Merge tag 'fs.idmapped.v5.17' of git://git.kernel.org/pub/scm/linux/kernel/git/brauner/linux

Pull fs idmapping updates from Christian Brauner: "This contains the work to enable the idmapping infrastructure to support idmapped mounts of filesystems mounted with an idmapping. In addition this contains various cleanups that avoid repeated open-coding of the same functionality and simplify the code in quite a few places. We also finish the renaming of the mapping helpers we started a few kernel releases back and move them to a dedicated header to not continue polluting the fs header needlessly with low-level idmapping helpers. With this series the fs header only contains idmapping helpers that interact with fs objects. Currently we only support idmapped mounts for filesystems mounted without an idmapping themselves. This was a conscious decision mentioned in multiple places (cf. [1]). As explained at length in [3] it is perfectly fine to extend support for idmapped mounts to filesystem's mounted with an idmapping should the need arise. The need has been there for some time now (cf. [2]). Before we can port any filesystem that is mountable with an idmapping to support idmapped mounts in the coming cycles, we need to first extend the mapping helpers to account for the filesystem's idmapping. This again, is explained at length in our documentation at [3] and also in the individual commit messages so here's an overview. Currently, the low-level mapping helpers implement the remapping algorithms described in [3] in a simplified manner as we could rely on the fact that all filesystems supporting idmapped mounts are mounted without an idmapping. In contrast, filesystems mounted with an idmapping are very likely to not use an identity mapping and will instead use a non-identity mapping. So the translation step from or into the filesystem's idmapping in the remapping algorithm cannot be skipped for such filesystems. Non-idmapped filesystems and filesystems not supporting idmapped mounts are unaffected by this change as the remapping algorithms can take the same shortcut as before. If the low-level helpers detect that they are dealing with an idmapped mount but the underlying filesystem is mounted without an idmapping we can rely on the previous shortcut and can continue to skip the translation step from or into the filesystem's idmapping. And of course, if the low-level helpers detect that they are not dealing with an idmapped mount they can simply return the relevant id unchanged; no remapping needs to be performed at all. These checks guarantee that only the minimal amount of work is performed. As before, if idmapped mounts aren't used the low-level helpers are idempotent and no work is performed at all" Link: 2ca4dcc4909d ("fs/mount_setattr: tighten permission checks") [1] Link: https://github.com/containers/podman/issues/10374 [2] Link: Documentations/filesystems/idmappings.rst [3] Link: a65e58e791a1 ("fs: document and rename fsid helpers") [4] * tag 'fs.idmapped.v5.17' of git://git.kernel.org/pub/scm/linux/kernel/git/brauner/linux: fs: support mapped mounts of mapped filesystems fs: add i_user_ns() helper fs: port higher-level mapping helpers fs: remove unused low-level mapping helpers fs: use low-level mapping helpers docs: update mapping documentation fs: account for filesystem mappings fs: tweak fsuidgid_has_mapping() fs: move mapping helpers fs: add is_idmapped_mnt() helper

Linus Torvalds committed 4 years ago

Commit 5dfbfe72 parents 84bfcc0 bd3033617 files · +356 −231Browse files

Unified · Split

17 files

Documentation/filesystems/idmappings.rst +0 −72
fs/cachefiles/bind.c +1 −1
fs/ecryptfs/main.c +1 −1
fs/ksmbd/smbacl.c +3 −16
fs/ksmbd/smbacl.h +3 −2
fs/namespace.c +39 −14
fs/nfsd/export.c +1 −1
fs/open.c +5 −3
fs/overlayfs/super.c +1 −1
fs/posix_acl.c +11 −6
fs/proc_namespace.c +1 −1
fs/xfs/xfs_inode.c +4 −4
fs/xfs/xfs_linux.h +1 −0
fs/xfs/xfs_symlink.c +2 −2
include/linux/fs.h +40 −101
include/linux/mnt_idmapping.h +234 −0
security/commoncap.c +9 −6

