leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Revert "ovl: relax permission checking on underlying layers"

Browse Source 
This reverts commit 007ea44892.

The commit broke some selinux-testsuite cases, and it looks like there's no
straightforward fix keeping the direction of this patch, so revert for now.

The original patch was trying to fix the consistency of permission checks, and
not an observed bug.  So reverting should be safe.

Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
This commit is contained in:
Miklos Szeredi 2018-12-04 11:31:30 +01:00
parent 155b8a0492
commit ec7ba118b9
1 changed files with 4 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
fs/overlayfs/inode.c
View File

@ -286,22 +286,13 @@ int ovl_permission(struct inode *inode, int mask)
if (err)
return err;
/* No need to do any access on underlying for special files */
if (special_file(realinode->i_mode))
return 0;
/* No need to access underlying for execute */
mask &= ~MAY_EXEC;
if ((mask & (MAY_READ | MAY_WRITE)) == 0)
return 0;
/* Lower files get copied up, so turn write access into read */
if (!upperinode && mask & MAY_WRITE) {
old_cred = ovl_override_creds(inode->i_sb);
if (!upperinode &&
!special_file(realinode->i_mode) && mask & MAY_WRITE) {
mask &= ~(MAY_WRITE | MAY_APPEND);
/* Make sure mounter can read file for copy up later */
mask |= MAY_READ;
}
old_cred = ovl_override_creds(inode->i_sb);
err = inode_permission(realinode, mask);
revert_creds(old_cred);