Unverified Commit 2bc5e5e8 authored by Christian Brauner's avatar Christian Brauner
Browse files

ovl: rely on SB_I_NOUMASK 

In commit f61b9bb3f838 ("fs: add a new SB_I_NOUMASK flag") we added a
new SB_I_NOUMASK flag that is used by filesystems like NFS to indicate
that umask stripping is never supposed to be done in the vfs independent
of whether or not POSIX ACLs are supported.

Overlayfs falls into the same category as it raises SB_POSIXACL
unconditionally to defer umask application to the upper filesystem.

Now that we have SB_I_NOUMASK use that and make SB_POSIXACL properly
conditional on whether or not the kernel does have support for it. This
will enable use to turn IS_POSIXACL() into nop on kernels that don't
have POSIX ACL support avoding bugs from missed umask stripping.

Link: https://lore.kernel.org/r/20231012-einband-uferpromenade-80541a047a1f@brauner


Acked-by: default avatarAmir Goldstein <amir73il@gmail.com>
Signed-off-by: default avatarChristian Brauner <brauner@kernel.org>
parent e4e8b47a

fs/overlayfs/super.c

+8 −0
Original line number Diff line number Diff line
@@ -1489,8 +1489,16 @@ int ovl_fill_super(struct super_block *sb, struct fs_context *fc) 
	sb->s_xattr = ofs->config.userxattr ? ovl_user_xattr_handlers :

		ovl_trusted_xattr_handlers;

	sb->s_fs_info = ofs;

#ifdef CONFIG_FS_POSIX_ACL

	sb->s_flags |= SB_POSIXACL;

#endif

	sb->s_iflags |= SB_I_SKIP_SYNC | SB_I_IMA_UNVERIFIABLE_SIGNATURE;

	/*

	 * Ensure that umask handling is done by the filesystems used

	 * for the the upper layer instead of overlayfs as that would

	 * lead to unexpected results.

	 */

	sb->s_iflags |= SB_I_NOUMASK;



	err = -ENOMEM;

	root_dentry = ovl_get_root(sb, ctx->upper.dentry, oe);