Documentation/filesystems/idmappings.rst+0−72

@@ -952,75 +952,3 @@ The raw userspace id that is put on disk is ``u1000`` so when the user takes · 951 unmodified lines
952	their home directory back to their home computer where they are assigned	952	their home directory back to their home computer where they are assigned
953	``u1000`` using the initial idmapping and mount the filesystem with the initial	953	``u1000`` using the initial idmapping and mount the filesystem with the initial
954	idmapping they will see all those files owned by ``u1000``.	954	idmapping they will see all those files owned by ``u1000``.
955
956	Shortcircuting
957	--------------
958
959	Currently, the implementation of idmapped mounts enforces that the filesystem
960	is mounted with the initial idmapping. The reason is simply that none of the
961	filesystems that we targeted were mountable with a non-initial idmapping. But
962	that might change soon enough. As we've seen above, thanks to the properties of
963	idmappings the translation works for both filesystems mounted with the initial
964	idmapping and filesystem with non-initial idmappings.
965
966	Based on this current restriction to filesystem mounted with the initial
967	idmapping two noticeable shortcuts have been taken:
968
969	1. We always stash a reference to the initial user namespace in ``struct
970	vfsmount``. Idmapped mounts are thus mounts that have a non-initial user
971	namespace attached to them.
972
973	In order to support idmapped mounts this needs to be changed. Instead of
974	stashing the initial user namespace the user namespace the filesystem was
975	mounted with must be stashed. An idmapped mount is then any mount that has
976	a different user namespace attached then the filesystem was mounted with.
977	This has no user-visible consequences.
978
979	2. The translation algorithms in ``mapped_fsid()`` and ``i_id_into_mnt()``
980	are simplified.
981
982	Let's consider ``mapped_fs*id()`` first. This function translates the
983	caller's kernel id into a kernel id in the filesystem's idmapping via
984	a mount's idmapping. The full algorithm is::
985
986	mapped_fsuid(kid):
987	/* Map the kernel id up into a userspace id in the mount's idmapping. */
988	from_kuid(mount-idmapping, kid) = uid
989
990	/* Map the userspace id down into a kernel id in the filesystem's idmapping. */
991	make_kuid(filesystem-idmapping, uid) = kuid
992
993	We know that the filesystem is always mounted with the initial idmapping as
994	we enforce this in ``mount_setattr()``. So this can be shortened to::
995
996	mapped_fsuid(kid):
997	/* Map the kernel id up into a userspace id in the mount's idmapping. */
998	from_kuid(mount-idmapping, kid) = uid
999
1000	/* Map the userspace id down into a kernel id in the filesystem's idmapping. */
1001	KUIDT_INIT(uid) = kuid
1002
1003	Similarly, for ``i_*id_into_mnt()`` which translated the filesystem's kernel
1004	id into a mount's kernel id::
1005
1006	i_uid_into_mnt(kid):
1007	/* Map the kernel id up into a userspace id in the filesystem's idmapping. */
1008	from_kuid(filesystem-idmapping, kid) = uid
1009
1010	/* Map the userspace id down into a kernel id in the mounts's idmapping. */
1011	make_kuid(mount-idmapping, uid) = kuid
1012
1013	Again, we know that the filesystem is always mounted with the initial
1014	idmapping as we enforce this in ``mount_setattr()``. So this can be
1015	shortened to::
1016
1017	i_uid_into_mnt(kid):
1018	/* Map the kernel id up into a userspace id in the filesystem's idmapping. */
1019	__kuid_val(kid) = uid
1020
1021	/* Map the userspace id down into a kernel id in the mounts's idmapping. */
1022	make_kuid(mount-idmapping, uid) = kuid
1023
1024	Handling filesystems mounted with non-initial idmappings requires that the
1025	translation functions be converted to their full form. They can still be
1026	shortcircuited on non-idmapped mounts. This has no user-visible consequences.

fs/cachefiles/bind.c+1−1

@@ -117,7 +117,7 @@ static int cachefiles_daemon_add_cache(struct cachefiles_cache *cache) · 116 unmodified lines
117	root = path.dentry;	117	root = path.dentry;
118		118
119	ret = -EINVAL;	119	ret = -EINVAL;
120	if (mnt_user_ns(path.mnt) != &init_user_ns) {	120	if (is_idmapped_mnt(path.mnt)) {
121	pr_warn("File cache on idmapped mounts not supported");	121	pr_warn("File cache on idmapped mounts not supported");
122	goto error_unsupported;	122	goto error_unsupported;
123	}	123	}

fs/ecryptfs/main.c+1−1

@@ -537,7 +537,7 @@ static struct dentry ecryptfs_mount(struct file_system_type fs_type, int flags · 536 unmodified lines
537	goto out_free;	537	goto out_free;
538	}	538	}
539		539
540	if (mnt_user_ns(path.mnt) != &init_user_ns) {	540	if (is_idmapped_mnt(path.mnt)) {
541	rc = -EINVAL;	541	rc = -EINVAL;
542	printk(KERN_ERR "Mounting on idmapped mounts currently disallowed\n");	542	printk(KERN_ERR "Mounting on idmapped mounts currently disallowed\n");
543	goto out_free;	543	goto out_free;

fs/ksmbd/smbacl.c+3−16

 #include <linux/fs.h>
 #include <linux/slab.h>
 #include <linux/string.h>
+#include <linux/mnt_idmapping.h>
 #include "smbacl.h"
 #include "smb_common.h"
 		uid_t id;
 		id = le32_to_cpu(psid->sub_auth[psid->num_subauth - 1]);
-		/*
+		uid = mapped_kuid_user(user_ns, &init_user_ns, KUIDT_INIT(id));
-		 * Translate raw sid into kuid in the server's user
-		 * namespace.
-		 */
-		uid = make_kuid(&init_user_ns, id);
-		/* If this is an idmapped mount, apply the idmapping. */
-		uid = kuid_from_mnt(user_ns, uid);
 		if (uid_valid(uid)) {
 			fattr->cf_uid = uid;
 			rc = 0;
 		gid_t id;
 		id = le32_to_cpu(psid->sub_auth[psid->num_subauth - 1]);
-		/*
+		gid = mapped_kgid_user(user_ns, &init_user_ns, KGIDT_INIT(id));
-		 * Translate raw sid into kgid in the server's user
-		 * namespace.
-		 */
-		gid = make_kgid(&init_user_ns, id);
-		/* If this is an idmapped mount, apply the idmapping. */
-		gid = kgid_from_mnt(user_ns, gid);
 		if (gid_valid(gid)) {
 			fattr->cf_gid = gid;
 			rc = 0;

fs/ksmbd/smbacl.h+3−2

 #include <linux/fs.h>
 #include <linux/namei.h>
 #include <linux/posix_acl.h>
+#include <linux/mnt_idmapping.h>
 #include "mgmt/tree_connect.h"
 	kuid_t kuid;
 	/* If this is an idmapped mount, apply the idmapping. */
-	kuid = kuid_into_mnt(mnt_userns, pace->e_uid);
+	kuid = mapped_kuid_fs(mnt_userns, &init_user_ns, pace->e_uid);
 	/* Translate the kuid into a userspace id ksmbd would see. */
 	return from_kuid(&init_user_ns, kuid);
 	kgid_t kgid;
 	/* If this is an idmapped mount, apply the idmapping. */
-	kgid = kgid_into_mnt(mnt_userns, pace->e_gid);
+	kgid = mapped_kgid_fs(mnt_userns, &init_user_ns, pace->e_gid);
 	/* Translate the kgid into a userspace id ksmbd would see. */
 	return from_kgid(&init_user_ns, kgid);

