Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1555802

[PATCH v2] ovl: drop CAP_SYS_RESOURCE from saved mounter's credentials

Show all headers | View raw

If overlay was mounted by root then quota set for upper layer does not work
because overlay now always use mounter's credentials for operations.
Also overlay might deplete reserved space and inodes in ext4.

This patch drops capability SYS_RESOURCE from saved credentials.
This affects creation new files, whiteouts, and copy-up operations.

Signed-off-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
Fixes: 1175b6b8d963 ("ovl: do operations on underlying file system in mounter's context")
Cc: Vivek Goyal <vgoyal@redhat.com>
Cc: Miklos Szeredi <mszeredi@redhat.com>
---
 fs/overlayfs/super.c |    9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
index 20f48abbb82f..8dba982e1af5 100644
--- a/fs/overlayfs/super.c
+++ b/fs/overlayfs/super.c
@@ -701,6 +701,7 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent)
 	unsigned int stacklen = 0;
 	unsigned int i;
 	bool remote = false;
+	struct cred *cred;
 	int err;
 
 	err = -ENOMEM;
@@ -870,10 +871,14 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent)
 	else
 		sb->s_d_op = &ovl_dentry_operations;
 
-	ufs->creator_cred = prepare_creds();
-	if (!ufs->creator_cred)
+	cred = prepare_creds();
+	if (!cred)
 		goto out_put_lower_mnt;
 
+	/* Never override disk quota limits or use reserved space */
+	cap_lower(cred->cap_effective, CAP_SYS_RESOURCE);
+	ufs->creator_cred = cred;
+
 	err = -ENOMEM;
 	oe = ovl_alloc_entry(numlower);
 	if (!oe)

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH] ovl: do not ignore disk quota if current task is not  privileged Konstantin Khlebnikov <khlebnikov@yandex-team.ru> - 2017-01-10 12:40 +0100
  Re: [PATCH] ovl: do not ignore disk quota if current task is not  privileged Vivek Goyal <vgoyal@redhat.com> - 2017-01-10 15:50 +0100
    Re: [PATCH] ovl: do not ignore disk quota if current task is not privileged Miklos Szeredi <miklos@szeredi.hu> - 2017-01-10 17:00 +0100
      Re: [PATCH] ovl: do not ignore disk quota if current task is not  privileged Konstantin Khlebnikov <khlebnikov@yandex-team.ru> - 2017-01-10 17:40 +0100
        Re: [PATCH] ovl: do not ignore disk quota if current task is not privileged Amir Goldstein <amir73il@gmail.com> - 2017-01-10 19:20 +0100
          Re: [PATCH] ovl: do not ignore disk quota if current task is not  privileged Konstantin Khlebnikov <khlebnikov@yandex-team.ru> - 2017-01-10 19:40 +0100
  Re: [PATCH] ovl: do not ignore disk quota if current task is not  privileged Vivek Goyal <vgoyal@redhat.com> - 2017-01-10 17:10 +0100
    Re: [PATCH] ovl: do not ignore disk quota if current task is not  privileged Vivek Goyal <vgoyal@redhat.com> - 2017-01-10 17:40 +0100
      Re: [PATCH] ovl: do not ignore disk quota if current task is not  privileged Konstantin Khlebnikov <khlebnikov@yandex-team.ru> - 2017-01-10 17:50 +0100
    Re: [PATCH] ovl: do not ignore disk quota if current task is not  privileged Konstantin Khlebnikov <khlebnikov@yandex-team.ru> - 2017-01-10 17:40 +0100
  [PATCH v2] ovl: drop CAP_SYS_RESOURCE from saved mounter's  credentials Konstantin Khlebnikov <khlebnikov@yandex-team.ru> - 2017-01-10 19:40 +0100
    Re: [PATCH v2] ovl: drop CAP_SYS_RESOURCE from saved mounter's  credentials Vivek Goyal <vgoyal@redhat.com> - 2017-01-10 20:20 +0100

csiph-web