Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1345979

Re: [PATCH v2 1/1] OverlayFS: Fix checking permissions during lookup.

From Vivek Goyal <vgoyal@redhat.com>
Newsgroups linux.kernel
Subject Re: [PATCH v2 1/1] OverlayFS: Fix checking permissions during lookup.
Date 2016-02-29 17:40 +0100
Message-ID <r7z1x-5sW-33@gated-at.bofh.it> (permalink)
References <r5I8X-5nh-25@gated-at.bofh.it> <r6wyK-86V-15@gated-at.bofh.it> <r6KLn-1EZ-7@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

On Sat, Feb 27, 2016 at 01:40:02PM +0300, Nazarov Sergey wrote:
> 26.02.2016, 22:41, "Vivek Goyal" <vgoyal@redhat.com>:
> >
> > So what's the problem we are trying to solve. Why should we able to
> > override the DAC checks of lower layer if same directory in upper
> > is searchable for user but it is not searchable in lower layer.
> >
> 
> If I right, this is a one of the main feature of overlayfs - upper layer has priority over lower ones.
> Override AC checks necessary for lookup operation only. Lower layer files access AC checks
> remain, so this should not be a security problem.

So a directory which is not searchable by user in lower layer suddenly
becomes searchable once union is created. In fact there are two cases.
If upper layer directory does exist, then it is not searchable. If 
upper layer direcotry does exist with user having search permissions, then
lower layer directory should become searchable? May be, I don't know.

Thanks
Vivek

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH v2 1/1] OverlayFS: Fix checking permissions during lookup. Ignacy Gawędzki   <ignacy.gawedzki@green-communications.fr> - 2016-02-24 15:00 +0100
  Re: [PATCH v2 1/1] OverlayFS: Fix checking permissions during lookup. Vivek Goyal <vgoyal@redhat.com> - 2016-02-26 20:50 +0100
    Re: [PATCH v2 1/1] OverlayFS: Fix checking permissions during lookup. Nazarov Sergey <s-nazarov@yandex.ru> - 2016-02-27 12:00 +0100
      Re: [PATCH v2 1/1] OverlayFS: Fix checking permissions during lookup. Vivek Goyal <vgoyal@redhat.com> - 2016-02-29 17:40 +0100
    Re: [PATCH v2 1/1] OverlayFS: Fix checking permissions during lookup. Ignacy Gawędzki   <ignacy.gawedzki@green-communications.fr> - 2016-02-28 12:20 +0100
      Re: [PATCH v2 1/1] OverlayFS: Fix checking permissions during lookup. Vivek Goyal <vgoyal@redhat.com> - 2016-02-29 17:30 +0100
        Re: [PATCH v2 1/1] OverlayFS: Fix checking permissions during lookup. Ignacy Gawędzki   <ignacy.gawedzki@green-communications.fr> - 2016-02-29 18:00 +0100

csiph-web