fs/namespace.c+39−14

 #include <uapi/linux/mount.h>
 #include <linux/fs_context.h>
 #include <linux/shmem_fs.h>
+#include <linux/mnt_idmapping.h>
 #include "pnode.h"
 #include "internal.h"
 	struct user_namespace *mnt_userns;
 	mnt_userns = mnt_user_ns(&mnt->mnt);
-	if (mnt_userns != &init_user_ns)
+	if (!initial_idmapping(mnt_userns))
 		put_user_ns(mnt_userns);
 	kfree_const(mnt->mnt_devname);
 #ifdef CONFIG_SMP
 struct vfsmount *vfs_create_mount(struct fs_context *fc)
 {
 	struct mount *mnt;
+	struct user_namespace *fs_userns;
 	if (!fc->root)
 		return ERR_PTR(-EINVAL);
 	mnt->mnt_mountpoint	= mnt->mnt.mnt_root;
 	mnt->mnt_parent		= mnt;
+	fs_userns = mnt->mnt.mnt_sb->s_user_ns;
+	if (!initial_idmapping(fs_userns))
+		mnt->mnt.mnt_userns = get_user_ns(fs_userns);
 	lock_mount_hash();
 	list_add_tail(&mnt->mnt_instance, &mnt->mnt.mnt_sb->s_mounts);
 	unlock_mount_hash();
 	atomic_inc(&sb->s_active);
 	mnt->mnt.mnt_userns = mnt_user_ns(&old->mnt);
-	if (mnt->mnt.mnt_userns != &init_user_ns)
+	if (!initial_idmapping(mnt->mnt.mnt_userns))
 		mnt->mnt.mnt_userns = get_user_ns(mnt->mnt.mnt_userns);
 	mnt->mnt.mnt_sb = sb;
 	mnt->mnt.mnt_root = dget(root);
 static int can_idmap_mount(const struct mount_kattr *kattr, struct mount *mnt)
 {
 	struct vfsmount *m = &mnt->mnt;
+	struct user_namespace *fs_userns = m->mnt_sb->s_user_ns;
 	if (!kattr->mnt_userns)
 		return 0;
+	/*
+	 * Creating an idmapped mount with the filesystem wide idmapping
+	 * doesn't make sense so block that. We don't allow mushy semantics.
+	 */
+	if (kattr->mnt_userns == fs_userns)
+		return -EINVAL;
 	/*
 	 * Once a mount has been idmapped we don't allow it to change its
 	 * mapping. It makes things simpler and callers can just create
 	 * another bind-mount they can idmap if they want to.
 	 */
-	if (mnt_user_ns(m) != &init_user_ns)
+	if (is_idmapped_mnt(m))
 		return -EPERM;
 	/* The underlying filesystem doesn't support idmapped mounts yet. */
 	if (!(m->mnt_sb->s_type->fs_flags & FS_ALLOW_IDMAP))
 		return -EINVAL;
-	/* Don't yet support filesystem mountable in user namespaces. */
-	if (m->mnt_sb->s_user_ns != &init_user_ns)
-		return -EINVAL;
 	/* We're not controlling the superblock. */
-	if (!capable(CAP_SYS_ADMIN))
+	if (!ns_capable(fs_userns, CAP_SYS_ADMIN))
 		return -EPERM;
 	/* Mount has already been visible in the filesystem hierarchy. */
 static void do_idmap_mount(const struct mount_kattr *kattr, struct mount *mnt)
 {
-	struct user_namespace *mnt_userns;
+	struct user_namespace *mnt_userns, *old_mnt_userns;
 	if (!kattr->mnt_userns)
 		return;
+	/*
+	 * We're the only ones able to change the mount's idmapping. So
+	 * mnt->mnt.mnt_userns is stable and we can retrieve it directly.
+	 */
+	old_mnt_userns = mnt->mnt.mnt_userns;
 	mnt_userns = get_user_ns(kattr->mnt_userns);
 	/* Pairs with smp_load_acquire() in mnt_user_ns(). */
 	smp_store_release(&mnt->mnt.mnt_userns, mnt_userns);
+	/*
+	 * If this is an idmapped filesystem drop the reference we've taken
+	 * in vfs_create_mount() before.
+	 */
+	if (!initial_idmapping(old_mnt_userns))
+		put_user_ns(old_mnt_userns);
 }
 static void mount_setattr_commit(struct mount_kattr *kattr,
 	}
 	/*
-	 * The init_user_ns is used to indicate that a vfsmount is not idmapped.
+	 * The initial idmapping cannot be used to create an idmapped
-	 * This is simpler than just having to treat NULL as unmapped. Users
+	 * mount. We use the initial idmapping as an indicator of a mount
-	 * wanting to idmap a mount to init_user_ns can just use a namespace
+	 * that is not idmapped. It can simply be passed into helpers that
-	 * with an identity mapping.
+	 * are aware of idmapped mounts as a convenient shortcut. A user
+	 * can just create a dedicated identity mapping to achieve the same
+	 * result.
 	 */
 	mnt_userns = container_of(ns, struct user_namespace, ns);
-	if (mnt_userns == &init_user_ns) {
+	if (initial_idmapping(mnt_userns)) {
 		err = -EPERM;
 		goto out_fput;
 	}

fs/nfsd/export.c+1−1

@@ -427,7 +427,7 @@ static int check_export(struct path path, int flags, unsigned char *uuid) · 426 unmodified lines
427	return -EINVAL;	427	return -EINVAL;
428	}	428	}
429		429
430	if (mnt_user_ns(path->mnt) != &init_user_ns) {	430	if (is_idmapped_mnt(path->mnt)) {
431	dprintk("exp_export: export of idmapped mounts not yet supported.\n");	431	dprintk("exp_export: export of idmapped mounts not yet supported.\n");
432	return -EINVAL;	432	return -EINVAL;
433	}	433	}

