diff options
| author |   Serge E. Hallyn <serge@hallyn.com> | 2011-03-23 16:43:25 -0700 |
|---|---|---|
| committer |   Linus Torvalds <torvalds@linux-foundation.org> | 2011-03-23 19:47:08 -0700 |
| commit | e795b71799ff0b27365020c9ddaa25d0d83f99c8 (patch) | |
| tree | f3b628c2366f181380a8fbcd490910eb086a7b8e /include | |
| parent | userns: user namespaces: convert several capable() calls (diff) | |
| download | linux-dev-e795b71799ff0b27365020c9ddaa25d0d83f99c8.tar.xz linux-dev-e795b71799ff0b27365020c9ddaa25d0d83f99c8.zip | |
userns: userns: check user namespace for task->file uid equivalence checks
Cheat for now and say all files belong to init_user_ns. Next step will be
to let superblocks belong to a user_ns, and derive inode_userns(inode)
from inode->i_sb->s_user_ns. Finally we'll introduce more flexible
arrangements.
Changelog:
Feb 15: make is_owner_or_cap take const struct inode
Feb 23: make is_owner_or_cap bool
[akpm@linux-foundation.org: coding-style fixes]
Signed-off-by: Serge E. Hallyn <serge.hallyn@canonical.com>
Acked-by: "Eric W. Biederman" <ebiederm@xmission.com>
Acked-by: Daniel Lezcano <daniel.lezcano@free.fr>
Acked-by: David Howells <dhowells@redhat.com>
Cc: James Morris <jmorris@namei.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'include')
| -rw-r--r-- | include/linux/fs.h | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/include/linux/fs.h b/include/linux/fs.h index 12529e966350..9eebc646d14a 100644 --- a/include/linux/fs.h +++ b/include/linux/fs.h @@ -1457,8 +1457,13 @@ enum { #define put_fs_excl() atomic_dec(¤t->fs_excl) #define has_fs_excl() atomic_read(¤t->fs_excl) -#define is_owner_or_cap(inode) \ - ((current_fsuid() == (inode)->i_uid) || capable(CAP_FOWNER)) +/* + * until VFS tracks user namespaces for inodes, just make all files + * belong to init_user_ns + */ +extern struct user_namespace init_user_ns; +#define inode_userns(inode) (&init_user_ns) +extern bool is_owner_or_cap(const struct inode *inode); /* not quite ready to be deprecated, but... */ extern void lock_super(struct super_block *); |