Skip to content

Commit

Permalink
ovl: handle idmappings in ovl_permission()
Browse files Browse the repository at this point in the history
Use the previously introduced ovl_i_path_real() helper to retrieve the
relevant upper or lower path and take the mount's idmapping into account
for the lower layer permission check. This is needed to support idmapped
base layers with overlay.

Cc: <linux-unionfs@vger.kernel.org>
Tested-by: Giuseppe Scrivano <gscrivan@redhat.com>
Reviewed-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Christian Brauner (Microsoft) <brauner@kernel.org>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
  • Loading branch information
Christian Brauner authored and Miklos Szeredi committed Apr 28, 2022
1 parent 2878dff commit 4b7791b
Showing 1 changed file with 6 additions and 3 deletions.
9 changes: 6 additions & 3 deletions fs/overlayfs/inode.c
Original file line number Diff line number Diff line change
Expand Up @@ -280,12 +280,14 @@ int ovl_permission(struct user_namespace *mnt_userns,
struct inode *inode, int mask)
{
struct inode *upperinode = ovl_inode_upper(inode);
struct inode *realinode = upperinode ?: ovl_inode_lower(inode);
struct inode *realinode;
struct path realpath;
const struct cred *old_cred;
int err;

/* Careful in RCU walk mode */
if (!realinode) {
ovl_i_path_real(inode, &realpath);
if (!realpath.dentry) {
WARN_ON(!(mask & MAY_NOT_BLOCK));
return -ECHILD;
}
Expand All @@ -298,14 +300,15 @@ int ovl_permission(struct user_namespace *mnt_userns,
if (err)
return err;

realinode = d_inode(realpath.dentry);
old_cred = ovl_override_creds(inode->i_sb);
if (!upperinode &&
!special_file(realinode->i_mode) && mask & MAY_WRITE) {
mask &= ~(MAY_WRITE | MAY_APPEND);
/* Make sure mounter can read file for copy up later */
mask |= MAY_READ;
}
err = inode_permission(&init_user_ns, realinode, mask);
err = inode_permission(mnt_user_ns(realpath.mnt), realinode, mask);
revert_creds(old_cred);

return err;
Expand Down

0 comments on commit 4b7791b

Please sign in to comment.