fs/open.c+5−3

 #include <linux/ima.h>
 #include <linux/dnotify.h>
 #include <linux/compat.h>
+#include <linux/mnt_idmapping.h>
 #include "internal.h"
 int chown_common(const struct path *path, uid_t user, gid_t group)
 {
-	struct user_namespace *mnt_userns;
+	struct user_namespace *mnt_userns, *fs_userns;
 	struct inode *inode = path->dentry->d_inode;
 	struct inode *delegated_inode = NULL;
 	int error;
 	gid = make_kgid(current_user_ns(), group);
 	mnt_userns = mnt_user_ns(path->mnt);
-	uid = kuid_from_mnt(mnt_userns, uid);
+	fs_userns = i_user_ns(inode);
-	gid = kgid_from_mnt(mnt_userns, gid);
+	uid = mapped_kuid_user(mnt_userns, fs_userns, uid);
+	gid = mapped_kgid_user(mnt_userns, fs_userns, gid);
 retry_deleg:
 	newattrs.ia_valid =  ATTR_CTIME;

fs/overlayfs/super.c+1−1

@@ -873,7 +873,7 @@ static int ovl_mount_dir_noesc(const char name, struct path path) · 872 unmodified lines
873	pr_err("filesystem on '%s' not supported\n", name);	873	pr_err("filesystem on '%s' not supported\n", name);
874	goto out_put;	874	goto out_put;
875	}	875	}
876	if (mnt_user_ns(path->mnt) != &init_user_ns) {	876	if (is_idmapped_mnt(path->mnt)) {
877	pr_err("idmapped layers are currently not supported\n");	877	pr_err("idmapped layers are currently not supported\n");
878	goto out_put;	878	goto out_put;
879	}	879	}

fs/posix_acl.c+11−6

 #include <linux/export.h>
 #include <linux/user_namespace.h>
 #include <linux/namei.h>
+#include <linux/mnt_idmapping.h>
 static struct posix_acl **acl_by_type(struct inode *inode, int type)
 {
                                         goto check_perm;
                                 break;
                         case ACL_USER:
-				uid = kuid_into_mnt(mnt_userns, pa->e_uid);
+				uid = mapped_kuid_fs(mnt_userns,
+						     i_user_ns(inode),
+						     pa->e_uid);
 				if (uid_eq(uid, current_fsuid()))
                                         goto mask;
 				break;
                                 }
 				break;
                         case ACL_GROUP:
-				gid = kgid_into_mnt(mnt_userns, pa->e_gid);
+				gid = mapped_kgid_fs(mnt_userns,
+						     i_user_ns(inode),
+						     pa->e_gid);
 				if (in_group_p(gid)) {
 					found = 1;
 					if ((pa->e_perm & want) == want)
 		case ACL_USER:
 			uid = make_kuid(from, le32_to_cpu(entry->e_id));
 			if (from_user)
-				uid = kuid_from_mnt(mnt_userns, uid);
+				uid = mapped_kuid_user(mnt_userns, &init_user_ns, uid);
 			else
-				uid = kuid_into_mnt(mnt_userns, uid);
+				uid = mapped_kuid_fs(mnt_userns, &init_user_ns, uid);
 			entry->e_id = cpu_to_le32(from_kuid(to, uid));
 			break;
 		case ACL_GROUP:
 			gid = make_kgid(from, le32_to_cpu(entry->e_id));
 			if (from_user)
-				gid = kgid_from_mnt(mnt_userns, gid);
+				gid = mapped_kgid_user(mnt_userns, &init_user_ns, gid);
 			else
-				gid = kgid_into_mnt(mnt_userns, gid);
+				gid = mapped_kgid_fs(mnt_userns, &init_user_ns, gid);
 			entry->e_id = cpu_to_le32(from_kgid(to, gid));
 			break;
 		default:

fs/proc_namespace.c+1−1

@@ -80,7 +80,7 @@ static void show_mnt_opts(struct seq_file m, struct vfsmount mnt) · 79 unmodified lines
80	seq_puts(m, fs_infop->str);	80	seq_puts(m, fs_infop->str);
81	}	81	}
82		82
83	if (mnt_user_ns(mnt) != &init_user_ns)	83	if (is_idmapped_mnt(mnt))
84	seq_puts(m, ",idmapped");	84	seq_puts(m, ",idmapped");
85	}	85	}
86		86

fs/xfs/xfs_inode.c+4−4

@@ -988,8 +988,8 @@ xfs_create( · 987 unmodified lines
988	/*	988	/*
989	* Make sure that we have allocated dquot(s) on disk.	989	* Make sure that we have allocated dquot(s) on disk.
990	*/	990	*/
991	error = xfs_qm_vop_dqalloc(dp, mapped_fsuid(mnt_userns),	991	error = xfs_qm_vop_dqalloc(dp, mapped_fsuid(mnt_userns, &init_user_ns),
992	mapped_fsgid(mnt_userns), prid,	992	mapped_fsgid(mnt_userns, &init_user_ns), prid,
993	XFS_QMOPT_QUOTALL \| XFS_QMOPT_INHERIT,	993	XFS_QMOPT_QUOTALL \| XFS_QMOPT_INHERIT,
994	&udqp, &gdqp, &pdqp);	994	&udqp, &gdqp, &pdqp);
995	if (error)	995	if (error)
@@ -1142,8 +1142,8 @@ xfs_create_tmpfile( · 146 unmodified lines
1142	/*	1142	/*
1143	* Make sure that we have allocated dquot(s) on disk.	1143	* Make sure that we have allocated dquot(s) on disk.
1144	*/	1144	*/
1145	error = xfs_qm_vop_dqalloc(dp, mapped_fsuid(mnt_userns),	1145	error = xfs_qm_vop_dqalloc(dp, mapped_fsuid(mnt_userns, &init_user_ns),
1146	mapped_fsgid(mnt_userns), prid,	1146	mapped_fsgid(mnt_userns, &init_user_ns), prid,
1147	XFS_QMOPT_QUOTALL \| XFS_QMOPT_INHERIT,	1147	XFS_QMOPT_QUOTALL \| XFS_QMOPT_INHERIT,
1148	&udqp, &gdqp, &pdqp);	1148	&udqp, &gdqp, &pdqp);
1149	if (error)	1149	if (error)

