[PATCH v5 11/42] namei: make permission helpers idmapped mount aware
Christoph Hellwig
hch at infradead.org
Tue Jan 19 09:23:16 UTC 2021
On Tue, Jan 12, 2021 at 11:00:53PM +0100, Christian Brauner wrote:
> The two helpers inode_permission() and generic_permission() are used by
> the vfs to perform basic permission checking by verifying that the
> caller is privileged over an inode. In order to handle idmapped mounts
> we extend the two helpers with an additional user namespace argument.
> On idmapped mounts the two helpers will make sure to map the inode
> according to the mount's user namespace and then peform identical
> permission checks to inode_permission() and generic_permission(). If the
> initial user namespace is passed nothing changes so non-idmapped mounts
> will see identical behavior as before.
More long lines in here.
Otherwise looks good:
Reviewed-by: Christoph Hellwig <hch at lst.de>
More information about the Linux-security-module-archive
mailing list