All of lore.kernel.org
 help / color / mirror / Atom feed
From: ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org (Eric W. Biederman)
To: Christian Brauner <christian-STijNZzMWpgWenYVfaLwtA@public.gmane.org>
Cc: linux-fsdevel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org,
	Seth Forshee
	<seth.forshee-Z7WLFzj8eWMS+FvcfC7Uqw@public.gmane.org>,
	Linux Containers
	<containers-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org>,
	linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
Subject: Re: [REVIEW][PATCH 4/6] fs: Allow superblock owner to access do_remount_sb()
Date: Thu, 24 May 2018 11:45:06 -0500	[thread overview]
Message-ID: <87603d3svh.fsf__45382.6481396847$1527180219$gmane$org@xmission.com> (raw)
In-Reply-To: <20180524155803.GB19932-cl+VPiYnx/1AfugRpC6u6w@public.gmane.org> (Christian Brauner's message of "Thu, 24 May 2018 17:58:03 +0200")

Christian Brauner <christian-STijNZzMWpgWenYVfaLwtA@public.gmane.org> writes:

> On Wed, May 23, 2018 at 06:25:36PM -0500, Eric W. Biederman wrote:
>> Superblock level remounts are currently restricted to global
>> CAP_SYS_ADMIN, as is the path for changing the root mount to
>> read only on umount. Loosen both of these permission checks to
>> also allow CAP_SYS_ADMIN in any namespace which is privileged
>> towards the userns which originally mounted the filesystem.
>
> Acked-by: Christian Brauner <christian-STijNZzMWpgWenYVfaLwtA@public.gmane.org>
>
>> 
>> Signed-off-by: Seth Forshee <seth.forshee-Z7WLFzj8eWMS+FvcfC7Uqw@public.gmane.org>
>> Acked-by: "Eric W. Biederman" <ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org>
>> Acked-by: Serge Hallyn <serge.hallyn-Z7WLFzj8eWMS+FvcfC7Uqw@public.gmane.org>
>
> Note, I just talked to Serge. This should be Acked-by: Serge Hallyn <serge-A9i7LUbDfNHQT0dZR+AlfA@public.gmane.org>

Now you know how long these patches have been sitting waiting to get
merged.

Eric

  parent reply	other threads:[~2018-05-24 16:45 UTC|newest]

