Gh0st
/
linux
mirror of https://github.com/torvalds/linux.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

ovl: pass original credentials, not mounter credentials during create 

When creating new files the security layer expects the original
credentials to be passed.  When cleaning up the code this was accidently
changed to pass the mounter's credentials by relying on current->cred
which is already overriden at this point.  Pass the original credentials
directly.

Reported-by: Ondrej Mosnacek <omosnace@redhat.com>
Reported-by: Paul Moore <paul@paul-moore.com>
Fixes: e566bff963 ("ovl: port ovl_create_or_link() to new ovl_override_creator_creds")
Link: https://lore.kernel.org/CAFqZXNvL1ciLXMhHrnoyBmQu1PAApH41LkSWEhrcvzAAbFij8Q@mail.gmail.com
Signed-off-by: Christian Brauner <brauner@kernel.org>
Tested-by: Ondrej Mosnacek <omosnace@redhat.com>
Reviewed-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This commit is contained in:
Christian Brauner 2025-12-05 13:10:48 +01:00 committed by Linus Torvalds
parent 4b9d25b4d3
commit 87c9e88ac4
1 changed files with 12 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
fs/overlayfs/dir.c
View File

@ -581,7 +581,8 @@ static int ovl_create_over_whiteout(struct dentry *dentry, struct inode *inode,
goto out_dput;
}
static const struct cred *ovl_override_creator_creds(struct dentry *dentry, struct inode *inode, umode_t mode)
static const struct cred *ovl_override_creator_creds(const struct cred *original_creds,
struct dentry *dentry, struct inode *inode, umode_t mode)
{
int err;
@ -596,7 +597,7 @@ static const struct cred *ovl_override_creator_creds(struct dentry *dentry, stru
override_cred->fsgid = inode->i_gid;
err = security_dentry_create_files_as(dentry, mode, &dentry->d_name,
current->cred, override_cred);
original_creds, override_cred);
if (err)
return ERR_PTR(err);
@ -614,8 +615,11 @@ static void ovl_revert_creator_creds(const struct cred *old_cred)
DEFINE_CLASS(ovl_override_creator_creds,
const struct cred *,
if (!IS_ERR_OR_NULL(_T)) ovl_revert_creator_creds(_T),
ovl_override_creator_creds(dentry, inode, mode),
struct dentry *dentry, struct inode *inode, umode_t mode)
ovl_override_creator_creds(original_creds, dentry, inode, mode),
const struct cred *original_creds,
struct dentry *dentry,
struct inode *inode,
umode_t mode)
static int ovl_create_handle_whiteouts(struct dentry *dentry,
struct inode *inode,
@ -633,7 +637,7 @@ static int ovl_create_or_link(struct dentry *dentry, struct inode *inode,
int err;
struct dentry *parent = dentry->d_parent;
with_ovl_creds(dentry->d_sb) {
scoped_class(override_creds_ovl, original_creds, dentry->d_sb) {
/*
* When linking a file with copy up origin into a new parent, mark the
* new parent dir "impure".
@ -661,7 +665,7 @@ static int ovl_create_or_link(struct dentry *dentry, struct inode *inode,
if (attr->hardlink)
return ovl_create_handle_whiteouts(dentry, inode, attr);
scoped_class(ovl_override_creator_creds, cred, dentry, inode, attr->mode) {
scoped_class(ovl_override_creator_creds, cred, original_creds, dentry, inode, attr->mode) {
if (IS_ERR(cred))
return PTR_ERR(cred);
return ovl_create_handle_whiteouts(dentry, inode, attr);
@ -1364,8 +1368,8 @@ static int ovl_create_tmpfile(struct file *file, struct dentry *dentry,
int flags = file->f_flags | OVL_OPEN_FLAGS;
int err;
with_ovl_creds(dentry->d_sb) {
scoped_class(ovl_override_creator_creds, cred, dentry, inode, mode) {
scoped_class(override_creds_ovl, original_creds, dentry->d_sb) {
scoped_class(ovl_override_creator_creds, cred, original_creds, dentry, inode, mode) {
if (IS_ERR(cred))
return PTR_ERR(cred);