• Eric W. Biederman's avatar
    vfs: Don't modify inodes with a uid or gid unknown to the vfs · 0bd23d09
    Eric W. Biederman authored
    When a filesystem outside of init_user_ns is mounted it could have
    uids and gids stored in it that do not map to init_user_ns.
    The plan is to allow those filesystems to set i_uid to INVALID_UID and
    i_gid to INVALID_GID for unmapped uids and gids and then to handle
    that strange case in the vfs to ensure there is consistent robust
    handling of the weirdness.
    Upon a careful review of the vfs and filesystems about the only case
    where there is any possibility of confusion or trouble is when the
    inode is written back to disk.  In that case filesystems typically
    read the inode->i_uid and inode->i_gid and write them to disk even
    when just an inode timestamp is being updated.
    Which leads to a rule that is very simple to implement and understand
    inodes whose i_uid or i_gid is not valid may not be written.
    In dealing with access times this means treat those inodes as if the
    inode flag S_NOATIME was set.  Reads of the inodes appear safe and
    useful, but any write or modification is disallowed.  The only inode
    write that is allowed is a chown that sets the uid and gid on the
    inode to valid values.  After such a chown the inode is normal and may
    be treated as such.
    Denying all writes to inodes with uids or gids unknown to the vfs also
    prevents several oddball cases where corruption would have occurred
    because the vfs does not have complete information.
    One problem case that is prevented is attempting to use the gid of a
    directory for new inodes where the directories sgid bit is set but the
    directories gid is not mapped.
    Another problem case avoided is attempting to update the evm hash
    after setxattr, removexattr, and setattr.  As the evm hash includeds
    the inode->i_uid or inode->i_gid not knowning the uid or gid prevents
    a correct evm hash from being computed.  evm hash verification also
    fails when i_uid or i_gid is unknown but that is essentially harmless
    as it does not cause filesystem corruption.
    Acked-by: default avatarSeth Forshee <seth.forshee@canonical.com>
    Signed-off-by: default avatar"Eric W. Biederman" <ebiederm@xmission.com>
xattr.c 23.5 KB