fs/xfs/xfs_linux.h+1−0

@@ -61,6 +61,7 @@ typedef __u32 xfs_nlink_t; · 60 unmodified lines
61	#include <linux/ratelimit.h>	61	#include <linux/ratelimit.h>
62	#include <linux/rhashtable.h>	62	#include <linux/rhashtable.h>
63	#include <linux/xattr.h>	63	#include <linux/xattr.h>
		64	#include <linux/mnt_idmapping.h>
64		65
65	#include <asm/page.h>	66	#include <asm/page.h>
66	#include <asm/div64.h>	67	#include <asm/div64.h>

fs/xfs/xfs_symlink.c+2−2

@@ -184,8 +184,8 @@ xfs_symlink( · 183 unmodified lines
184	/*	184	/*
185	* Make sure that we have allocated dquot(s) on disk.	185	* Make sure that we have allocated dquot(s) on disk.
186	*/	186	*/
187	error = xfs_qm_vop_dqalloc(dp, mapped_fsuid(mnt_userns),	187	error = xfs_qm_vop_dqalloc(dp, mapped_fsuid(mnt_userns, &init_user_ns),
188	mapped_fsgid(mnt_userns), prid,	188	mapped_fsgid(mnt_userns, &init_user_ns), prid,
189	XFS_QMOPT_QUOTALL \| XFS_QMOPT_INHERIT,	189	XFS_QMOPT_QUOTALL \| XFS_QMOPT_INHERIT,
190	&udqp, &gdqp, &pdqp);	190	&udqp, &gdqp, &pdqp);
191	if (error)	191	if (error)