Thread overview: 50+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-05-23 23:22 [REVIEW][PATCH 0/6] Wrapping up the vfs support for unprivileged mounts Eric W. Biederman
2018-05-23 23:25 ` [REVIEW][PATCH 1/6] vfs: Don't allow changing the link count of an inode with an invalid uid or gid Eric W. Biederman
2018-05-24 12:58   ` Seth Forshee
2018-05-24 22:30     ` Christian Brauner
     [not found]   ` <20180523232538.4880-1-ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org>
2018-05-24 12:58     ` Seth Forshee
2018-05-23 23:25 ` [REVIEW][PATCH 2/6] vfs: Allow userns root to call mknod on owned filesystems Eric W. Biederman
     [not found]   ` <20180523232538.4880-2-ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org>
2018-05-24 13:55     ` Seth Forshee
2018-05-24 13:55   ` Seth Forshee
2018-05-24 16:55     ` Eric W. Biederman
     [not found]       ` <87y3g92dta.fsf-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org>
2018-05-24 17:22         ` Seth Forshee
2018-05-24 17:22           ` Seth Forshee
2018-05-24 16:55     ` Eric W. Biederman
2018-05-24 19:12   ` Christian Brauner
2018-05-23 23:25 ` [REVIEW][PATCH 3/6] fs: Allow superblock owner to replace invalid owners of inodes Eric W. Biederman
2018-05-23 23:41   ` [REVIEW][PATCH v2 " Eric W. Biederman
2018-05-24 22:30     ` Christian Brauner
     [not found]   ` <20180523232538.4880-3-ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org>
2018-05-23 23:41     ` Eric W. Biederman
     [not found] ` <87o9h6554f.fsf-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org>
2018-05-23 23:25   ` [REVIEW][PATCH 1/6] vfs: Don't allow changing the link count of an inode with an invalid uid or gid Eric W. Biederman
2018-05-23 23:25   ` [REVIEW][PATCH 2/6] vfs: Allow userns root to call mknod on owned filesystems Eric W. Biederman
2018-05-23 23:25   ` [REVIEW][PATCH 3/6] fs: Allow superblock owner to replace invalid owners of inodes Eric W. Biederman
2018-05-23 23:25   ` [REVIEW][PATCH 4/6] fs: Allow superblock owner to access do_remount_sb() Eric W. Biederman
2018-05-23 23:25   ` [REVIEW][PATCH 5/6] capabilities: Allow privileged user in s_user_ns to set security.* xattrs Eric W. Biederman
2018-05-23 23:25   ` [REVIEW][PATCH 6/6] fs: Allow CAP_SYS_ADMIN in s_user_ns to freeze and thaw filesystems Eric W. Biederman
2018-05-24 21:46   ` [REVIEW][PATCH 0/6] Wrapping up the vfs support for unprivileged mounts Theodore Y. Ts'o
2018-05-29 15:40   ` Dongsu Park
2018-05-23 23:25 ` [REVIEW][PATCH 4/6] fs: Allow superblock owner to access do_remount_sb() Eric W. Biederman
2018-05-24 15:58   ` Christian Brauner
     [not found]     ` <20180524155803.GB19932-cl+VPiYnx/1AfugRpC6u6w@public.gmane.org>
2018-05-24 16:45       ` Eric W. Biederman [this message]
2018-05-24 16:45     ` Eric W. Biederman
2018-05-24 17:28       ` Christian Brauner
2018-05-23 23:25 ` [REVIEW][PATCH 5/6] capabilities: Allow privileged user in s_user_ns to set security.* xattrs Eric W. Biederman
2018-05-24 15:57   ` Christian Brauner
2018-05-23 23:25 ` [REVIEW][PATCH 6/6] fs: Allow CAP_SYS_ADMIN in s_user_ns to freeze and thaw filesystems Eric W. Biederman
2018-05-24 15:59   ` Christian Brauner
2018-05-24 21:46 ` [REVIEW][PATCH 0/6] Wrapping up the vfs support for unprivileged mounts Theodore Y. Ts'o
2018-05-24 23:23   ` Eric W. Biederman
2018-05-25  3:57     ` Dave Chinner
2018-05-25  4:06       ` Darrick J. Wong
2018-05-25  4:06         ` Darrick J. Wong
2018-05-29 13:12       ` Eric W. Biederman
2018-05-29 13:12       ` Eric W. Biederman
2018-05-29 22:17         ` Dave Chinner
2018-05-30  2:34           ` Eric W. Biederman
2018-05-30  2:34             ` Eric W. Biederman
2018-05-30  4:34             ` Dave Chinner
     [not found]             ` <87k1rlkh1g.fsf-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org>
2018-05-30  4:34               ` Dave Chinner
     [not found]         ` <8736yar4g3.fsf-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org>
2018-05-29 22:17           ` Dave Chinner
     [not found]     ` <87y3g8y6x9.fsf-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org>
2018-05-25  3:57       ` Dave Chinner
     [not found]   ` <20180524214617.GG7712-AKGzg7BKzIDYtjvyW6yDsg@public.gmane.org>
2018-05-24 23:23     ` Eric W. Biederman
2018-05-29 15:40 ` Dongsu Park

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to='87603d3svh.fsf__45382.6481396847$1527180219$gmane$org@xmission.com' \
    --to=ebiederm-as9lmozglivwk0htik3j/w@public.gmane.org \
    --cc=christian-STijNZzMWpgWenYVfaLwtA@public.gmane.org \
    --cc=containers-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org \
    --cc=linux-fsdevel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \
    --cc=linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \
    --cc=seth.forshee-Z7WLFzj8eWMS+FvcfC7Uqw@public.gmane.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.