Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1431067
| From | ebiederm@xmission.com (Eric W. Biederman) |
|---|---|
| Newsgroups | linux.kernel |
| Subject | Re: [PATCH] orangefs: fix namespace handling |
| Date | 2016-06-25 06:50 +0200 |
| Message-ID | <rNNHz-WP-3@gated-at.bofh.it> (permalink) |
| References | <rNJaV-6nD-1@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
Jann Horn <jannh@google.com> writes:
> diff --git a/fs/orangefs/devorangefs-req.c b/fs/orangefs/devorangefs-req.c
> index db170be..a287a66 100644
> --- a/fs/orangefs/devorangefs-req.c
> +++ b/fs/orangefs/devorangefs-req.c
> @@ -116,6 +116,13 @@ static int orangefs_devreq_open(struct inode *inode, struct file *file)
> {
> int ret = -EINVAL;
>
> + /* in order to ensure that the filesystem driver sees correct UIDs */
> + if (file->f_cred->user_ns != &init_user_ns) {
> + gossip_err("%s: device cannot be opened outside init_user_ns\n",
> + __func__);
> + goto out;
> + }
> +
Not necessarily in this patch but the code should also verify that the
opener is also in the initial pid namespace as pids are transferred in
the upcalls as well.
> if (!(file->f_flags & O_NONBLOCK)) {
> gossip_err("%s: device cannot be opened in blocking mode\n",
> __func__);
Eric
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH] orangefs: fix namespace handling Jann Horn <jannh@google.com> - 2016-06-25 02:00 +0200
Re: [PATCH] orangefs: fix namespace handling ebiederm@xmission.com (Eric W. Biederman) - 2016-06-25 06:50 +0200
Re: [PATCH] orangefs: fix namespace handling Mike Marshall <hubcap@omnibond.com> - 2016-06-26 01:10 +0200
csiph-web