include/linux/fs.h+40−101

 #include <linux/stddef.h>
 #include <linux/mount.h>
 #include <linux/cred.h>
+#include <linux/mnt_idmapping.h>
 #include <asm/byteorder.h>
 #include <uapi/linux/fs.h>
 	struct list_head	s_inodes_wb;	/* writeback inodes */
 } __randomize_layout;
+static inline struct user_namespace *i_user_ns(const struct inode *inode)
+{
+	return inode->i_sb->s_user_ns;
+}
 /* Helper functions so that in most cases filesystems will
  * not need to deal directly with kuid_t and kgid_t and can
  * instead deal with the raw numeric values that are stored
  */
 static inline uid_t i_uid_read(const struct inode *inode)
 {
-	return from_kuid(inode->i_sb->s_user_ns, inode->i_uid);
+	return from_kuid(i_user_ns(inode), inode->i_uid);
 }
 static inline gid_t i_gid_read(const struct inode *inode)
 {
-	return from_kgid(inode->i_sb->s_user_ns, inode->i_gid);
+	return from_kgid(i_user_ns(inode), inode->i_gid);
 }
 static inline void i_uid_write(struct inode *inode, uid_t uid)
 {
-	inode->i_uid = make_kuid(inode->i_sb->s_user_ns, uid);
+	inode->i_uid = make_kuid(i_user_ns(inode), uid);
 }
 static inline void i_gid_write(struct inode *inode, gid_t gid)
 {
-	inode->i_gid = make_kgid(inode->i_sb->s_user_ns, gid);
+	inode->i_gid = make_kgid(i_user_ns(inode), gid);
-}
-/**
- * kuid_into_mnt - map a kuid down into a mnt_userns
- * @mnt_userns: user namespace of the relevant mount
- * @kuid: kuid to be mapped
- *
- * Return: @kuid mapped according to @mnt_userns.
- * If @kuid has no mapping INVALID_UID is returned.
- */
-static inline kuid_t kuid_into_mnt(struct user_namespace *mnt_userns,
-				   kuid_t kuid)
-{
-	return make_kuid(mnt_userns, __kuid_val(kuid));
-}
-/**
- * kgid_into_mnt - map a kgid down into a mnt_userns
- * @mnt_userns: user namespace of the relevant mount
- * @kgid: kgid to be mapped
- *
- * Return: @kgid mapped according to @mnt_userns.
- * If @kgid has no mapping INVALID_GID is returned.
- */
-static inline kgid_t kgid_into_mnt(struct user_namespace *mnt_userns,
-				   kgid_t kgid)
-{
-	return make_kgid(mnt_userns, __kgid_val(kgid));
 }
 /**
 static inline kuid_t i_uid_into_mnt(struct user_namespace *mnt_userns,
 				    const struct inode *inode)
 {
-	return kuid_into_mnt(mnt_userns, inode->i_uid);
+	return mapped_kuid_fs(mnt_userns, i_user_ns(inode), inode->i_uid);
 }
 /**
 static inline kgid_t i_gid_into_mnt(struct user_namespace *mnt_userns,
 				    const struct inode *inode)
 {
-	return kgid_into_mnt(mnt_userns, inode->i_gid);
+	return mapped_kgid_fs(mnt_userns, i_user_ns(inode), inode->i_gid);
-}
-/**
- * kuid_from_mnt - map a kuid up into a mnt_userns
- * @mnt_userns: user namespace of the relevant mount
- * @kuid: kuid to be mapped
- *
- * Return: @kuid mapped up according to @mnt_userns.
- * If @kuid has no mapping INVALID_UID is returned.
- */
-static inline kuid_t kuid_from_mnt(struct user_namespace *mnt_userns,
-				   kuid_t kuid)
-{
-	return KUIDT_INIT(from_kuid(mnt_userns, kuid));
-}
-/**
- * kgid_from_mnt - map a kgid up into a mnt_userns
- * @mnt_userns: user namespace of the relevant mount
- * @kgid: kgid to be mapped
- *
- * Return: @kgid mapped up according to @mnt_userns.
- * If @kgid has no mapping INVALID_GID is returned.
- */
-static inline kgid_t kgid_from_mnt(struct user_namespace *mnt_userns,
-				   kgid_t kgid)
-{
-	return KGIDT_INIT(from_kgid(mnt_userns, kgid));
-}
-/**
- * mapped_fsuid - return caller's fsuid mapped up into a mnt_userns
- * @mnt_userns: user namespace of the relevant mount
- *
- * Use this helper to initialize a new vfs or filesystem object based on
- * the caller's fsuid. A common example is initializing the i_uid field of
- * a newly allocated inode triggered by a creation event such as mkdir or
- * O_CREAT. Other examples include the allocation of quotas for a specific
- * user.
- *
- * Return: the caller's current fsuid mapped up according to @mnt_userns.
- */
-static inline kuid_t mapped_fsuid(struct user_namespace *mnt_userns)
-{
-	return kuid_from_mnt(mnt_userns, current_fsuid());
-}
-/**
- * mapped_fsgid - return caller's fsgid mapped up into a mnt_userns
- * @mnt_userns: user namespace of the relevant mount
- *
- * Use this helper to initialize a new vfs or filesystem object based on
- * the caller's fsgid. A common example is initializing the i_gid field of
- * a newly allocated inode triggered by a creation event such as mkdir or
- * O_CREAT. Other examples include the allocation of quotas for a specific
- * user.
- *
- * Return: the caller's current fsgid mapped up according to @mnt_userns.
- */
-static inline kgid_t mapped_fsgid(struct user_namespace *mnt_userns)
-{
-	return kgid_from_mnt(mnt_userns, current_fsgid());
 }
 /**
 static inline void inode_fsuid_set(struct inode *inode,
 				   struct user_namespace *mnt_userns)
 {
-	inode->i_uid = mapped_fsuid(mnt_userns);
+	inode->i_uid = mapped_fsuid(mnt_userns, i_user_ns(inode));
 }
 /**
 static inline void inode_fsgid_set(struct inode *inode,
 				   struct user_namespace *mnt_userns)
 {
-	inode->i_gid = mapped_fsgid(mnt_userns);
+	inode->i_gid = mapped_fsgid(mnt_userns, i_user_ns(inode));
 }
 /**
 static inline bool fsuidgid_has_mapping(struct super_block *sb,
 					struct user_namespace *mnt_userns)
 {
-	struct user_namespace *s_user_ns = sb->s_user_ns;
+	struct user_namespace *fs_userns = sb->s_user_ns;
+	kuid_t kuid;
+	kgid_t kgid;
-	return kuid_has_mapping(s_user_ns, mapped_fsuid(mnt_userns)) &&
+	kuid = mapped_fsuid(mnt_userns, fs_userns);
-	       kgid_has_mapping(s_user_ns, mapped_fsgid(mnt_userns));
+	if (!uid_valid(kuid))
+		return false;
+	kgid = mapped_fsgid(mnt_userns, fs_userns);
+	if (!gid_valid(kgid))
+		return false;
+	return kuid_has_mapping(fs_userns, kuid) &&
+	       kgid_has_mapping(fs_userns, kgid);
 }
 extern struct timespec64 current_time(struct inode *inode);
 {
 	return mnt_user_ns(file->f_path.mnt);
 }
+/**
+ * is_idmapped_mnt - check whether a mount is mapped
+ * @mnt: the mount to check
+ *
+ * If @mnt has an idmapping attached different from the
+ * filesystem's idmapping then @mnt is mapped.
+ *
+ * Return: true if mount is mapped, false if not.
+ */
+static inline bool is_idmapped_mnt(const struct vfsmount *mnt)
+{
+	return mnt_user_ns(mnt) != mnt->mnt_sb->s_user_ns;
+}
 extern long vfs_truncate(const struct path *, loff_t);
 int do_truncate(struct user_namespace *, struct dentry *, loff_t start,
 		unsigned int time_attrs, struct file *filp);

