diff options
| author |   Miklos Szeredi <mszeredi@redhat.com> | 2018-10-26 23:34:39 +0200 |
|---|---|---|
| committer | Miklos Szeredi <mszeredi@redhat.com> | 2018-10-26 23:34:39 +0200 |
| commit | 007ea44892e6fa963a0876a979e34890325c64eb (patch) | |
| tree | 83dff50eb71f2222451342424e4dd3e64b5f27fb /fs/overlayfs | |
| parent | ovl: fix recursive oi->lock in ovl_link() (diff) | |
| download | wireguard-linux-007ea44892e6fa963a0876a979e34890325c64eb.tar.xz wireguard-linux-007ea44892e6fa963a0876a979e34890325c64eb.zip | |
ovl: relax permission checking on underlying layers
Make permission checking more consistent:
- special files don't need any access check on underling fs
- exec permission check doesn't need to be performed on underlying fs
Reported-by: "J. Bruce Fields" <bfields@fieldses.org>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Diffstat (limited to 'fs/overlayfs')
| -rw-r--r-- | fs/overlayfs/inode.c | 17 |
1 files changed, 13 insertions, 4 deletions
diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c index 3b7ed5d2279c..6bcc9dedc342 100644 --- a/fs/overlayfs/inode.c +++ b/fs/overlayfs/inode.c @@ -286,13 +286,22 @@ int ovl_permission(struct inode *inode, int mask) if (err) return err; - old_cred = ovl_override_creds(inode->i_sb); - if (!upperinode && - !special_file(realinode->i_mode) && mask & MAY_WRITE) { + /* No need to do any access on underlying for special files */ + if (special_file(realinode->i_mode)) + return 0; + + /* No need to access underlying for execute */ + mask &= ~MAY_EXEC; + if ((mask & (MAY_READ | MAY_WRITE)) == 0) + return 0; + + /* Lower files get copied up, so turn write access into read */ + if (!upperinode && mask & MAY_WRITE) { mask &= ~(MAY_WRITE | MAY_APPEND); - /* Make sure mounter can read file for copy up later */ mask |= MAY_READ; } + + old_cred = ovl_override_creds(inode->i_sb); err = inode_permission(realinode, mask); revert_creds(old_cred); |