linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Miklos Szeredi <miklos@szeredi.hu>
To: viro@ZenIV.linux.org.uk, torvalds@linux-foundation.org
Cc: linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org,
	hch@infradead.org, akpm@linux-foundation.org, apw@canonical.com,
	nbd@openwrt.org, neilb@suse.de, jordipujolp@gmail.com,
	ezk@fsl.cs.sunysb.edu, dhowells@redhat.com,
	sedat.dilek@googlemail.com, hooanon05@yahoo.co.jp,
	mszeredi@suse.cz
Subject: [PATCH 12/13] ovl: switch to __inode_permission()
Date: Thu, 20 Sep 2012 20:55:29 +0200	[thread overview]
Message-ID: <1348167330-30288-13-git-send-email-miklos@szeredi.hu> (raw)
In-Reply-To: <1348167330-30288-1-git-send-email-miklos@szeredi.hu>

From: Andy Whitcroft <apw@canonical.com>

When checking permissions on an overlayfs inode we do not take into
account either device cgroup restrictions nor security permissions.
This allows a user to mount an overlayfs layer over a restricted device
directory and by pass those permissions to open otherwise restricted
files.

Switch over to __inode_permissions.

Signed-off-by: Andy Whitcroft <apw@canonical.com>
Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
---
 fs/overlayfs/inode.c |   12 +-----------
 1 files changed, 1 insertions(+), 11 deletions(-)

diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c
index e854720..f3a534f 100644
--- a/fs/overlayfs/inode.c
+++ b/fs/overlayfs/inode.c
@@ -100,19 +100,9 @@ int ovl_permission(struct inode *inode, int mask)
 		if (is_upper && !IS_RDONLY(inode) && IS_RDONLY(realinode) &&
 		    (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode)))
 			goto out_dput;
-
-		/*
-		 * Nobody gets write access to an immutable file.
-		 */
-		err = -EACCES;
-		if (IS_IMMUTABLE(realinode))
-			goto out_dput;
 	}
 
-	if (realinode->i_op->permission)
-		err = realinode->i_op->permission(realinode, mask);
-	else
-		err = generic_permission(realinode, mask);
+	err = __inode_permission(realinode, mask);
 out_dput:
 	dput(alias);
 	return err;
-- 
1.7.7


  parent reply	other threads:[~2012-09-20 18:55 UTC|newest]

Thread overview: 22+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2012-09-20 18:55 [PATCH 00/13] overlay filesystem: request for inclusion (v15) Miklos Szeredi
2012-09-20 18:55 ` [PATCH 01/13] vfs: add i_op->dentry_open() Miklos Szeredi
2012-09-20 18:55 ` [PATCH 02/13] vfs: export do_splice_direct() to modules Miklos Szeredi
2012-09-20 18:55 ` [PATCH 03/13] vfs: introduce clone_private_mount() Miklos Szeredi
2012-09-20 18:55 ` [PATCH 04/13] overlay filesystem Miklos Szeredi
2012-09-20 18:55 ` [PATCH 05/13] overlayfs: add statfs support Miklos Szeredi
2012-09-20 18:55 ` [PATCH 06/13] overlayfs: implement show_options Miklos Szeredi
2012-09-20 18:55 ` [PATCH 07/13] overlay: overlay filesystem documentation Miklos Szeredi
2012-09-20 18:55 ` [PATCH 08/13] fs: limit filesystem stacking depth Miklos Szeredi
2012-09-20 18:55 ` [PATCH 09/13] overlayfs: fix possible leak in ovl_new_inode Miklos Szeredi
2012-09-20 18:55 ` [PATCH 10/13] overlayfs: create new inode in ovl_link Miklos Szeredi
2012-09-20 18:55 ` [PATCH 11/13] vfs: export __inode_permission() to modules Miklos Szeredi
2012-09-20 18:55 ` Miklos Szeredi [this message]
2012-09-20 18:55 ` [PATCH 13/13] overlayfs: copy up i_uid/i_gid from the underlying inode Miklos Szeredi
2012-09-20 19:34 ` [PATCH 00/13] overlay filesystem: request for inclusion (v15) J. R. Okajima
2012-09-20 20:48   ` Miklos Szeredi
2012-09-20 21:30     ` J. R. Okajima
2012-09-23 13:02     ` Jan Engelhardt
  -- strict thread matches above, loose matches on Subject: below --
2012-08-15 15:48 [PATCH 00/13] overlay filesystem: request for inclusion (v14) Miklos Szeredi
2012-08-15 15:48 ` [PATCH 12/13] ovl: switch to __inode_permission() Miklos Szeredi
2012-08-15 16:59   ` Casey Schaufler
2012-08-15 17:07     ` Andy Whitcroft
2012-08-15 17:34       ` Casey Schaufler

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1348167330-30288-13-git-send-email-miklos@szeredi.hu \
    --to=miklos@szeredi.hu \
    --cc=akpm@linux-foundation.org \
    --cc=apw@canonical.com \
    --cc=dhowells@redhat.com \
    --cc=ezk@fsl.cs.sunysb.edu \
    --cc=hch@infradead.org \
    --cc=hooanon05@yahoo.co.jp \
    --cc=jordipujolp@gmail.com \
    --cc=linux-fsdevel@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=mszeredi@suse.cz \
    --cc=nbd@openwrt.org \
    --cc=neilb@suse.de \
    --cc=sedat.dilek@googlemail.com \
    --cc=torvalds@linux-foundation.org \
    --cc=viro@ZenIV.linux.org.uk \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).