include/linux/mnt_idmapping.h+234−0

@@ -0,0 +1,234 @@
	1	/* SPDX-License-Identifier: GPL-2.0 */
	2	#ifndef _LINUX_MNT_IDMAPPING_H
	3	#define _LINUX_MNT_IDMAPPING_H
	4
	5	#include <linux/types.h>
	6	#include <linux/uidgid.h>
	7
	8	struct user_namespace;
	9	/*
	10	* Carries the initial idmapping of 0:0:4294967295 which is an identity
	11	* mapping. This means that {g,u}id 0 is mapped to {g,u}id 0, {g,u}id 1 is
	12	* mapped to {g,u}id 1, [...], {g,u}id 1000 to {g,u}id 1000, [...].
	13	*/
	14	extern struct user_namespace init_user_ns;
	15
	16	/**
	17	* initial_idmapping - check whether this is the initial mapping
	18	* @ns: idmapping to check
	19	*
	20	* Check whether this is the initial mapping, mapping 0 to 0, 1 to 1,
	21	* [...], 1000 to 1000 [...].
	22	*
	23	* Return: true if this is the initial mapping, false if not.
	24	*/
	25	static inline bool initial_idmapping(const struct user_namespace *ns)
	26	{
	27	return ns == &init_user_ns;
	28	}
	29
	30	/**
	31	* no_idmapping - check whether we can skip remapping a kuid/gid
	32	* @mnt_userns: the mount's idmapping
	33	* @fs_userns: the filesystem's idmapping
	34	*
	35	* This function can be used to check whether a remapping between two
	36	* idmappings is required.
	37	* An idmapped mount is a mount that has an idmapping attached to it that
	38	* is different from the filsystem's idmapping and the initial idmapping.
	39	* If the initial mapping is used or the idmapping of the mount and the
	40	* filesystem are identical no remapping is required.
	41	*
	42	* Return: true if remapping can be skipped, false if not.
	43	*/
	44	static inline bool no_idmapping(const struct user_namespace *mnt_userns,
	45	const struct user_namespace *fs_userns)
	46	{
	47	return initial_idmapping(mnt_userns) \|\| mnt_userns == fs_userns;
	48	}
	49
	50	/**
	51	* mapped_kuid_fs - map a filesystem kuid into a mnt_userns
	52	* @mnt_userns: the mount's idmapping
	53	* @fs_userns: the filesystem's idmapping
	54	* @kuid : kuid to be mapped
	55	*
	56	* Take a @kuid and remap it from @fs_userns into @mnt_userns. Use this
	57	* function when preparing a @kuid to be reported to userspace.
	58	*
	59	* If no_idmapping() determines that this is not an idmapped mount we can
	60	* simply return @kuid unchanged.
	61	* If initial_idmapping() tells us that the filesystem is not mounted with an
	62	* idmapping we know the value of @kuid won't change when calling
	63	* from_kuid() so we can simply retrieve the value via __kuid_val()
	64	* directly.
	65	*
	66	* Return: @kuid mapped according to @mnt_userns.
	67	* If @kuid has no mapping in either @mnt_userns or @fs_userns INVALID_UID is
	68	* returned.
	69	*/
	70	static inline kuid_t mapped_kuid_fs(struct user_namespace *mnt_userns,
	71	struct user_namespace *fs_userns,
	72	kuid_t kuid)
	73	{
	74	uid_t uid;
	75
	76	if (no_idmapping(mnt_userns, fs_userns))
	77	return kuid;
	78	if (initial_idmapping(fs_userns))
	79	uid = __kuid_val(kuid);
	80	else
	81	uid = from_kuid(fs_userns, kuid);
	82	if (uid == (uid_t)-1)
	83	return INVALID_UID;
	84	return make_kuid(mnt_userns, uid);
	85	}
	86
	87	/**
	88	* mapped_kgid_fs - map a filesystem kgid into a mnt_userns
	89	* @mnt_userns: the mount's idmapping
	90	* @fs_userns: the filesystem's idmapping
	91	* @kgid : kgid to be mapped
	92	*
	93	* Take a @kgid and remap it from @fs_userns into @mnt_userns. Use this
	94	* function when preparing a @kgid to be reported to userspace.
	95	*
	96	* If no_idmapping() determines that this is not an idmapped mount we can
	97	* simply return @kgid unchanged.
	98	* If initial_idmapping() tells us that the filesystem is not mounted with an
	99	* idmapping we know the value of @kgid won't change when calling
	100	* from_kgid() so we can simply retrieve the value via __kgid_val()
	101	* directly.
	102	*
	103	* Return: @kgid mapped according to @mnt_userns.
	104	* If @kgid has no mapping in either @mnt_userns or @fs_userns INVALID_GID is
	105	* returned.
	106	*/
	107	static inline kgid_t mapped_kgid_fs(struct user_namespace *mnt_userns,
	108	struct user_namespace *fs_userns,
	109	kgid_t kgid)
	110	{
	111	gid_t gid;
	112
	113	if (no_idmapping(mnt_userns, fs_userns))
	114	return kgid;
	115	if (initial_idmapping(fs_userns))
	116	gid = __kgid_val(kgid);
	117	else
	118	gid = from_kgid(fs_userns, kgid);
	119	if (gid == (gid_t)-1)
	120	return INVALID_GID;
	121	return make_kgid(mnt_userns, gid);
	122	}
	123
	124	/**
	125	* mapped_kuid_user - map a user kuid into a mnt_userns
	126	* @mnt_userns: the mount's idmapping
	127	* @fs_userns: the filesystem's idmapping
	128	* @kuid : kuid to be mapped
	129	*
	130	* Use the idmapping of @mnt_userns to remap a @kuid into @fs_userns. Use this
	131	* function when preparing a @kuid to be written to disk or inode.
	132	*
	133	* If no_idmapping() determines that this is not an idmapped mount we can
	134	* simply return @kuid unchanged.
	135	* If initial_idmapping() tells us that the filesystem is not mounted with an
	136	* idmapping we know the value of @kuid won't change when calling
	137	* make_kuid() so we can simply retrieve the value via KUIDT_INIT()
	138	* directly.
	139	*
	140	* Return: @kuid mapped according to @mnt_userns.
	141	* If @kuid has no mapping in either @mnt_userns or @fs_userns INVALID_UID is
	142	* returned.
	143	*/
	144	static inline kuid_t mapped_kuid_user(struct user_namespace *mnt_userns,
	145	struct user_namespace *fs_userns,
	146	kuid_t kuid)
	147	{
	148	uid_t uid;
	149
	150	if (no_idmapping(mnt_userns, fs_userns))
	151	return kuid;
	152	uid = from_kuid(mnt_userns, kuid);
	153	if (uid == (uid_t)-1)
	154	return INVALID_UID;
	155	if (initial_idmapping(fs_userns))
	156	return KUIDT_INIT(uid);
	157	return make_kuid(fs_userns, uid);
	158	}
	159
	160	/**
	161	* mapped_kgid_user - map a user kgid into a mnt_userns
	162	* @mnt_userns: the mount's idmapping
	163	* @fs_userns: the filesystem's idmapping
	164	* @kgid : kgid to be mapped
	165	*
	166	* Use the idmapping of @mnt_userns to remap a @kgid into @fs_userns. Use this
	167	* function when preparing a @kgid to be written to disk or inode.
	168	*
	169	* If no_idmapping() determines that this is not an idmapped mount we can
	170	* simply return @kgid unchanged.
	171	* If initial_idmapping() tells us that the filesystem is not mounted with an
	172	* idmapping we know the value of @kgid won't change when calling
	173	* make_kgid() so we can simply retrieve the value via KGIDT_INIT()
	174	* directly.
	175	*
	176	* Return: @kgid mapped according to @mnt_userns.
	177	* If @kgid has no mapping in either @mnt_userns or @fs_userns INVALID_GID is
	178	* returned.
	179	*/
	180	static inline kgid_t mapped_kgid_user(struct user_namespace *mnt_userns,
	181	struct user_namespace *fs_userns,
	182	kgid_t kgid)
	183	{
	184	gid_t gid;
	185
	186	if (no_idmapping(mnt_userns, fs_userns))
	187	return kgid;
	188	gid = from_kgid(mnt_userns, kgid);
	189	if (gid == (gid_t)-1)
	190	return INVALID_GID;
	191	if (initial_idmapping(fs_userns))
	192	return KGIDT_INIT(gid);
	193	return make_kgid(fs_userns, gid);
	194	}
	195
	196	/**
	197	* mapped_fsuid - return caller's fsuid mapped up into a mnt_userns
	198	* @mnt_userns: the mount's idmapping
	199	* @fs_userns: the filesystem's idmapping
	200	*
	201	* Use this helper to initialize a new vfs or filesystem object based on
	202	* the caller's fsuid. A common example is initializing the i_uid field of
	203	* a newly allocated inode triggered by a creation event such as mkdir or
	204	* O_CREAT. Other examples include the allocation of quotas for a specific
	205	* user.
	206	*
	207	* Return: the caller's current fsuid mapped up according to @mnt_userns.
	208	*/
	209	static inline kuid_t mapped_fsuid(struct user_namespace *mnt_userns,
	210	struct user_namespace *fs_userns)
	211	{
	212	return mapped_kuid_user(mnt_userns, fs_userns, current_fsuid());
	213	}
	214
	215	/**
	216	* mapped_fsgid - return caller's fsgid mapped up into a mnt_userns
	217	* @mnt_userns: the mount's idmapping
	218	* @fs_userns: the filesystem's idmapping
	219	*
	220	* Use this helper to initialize a new vfs or filesystem object based on
	221	* the caller's fsgid. A common example is initializing the i_gid field of
	222	* a newly allocated inode triggered by a creation event such as mkdir or
	223	* O_CREAT. Other examples include the allocation of quotas for a specific
	224	* user.
	225	*
	226	* Return: the caller's current fsgid mapped up according to @mnt_userns.
	227	*/
	228	static inline kgid_t mapped_fsgid(struct user_namespace *mnt_userns,
	229	struct user_namespace *fs_userns)
	230	{
	231	return mapped_kgid_user(mnt_userns, fs_userns, current_fsgid());
	232	}
	233
	234	#endif /* _LINUX_MNT_IDMAPPING_H */

