From: "Maciej Żenczykowski" <zenczykowski@gmail.com>
To: "Maciej Żenczykowski" <maze@google.com>
Cc: Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Joel Becker <jlbec@evilplan.org>, Christoph Hellwig <hch@lst.de>
Subject: [PATCH] configfs: make directories inherit uid/gid from creator
Date: Sat, 23 Jan 2021 12:55:16 -0800 [thread overview]
Message-ID: <20210123205516.2738060-1-zenczykowski@gmail.com> (raw)
From: Maciej Żenczykowski <maze@google.com>
Currently a non-root process can create directories, but cannot
create stuff in the directories it creates.
Example (before this patch):
phone:/ $ id
uid=1000(system) gid=1000(system) groups=1000(system),... context=u:r:su:s0
phone:/ $ cd /config/usb_gadget/g1/configs/
phone:/config/usb_gadget/g1/configs $ ls -lZ
drwxr-xr-x 3 system system u:object_r:configfs:s0 0 2020-12-28 06:03 b.1
phone:/config/usb_gadget/g1/configs $ mkdir b.2
phone:/config/usb_gadget/g1/configs $ ls -lZ
drwxr-xr-x 3 system system u:object_r:configfs:s0 0 2020-12-28 06:03 b.1
drwxr-xr-x 3 root root u:object_r:configfs:s0 0 2020-12-28 06:51 b.2
phone:/config/usb_gadget/g1/configs $ chown system:system b.2
chown: 'b.2' to 'system:system': Operation not permitted
phone:/config/usb_gadget/g1/configs $ ls -lZ b.1
-rw-r--r-- 1 system system u:object_r:configfs:s0 4096 2020-12-28 05:23 MaxPower
-rw-r--r-- 1 system system u:object_r:configfs:s0 4096 2020-12-28 05:23 bmAttributes
lrwxrwxrwx 1 root root u:object_r:configfs:s0 0 2020-12-28 05:23 function0 -> ../../../../usb_gadget/g1/functions/ffs.adb
drwxr-xr-x 2 system system u:object_r:configfs:s0 0 2020-12-28 05:23 strings
phone:/config/usb_gadget/g1/configs $ ln -s ../../../../usb_gadget/g1/functions/ffs.adb b.2/function0
ln: cannot create symbolic link from '../../../../usb_gadget/g1/functions/ffs.adb' to 'b.2/function0': Permission denied
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Christoph Hellwig <hch@lst.de>
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Ia907b2def940197b44aa87b337d37c5dde9c5b91
---
fs/configfs/dir.c | 15 +++++++++++++++
1 file changed, 15 insertions(+)
diff --git a/fs/configfs/dir.c b/fs/configfs/dir.c
index b839dd1b459f..04f18402ef7c 100644
--- a/fs/configfs/dir.c
+++ b/fs/configfs/dir.c
@@ -1410,6 +1410,21 @@ static int configfs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode
else
ret = configfs_attach_item(parent_item, item, dentry, frag);
+ /* inherit uid/gid from process creating the directory */
+ if (!uid_eq(current_fsuid(), GLOBAL_ROOT_UID) ||
+ !gid_eq(current_fsgid(), GLOBAL_ROOT_GID)) {
+ struct inode * inode = d_inode(dentry);
+ struct iattr ia = {
+ .ia_uid = current_fsuid(),
+ .ia_gid = current_fsgid(),
+ .ia_valid = ATTR_UID | ATTR_GID,
+ };
+ inode->i_uid = ia.ia_uid;
+ inode->i_gid = ia.ia_gid;
+ /* (note: the above manual assignments skip the permission checks) */
+ (void)configfs_setattr(dentry, &ia);
+ }
+
spin_lock(&configfs_dirent_lock);
sd->s_type &= ~CONFIGFS_USET_IN_MKDIR;
if (!ret)
--
2.30.0.280.ga3ce27912f-goog
next reply other threads:[~2021-01-23 20:56 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-01-23 20:55 Maciej Żenczykowski [this message]
2021-01-27 13:47 ` [PATCH] configfs: make directories inherit uid/gid from creator Greg Kroah-Hartman
2021-01-27 19:56 ` Maciej Żenczykowski
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210123205516.2738060-1-zenczykowski@gmail.com \
--to=zenczykowski@gmail.com \
--cc=gregkh@linuxfoundation.org \
--cc=hch@lst.de \
--cc=jlbec@evilplan.org \
--cc=linux-kernel@vger.kernel.org \
--cc=maze@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).