OpenE2K
/
linux
6
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Revert 95ebabde382c ("capabilities: Don't allow writing ambiguous v3 file capabilities") 

commit 3b0c2d3eaa83da259d7726192cf55a137769012f upstream.

It turns out that there are in fact userspace implementations that
care and this recent change caused a regression.

https://github.com/containers/buildah/issues/3071

As the motivation for the original change was future development,
and the impact is existing real world code just revert this change
and allow the ambiguity in v3 file caps.

Cc: stable@vger.kernel.org
Fixes: 95ebabde382c ("capabilities: Don't allow writing ambiguous v3 file capabilities")
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Eric W. Biederman 2021-03-12 15:07:09 -06:00 committed by Greg Kroah-Hartman
parent ac85e7d4ab
commit 47a5d1b63f
1 changed files with 1 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
security/commoncap.c
View File

@ -500,8 +500,7 @@ int cap_convert_nscap(struct dentry *dentry, void **ivalue, size_t size)
__u32 magic, nsmagic; __u32 magic, nsmagic;
struct inode *inode = d_backing_inode(dentry); struct inode *inode = d_backing_inode(dentry);
struct user_namespace *task_ns = current_user_ns(), struct user_namespace *task_ns = current_user_ns(),
*fs_ns = inode->i_sb->s_user_ns, *fs_ns = inode->i_sb->s_user_ns;
*ancestor;
kuid_t rootid; kuid_t rootid;
size_t newsize; size_t newsize;
@ -524,15 +523,6 @@ int cap_convert_nscap(struct dentry *dentry, void **ivalue, size_t size)
if (nsrootid == -1) if (nsrootid == -1)
return -EINVAL; return -EINVAL;
/*
* Do not allow allow adding a v3 filesystem capability xattr
* if the rootid field is ambiguous.
*/
for (ancestor = task_ns->parent; ancestor; ancestor = ancestor->parent) {
if (from_kuid(ancestor, rootid) == 0)
return -EINVAL;
}
newsize = sizeof(struct vfs_ns_cap_data); newsize = sizeof(struct vfs_ns_cap_data);
nscap = kmalloc(newsize, GFP_ATOMIC); nscap = kmalloc(newsize, GFP_ATOMIC);
if (!nscap) if (!nscap)