From: ebiederm@xmission.com (Eric W. Biederman)
To: James Bottomley <James.Bottomley@HansenPartnership.com>
Cc: Christoph Hellwig <hch@infradead.org>,
Dave Chinner <david@fromorbit.com>,
linux-xfs@vger.kernel.org, linux-fsdevel@vger.kernel.org,
Seth Forshee <seth.forshee@canonical.com>
Subject: Re: [PATCH 1/2] fs: add inode helpers for fsuid and fsgid
Date: Wed, 15 Feb 2017 15:29:05 +1300 [thread overview]
Message-ID: <87y3x8dw5q.fsf@xmission.com> (raw)
In-Reply-To: <1487088593.3133.23.camel@HansenPartnership.com> (James Bottomley's message of "Tue, 14 Feb 2017 08:09:53 -0800")
James Bottomley <James.Bottomley@HansenPartnership.com> writes:
> On Tue, 2017-02-14 at 20:46 +1300, Eric W. Biederman wrote:
>> James Bottomley <James.Bottomley@HansenPartnership.com> writes:
>>
>> > Now that we have two different views of filesystem ids (the
>> > filesystem view and the kernel view), we have a problem in that
>> > current_fsuid/fsgid() return the kernel view but are sometimes used
>> > in filesystem code where the filesystem view shoud be used. This
>> > patch introduces helpers to produce the filesystem view of current
>> > fsuid and fsgid.
>>
>> If I am reading this right what we are seeing is that xfs explicitly
>> opted out of type safety with predictable results. Accidentally
>> confusing kuids and uids, which is potentially security issue.
>>
>> All of that said where are you getting sb->s_user_ns != &init_user_ns
>> for an xfs filesystem?
James please answer this question:
Where are you getting sb->s_user_ns != &init_user_ns for an xfs filesystem?
None of this matters if sb->s_user_ns == &init_user_ns.
This is signification because only xfs keeps any in-core data structure
in it's on-disk encoding. So this problem is xfs specific. So
understanding how you are getting xfs to have sb->s_user_ns !=
&init_user_ns is important for discussing which direction we go with
helper functions here.
xfs with sb->s_user_ns == &init_user_ns is perfectly fine and as such no
fixes are needed.
Eric
next prev parent reply other threads:[~2017-02-15 2:33 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-02-13 17:46 xfs: fix inode uid/gid initialization James Bottomley
2017-02-13 19:43 ` Christoph Hellwig
2017-02-13 20:33 ` James Bottomley
2017-02-13 21:34 ` Dave Chinner
2017-02-14 6:08 ` Christoph Hellwig
2017-02-14 6:27 ` James Bottomley
2017-02-14 6:28 ` [PATCH 1/2] fs: add inode helpers for fsuid and fsgid James Bottomley
2017-02-14 7:46 ` Eric W. Biederman
2017-02-14 8:00 ` Christoph Hellwig
2017-02-14 16:09 ` James Bottomley
2017-02-15 2:29 ` Eric W. Biederman [this message]
2017-02-16 15:43 ` James Bottomley
2017-02-17 1:15 ` Eric W. Biederman
2017-02-17 17:12 ` James Bottomley
2017-02-20 4:56 ` Eric W. Biederman
2017-02-14 6:29 ` [PATCH 2/2] xfs: fix inode uid/gid initialization James Bottomley
2017-02-14 7:58 ` Christoph Hellwig
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87y3x8dw5q.fsf@xmission.com \
--to=ebiederm@xmission.com \
--cc=James.Bottomley@HansenPartnership.com \
--cc=david@fromorbit.com \
--cc=hch@infradead.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-xfs@vger.kernel.org \
--cc=seth.forshee@canonical.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.