[PATCH v6 12/40] namei: handle idmapped mounts in may_*() helpers

James Morris jmorris at namei.org
Fri Jan 22 03:47:59 UTC 2021

On Thu, 21 Jan 2021, Christian Brauner wrote:

> The may_follow_link(), may_linkat(), may_lookup(), may_open(),
> may_o_create(), may_create_in_sticky(), may_delete(), and may_create()
> helpers determine whether the caller is privileged enough to perform the
> associated operations. Let them handle idmapped mounts by mapping the
> inode or fsids according to the mount's user namespace. Afterwards the
> checks are identical to non-idmapped inodes. The patch takes care to
> retrieve the mount's user namespace right before performing permission
> checks and passing it down into the fileystem so the user namespace
> can't change in between by someone idmapping a mount that is currently
> not idmapped. If the initial user namespace is passed nothing changes so
> non-idmapped mounts will see identical behavior as before.
> Link: https://lore.kernel.org/r/20210112220124.837960-20-christian.brauner@ubuntu.com
> Cc: Christoph Hellwig <hch at lst.de>
> Cc: David Howells <dhowells at redhat.com>
> Cc: Al Viro <viro at zeniv.linux.org.uk>
> Cc: linux-fsdevel at vger.kernel.org
> Reviewed-by: Christoph Hellwig <hch at lst.de>
> Signed-off-by: Christian Brauner <christian.brauner at ubuntu.com>

Reviewed-by: James Morris <jamorris at linux.microsoft.com>

James Morris
<jmorris at namei.org>

More information about the Linux-security-module-archive mailing list