diff options
| author | Vivek Goyal <vgoyal@redhat.com> | 2017-02-13 15:45:26 -0500 |
|---|---|---|
| committer | Eric W. Biederman <ebiederm@xmission.com> | 2017-02-14 20:51:12 +1300 |
| commit | fea6d2a610c899bb7fd8e95fcbf46900b886e5a3 (patch) | |
| tree | a23814b103e82b88222f67aaed11a493fd0f45d4 /fs/exec.c | |
| parent | d6cffbbe9a7e51eb705182965a189457c17ba8a3 (diff) | |
vfs: Use upper filesystem inode in bprm_fill_uid()
Right now bprm_fill_uid() uses inode fetched from file_inode(bprm->file).
This in turn returns inode of lower filesystem (in a stacked filesystem
setup).
I was playing with modified patches of shiftfs posted by james bottomley
and realized that through shiftfs setuid bit does not take effect. And
reason being that we fetch uid/gid from inode of lower fs (and not from
shiftfs inode). And that results in following checks failing.
/* We ignore suid/sgid if there are no mappings for them in the ns */
if (!kuid_has_mapping(bprm->cred->user_ns, uid) ||
!kgid_has_mapping(bprm->cred->user_ns, gid))
return;
uid/gid fetched from lower fs inode might not be mapped inside the user
namespace of container. So we need to look at uid/gid fetched from
upper filesystem (shiftfs in this particular case) and these should be
mapped and setuid bit can take affect.
Signed-off-by: Vivek Goyal <vgoyal@redhat.com>
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
Diffstat (limited to 'fs/exec.c')
| -rw-r--r-- | fs/exec.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/fs/exec.c b/fs/exec.c index c195ebb8e2aa..698a86094f76 100644 --- a/fs/exec.c +++ b/fs/exec.c @@ -1475,7 +1475,7 @@ static void bprm_fill_uid(struct linux_binprm *bprm) if (task_no_new_privs(current)) return; - inode = file_inode(bprm->file); + inode = bprm->file->f_path.dentry->d_inode; mode = READ_ONCE(inode->i_mode); if (!(mode & (S_ISUID|S_ISGID))) return; |