security/commoncap.c+9−6

 #include <linux/user_namespace.h>
 #include <linux/binfmts.h>
 #include <linux/personality.h>
+#include <linux/mnt_idmapping.h>
 /*
  * If a non-root user executes a setuid-root binary in
 	kroot = make_kuid(fs_ns, root);
 	/* If this is an idmapped mount shift the kuid. */
-	kroot = kuid_into_mnt(mnt_userns, kroot);
+	kroot = mapped_kuid_fs(mnt_userns, fs_ns, kroot);
 	/* If the root kuid maps to a valid uid in current ns, then return
 	 * this as a nscap. */
  * @size:	size of @ivalue
  * @task_ns:	user namespace of the caller
  * @mnt_userns:	user namespace of the mount the inode was found from
+ * @fs_userns:	user namespace of the filesystem
  *
  * If the inode has been found through an idmapped mount the user namespace of
  * the vfsmount must be passed through @mnt_userns. This function will then
  */
 static kuid_t rootid_from_xattr(const void *value, size_t size,
 				struct user_namespace *task_ns,
-				struct user_namespace *mnt_userns)
+				struct user_namespace *mnt_userns,
+				struct user_namespace *fs_userns)
 {
 	const struct vfs_ns_cap_data *nscap = value;
 	kuid_t rootkid;
 		rootid = le32_to_cpu(nscap->rootid);
 	rootkid = make_kuid(task_ns, rootid);
-	return kuid_from_mnt(mnt_userns, rootkid);
+	return mapped_kuid_user(mnt_userns, fs_userns, rootkid);
 }
 static bool validheader(size_t size, const struct vfs_cap_data *cap)
 		return -EINVAL;
 	if (!capable_wrt_inode_uidgid(mnt_userns, inode, CAP_SETFCAP))
 		return -EPERM;
-	if (size == XATTR_CAPS_SZ_2 && (mnt_userns == &init_user_ns))
+	if (size == XATTR_CAPS_SZ_2 && (mnt_userns == fs_ns))
 		if (ns_capable(inode->i_sb->s_user_ns, CAP_SETFCAP))
 			/* user is privileged, just write the v2 */
 			return size;
-	rootid = rootid_from_xattr(*ivalue, size, task_ns, mnt_userns);
+	rootid = rootid_from_xattr(*ivalue, size, task_ns, mnt_userns, fs_ns);
 	if (!uid_valid(rootid))
 		return -EINVAL;
 	/* Limit the caps to the mounter of the filesystem
 	 * or the more limited uid specified in the xattr.
 	 */
-	rootkuid = kuid_into_mnt(mnt_userns, rootkuid);
+	rootkuid = mapped_kuid_fs(mnt_userns, fs_ns, rootkuid);
 	if (!rootid_owns_currentns(rootkuid))
 		return -ENODATA;

Merge tag 'fs.idmapped.v5.17' of git://git.kernel.org/pub/scm/linux/kernel/git/brauner/linux

Keyboard shortcuts

General

Issues and pull requests

Issues, pull requests and Inbox

Repository code