Commit c0ca3d70 authored by Vivek Goyal's avatar Vivek Goyal Committed by Miklos Szeredi
Browse files

ovl: modify ovl_permission() to do checks on two inodes 



Right now ovl_permission() calls __inode_permission(realinode), to do
permission checks on real inode and no checks are done on overlay inode.

Modify it to do checks both on overlay inode as well as underlying inode.
Checks on overlay inode will be done with the creds of calling task while
checks on underlying inode will be done with the creds of mounter.

Signed-off-by: default avatarVivek Goyal <vgoyal@redhat.com>
Signed-off-by: default avatarMiklos Szeredi <mszeredi@redhat.com>
parent 39a25b2b

fs/overlayfs/inode.c

+14 −4
Original line number Original line Diff line number Diff line
@@ -113,6 +113,7 @@ int ovl_permission(struct inode *inode, int mask) 
	bool is_upper;

	bool is_upper;

	struct dentry *realdentry = ovl_entry_real(oe, &is_upper);

	struct dentry *realdentry = ovl_entry_real(oe, &is_upper);

	struct inode *realinode;

	struct inode *realinode;

	const struct cred *old_cred;

	int err;

	int err;





	if (ovl_is_default_permissions(inode)) {

	if (ovl_is_default_permissions(inode)) {
@@ -166,7 +167,19 @@ int ovl_permission(struct inode *inode, int mask) 
			return -EROFS;

			return -EROFS;

	}

	}





	return __inode_permission(realinode, mask);

	/*

	 * Check overlay inode with the creds of task and underlying inode

	 * with creds of mounter

	 */

	err = generic_permission(inode, mask);

	if (err)

		return err;



	old_cred = ovl_override_creds(inode->i_sb);

	err = __inode_permission(realinode, mask);

	revert_creds(old_cred);



	return err;

}

}





static const char *ovl_get_link(struct dentry *dentry,

static const char *ovl_get_link(struct dentry *dentry,
@@ -314,9 +327,6 @@ struct posix_acl *ovl_get_acl(struct inode *inode, int type) 
{

{

	struct inode *realinode = ovl_inode_real(inode);

	struct inode *realinode = ovl_inode_real(inode);





	if (!realinode)

		return ERR_PTR(-ENOENT);



	if (!IS_POSIXACL(realinode))

	if (!IS_POSIXACL(realinode))

		return NULL;

		return NULL;

CRA Git | Maintained and supported by SUSTech CRA and CCSE