Commit 98487de3 authored by Jiufei Xue's avatar Jiufei Xue Committed by Miklos Szeredi
Browse files

ovl: check the capability before cred overridden 



We found that it return success when we set IMMUTABLE_FL flag to a file in
docker even though the docker didn't have the capability
CAP_LINUX_IMMUTABLE.

The commit d1d04ef8 ("ovl: stack file ops") and dab5ca8f ("ovl: add
lsattr/chattr support") implemented chattr operations on a regular overlay
file. ovl_real_ioctl() overridden the current process's subjective
credentials with ofs->creator_cred which have the capability
CAP_LINUX_IMMUTABLE so that it will return success in
vfs_ioctl()->cap_capable().

Fix this by checking the capability before cred overridden. And here we
only care about APPEND_FL and IMMUTABLE_FL, so get these information from
inode.

[SzM: move check and call to underlying fs inside inode locked region to
prevent two such calls from racing with each other]

Signed-off-by: default avatarJiufei Xue <jiufei.xue@linux.alibaba.com>
Signed-off-by: default avatarMiklos Szeredi <mszeredi@redhat.com>
parent d9899030

fs/overlayfs/file.c

+61 −18
Original line number Diff line number Diff line
@@ -11,6 +11,7 @@ 
#include <linux/mount.h>

#include <linux/xattr.h>

#include <linux/uio.h>

#include <linux/uaccess.h>

#include "overlayfs.h"



static char ovl_whatisit(struct inode *inode, struct inode *realinode)
@@ -408,34 +409,76 @@ static long ovl_real_ioctl(struct file *file, unsigned int cmd, 
	return ret;

}



static long ovl_ioctl(struct file *file, unsigned int cmd, unsigned long arg)

static unsigned int ovl_get_inode_flags(struct inode *inode)

{

	unsigned int flags = READ_ONCE(inode->i_flags);

	unsigned int ovl_iflags = 0;



	if (flags & S_SYNC)

		ovl_iflags |= FS_SYNC_FL;

	if (flags & S_APPEND)

		ovl_iflags |= FS_APPEND_FL;

	if (flags & S_IMMUTABLE)

		ovl_iflags |= FS_IMMUTABLE_FL;

	if (flags & S_NOATIME)

		ovl_iflags |= FS_NOATIME_FL;



	return ovl_iflags;

}



static long ovl_ioctl_set_flags(struct file *file, unsigned long arg)

{

	long ret;

	struct inode *inode = file_inode(file);

	unsigned int flags;

	unsigned int old_flags;



	switch (cmd) {

	case FS_IOC_GETFLAGS:

		ret = ovl_real_ioctl(file, cmd, arg);

		break;



	case FS_IOC_SETFLAGS:

	if (!inode_owner_or_capable(inode))

		return -EACCES;



	if (get_user(flags, (int __user *) arg))

		return -EFAULT;



	ret = mnt_want_write_file(file);

	if (ret)

		return ret;



	inode_lock(inode);



	/* Check the capability before cred override */

	ret = -EPERM;

	old_flags = ovl_get_inode_flags(inode);

	if (((flags ^ old_flags) & (FS_APPEND_FL | FS_IMMUTABLE_FL)) &&

	    !capable(CAP_LINUX_IMMUTABLE))

		goto unlock;



	ret = ovl_maybe_copy_up(file_dentry(file), O_WRONLY);

		if (!ret) {

			ret = ovl_real_ioctl(file, cmd, arg);

	if (ret)

		goto unlock;



	ret = ovl_real_ioctl(file, FS_IOC_SETFLAGS, arg);



			inode_lock(inode);

	ovl_copyflags(ovl_inode_real(inode), inode);

unlock:

	inode_unlock(inode);

		}



	mnt_drop_write_file(file);



	return ret;



}



static long ovl_ioctl(struct file *file, unsigned int cmd, unsigned long arg)

{

	long ret;



	switch (cmd) {

	case FS_IOC_GETFLAGS:

		ret = ovl_real_ioctl(file, cmd, arg);

		break;



	case FS_IOC_SETFLAGS:

		ret = ovl_ioctl_set_flags(file, arg);

		break;



	default:

CRA Git | Maintained and supported by SUSTech CRA and CCSE