Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1284217

Re: [PATCH 14/19] fs: Permit FIBMAP for users with CAP_SYS_RAWIO in s_user_ns

Show all headers | View raw

On Fri, Dec 04, 2015 at 02:07:36PM -0600, Serge E. Hallyn wrote:
> Heh, I was looking over http://www.gossamer-threads.com/lists/linux/kernel/103611
> a little while ago :)  The same question was asked 16 years ago.  Apparently
> the answer then was that it was easier than fixing the code.

So it seems then that either it still isn't safe and so unprivileged
users shouldn't be allowed to do it at all, or else it's safe and we
should drop the requirement completely. I can't say which is right,
unfortunately.

> 
> Quoting Theodore Ts'o (tytso@mit.edu):
> > The fact that we need CAP_SYS_RAIO for FIBMAP is pretty silly, given
> > that FIEMAP does not require privileges --- and in fact the preferred
> > interface.  Why not just simply drop the requirement for privileges
> > for FIBMAP?
> > 
> > (Seth, Serge, this isn't a real objection to your patch; but the fact
> > that FIBMAP requires root has always been a bit silly, and this would
> > be a great opportunity to simplify things a bit.)
> > 
> > 						- Ted
> > 						
> > 
> > On Fri, Dec 04, 2015 at 01:11:43PM -0600, Serge E. Hallyn wrote:
> > > Quoting Seth Forshee (seth.forshee@canonical.com):
> > > > Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
> > > 
> > > Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
> > > 
> > > > ---
> > > >  fs/ioctl.c | 2 +-
> > > >  1 file changed, 1 insertion(+), 1 deletion(-)
> > > > 
> > > > diff --git a/fs/ioctl.c b/fs/ioctl.c
> > > > index 5d01d2638ca5..45c371bed7ee 100644
> > > > --- a/fs/ioctl.c
> > > > +++ b/fs/ioctl.c
> > > > @@ -55,7 +55,7 @@ static int ioctl_fibmap(struct file *filp, int __user *p)
> > > >  	/* do we support this mess? */
> > > >  	if (!mapping->a_ops->bmap)
> > > >  		return -EINVAL;
> > > > -	if (!capable(CAP_SYS_RAWIO))
> > > > +	if (!ns_capable(filp->f_inode->i_sb->s_user_ns, CAP_SYS_RAWIO))
> > > >  		return -EPERM;
> > > >  	res = get_user(block, p);
> > > >  	if (res)
> > > > -- 
> > > > 1.9.1
> > > > 
> > > > --
> > > > To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> > > > the body of a message to majordomo@vger.kernel.org
> > > > More majordomo info at  http://vger.kernel.org/majordomo-info.html
> > > > Please read the FAQ at  http://www.tux.org/lkml/
> > > --
> > > To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in
> > > the body of a message to majordomo@vger.kernel.org
> > > More majordomo info at  http://vger.kernel.org/majordomo-info.html
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 14/19] fs: Permit FIBMAP for users with CAP_SYS_RAWIO in s_user_ns Seth Forshee <seth.forshee@canonical.com> - 2015-12-02 16:50 +0100
  Re: [PATCH 14/19] fs: Permit FIBMAP for users with CAP_SYS_RAWIO in  s_user_ns "Serge E. Hallyn" <serge@hallyn.com> - 2015-12-04 21:10 +0100
    Re: [PATCH 14/19] fs: Permit FIBMAP for users with CAP_SYS_RAWIO in  s_user_ns Seth Forshee <seth.forshee@canonical.com> - 2015-12-04 21:50 +0100
      Re: [PATCH 14/19] fs: Permit FIBMAP for users with CAP_SYS_RAWIO in  s_user_ns Theodore Ts'o <tytso@mit.edu> - 2015-12-05 00:20 +0100
        Re: [PATCH 14/19] fs: Permit FIBMAP for users with CAP_SYS_RAWIO in  s_user_ns "Serge E. Hallyn" <serge.hallyn@ubuntu.com> - 2015-12-05 00:50 +0100
          Re: [PATCH 14/19] fs: Permit FIBMAP for users with CAP_SYS_RAWIO in  s_user_ns Seth Forshee <seth.forshee@canonical.com> - 2015-12-05 07:20 +0100
        Re: [PATCH 14/19] fs: Permit FIBMAP for users with CAP_SYS_RAWIO in s_user_ns Andreas Dilger <adilger@dilger.ca> - 2015-12-05 01:10 +0100
  Re: [PATCH 14/19] fs: Permit FIBMAP for users with CAP_SYS_RAWIO in  s_user_ns Theodore Ts'o <tytso@mit.edu> - 2015-12-04 21:10 +0100

csiph-web