ` [REVIEW][PATCH 1/6] vfs: Don't allow changing the link count of an inode with an invalid uid or gid Eric W. Biederman 2018-05-23 23:25 ` [REVIEW][PATCH 2/6] vfs: Allow userns root to call mknod on owned filesystems Eric W. Biederman 2018-05-23 23:25 ` [REVIEW][PATCH 3/6] fs: Allow superblock owner to replace invalid owners of inodes Eric W. Biederman 2018-05-23 23:25 ` [REVIEW][PATCH 4/6] fs: Allow superblock owner to access do_remount_sb() Eric W. Biederman 2018-05-23 23:25 ` [REVIEW][PATCH 5/6] capabilities: Allow privileged user in s_user_ns to set security.* xattrs Eric W. Biederman 2018-05-23 23:25 ` [REVIEW][PATCH 6/6] fs: Allow CAP_SYS_ADMIN in s_user_ns to freeze and thaw filesystems Eric W. Biederman 2018-05-24 21:46 ` [REVIEW][PATCH 0/6] Wrapping up the vfs support for unprivileged mounts Theodore Y. Ts'o 2018-05-29 15:40 ` Dongsu Park 2018-05-23 23:25 ` [REVIEW][PATCH 4/6] fs: Allow superblock owner to access do_remount_sb() Eric W. Biederman 2018-05-24 15:58 ` Christian Brauner [not found] ` <20180524155803.GB19932-cl+VPiYnx/1AfugRpC6u6w@public.gmane.org> 2018-05-24 16:45 ` Eric W. Biederman 2018-05-24 16:45 ` Eric W. Biederman 2018-05-24 17:28 ` Christian Brauner 2018-05-23 23:25 ` [REVIEW][PATCH 5/6] capabilities: Allow privileged user in s_user_ns to set security.* xattrs Eric W. Biederman 2018-05-24 15:57 ` Christian Brauner 2018-05-23 23:25 ` [REVIEW][PATCH 6/6] fs: Allow CAP_SYS_ADMIN in s_user_ns to freeze and thaw filesystems Eric W. Biederman 2018-05-24 15:59 ` Christian Brauner 2018-05-24 21:46 ` [REVIEW][PATCH 0/6] Wrapping up the vfs support for unprivileged mounts Theodore Y. Ts'o 2018-05-24 23:23 ` Eric W. Biederman 2018-05-25 3:57 ` Dave Chinner 2018-05-25 4:06 ` Darrick J. Wong 2018-05-25 4:06 ` Darrick J. Wong 2018-05-29 13:12 ` Eric W. Biederman 2018-05-29 13:12 ` Eric W. Biederman 2018-05-29 22:17 ` Dave Chinner 2018-05-30 2:34 ` Eric W. Biederman 2018-05-30 2:34 ` Eric W. Biederman 2018-05-30 4:34 ` Dave Chinner [not found] ` <87k1rlkh1g.fsf-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org> 2018-05-30 4:34 ` Dave Chinner [not found] ` <8736yar4g3.fsf-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org> 2018-05-29 22:17 ` Dave Chinner [not found] ` <87y3g8y6x9.fsf-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org> 2018-05-25 3:57 ` Dave Chinner [not found] ` <20180524214617.GG7712-AKGzg7BKzIDYtjvyW6yDsg@public.gmane.org> 2018-05-24 23:23 ` Eric W. Biederman 2018-05-29 15:40 ` Dongsu Park
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20180524172232.GS3401@ubuntu-xps13 \ --to=seth.forshee-z7wlfzj8ewms+fvcfc7uqw@public.gmane.org \ --cc=christian-STijNZzMWpgWenYVfaLwtA@public.gmane.org \ --cc=containers-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org \ --cc=ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org \ --cc=linux-fsdevel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \ --cc=linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.