Commit 87c9e88a authored by Christian Brauner's avatar Christian Brauner Committed by Linus Torvalds
Browse files

ovl: pass original credentials, not mounter credentials during create 



When creating new files the security layer expects the original
credentials to be passed.  When cleaning up the code this was accidently
changed to pass the mounter's credentials by relying on current->cred
which is already overriden at this point.  Pass the original credentials
directly.

Reported-by: default avatarOndrej Mosnacek <omosnace@redhat.com>
Reported-by: default avatarPaul Moore <paul@paul-moore.com>
Fixes: e566bff9 ("ovl: port ovl_create_or_link() to new ovl_override_creator_creds")
Link: https://lore.kernel.org/CAFqZXNvL1ciLXMhHrnoyBmQu1PAApH41LkSWEhrcvzAAbFij8Q@mail.gmail.com


Signed-off-by: default avatarChristian Brauner <brauner@kernel.org>
Tested-by: default avatarOndrej Mosnacek <omosnace@redhat.com>
Reviewed-by: default avatarAmir Goldstein <amir73il@gmail.com>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 4b9d25b4

fs/overlayfs/dir.c

+12 −8
Original line number Diff line number Diff line
@@ -581,7 +581,8 @@ static int ovl_create_over_whiteout(struct dentry *dentry, struct inode *inode, 
	goto out_dput;

}



static const struct cred *ovl_override_creator_creds(struct dentry *dentry, struct inode *inode, umode_t mode)

static const struct cred *ovl_override_creator_creds(const struct cred *original_creds,

						     struct dentry *dentry, struct inode *inode, umode_t mode)

{

	int err;
@@ -596,7 +597,7 @@ static const struct cred *ovl_override_creator_creds(struct dentry *dentry, stru 
	override_cred->fsgid = inode->i_gid;



	err = security_dentry_create_files_as(dentry, mode, &dentry->d_name,

					      current->cred, override_cred);

					      original_creds, override_cred);

	if (err)

		return ERR_PTR(err);
@@ -614,8 +615,11 @@ static void ovl_revert_creator_creds(const struct cred *old_cred) 
DEFINE_CLASS(ovl_override_creator_creds,

	     const struct cred *,

	     if (!IS_ERR_OR_NULL(_T)) ovl_revert_creator_creds(_T),

	     ovl_override_creator_creds(dentry, inode, mode),

	     struct dentry *dentry, struct inode *inode, umode_t mode)

	     ovl_override_creator_creds(original_creds, dentry, inode, mode),

	     const struct cred *original_creds,

	     struct dentry *dentry,

	     struct inode *inode,

	     umode_t mode)



static int ovl_create_handle_whiteouts(struct dentry *dentry,

				       struct inode *inode,
@@ -633,7 +637,7 @@ static int ovl_create_or_link(struct dentry *dentry, struct inode *inode, 
	int err;

	struct dentry *parent = dentry->d_parent;



	with_ovl_creds(dentry->d_sb) {

	scoped_class(override_creds_ovl, original_creds, dentry->d_sb) {

		/*

		 * When linking a file with copy up origin into a new parent, mark the

		 * new parent dir "impure".
@@ -661,7 +665,7 @@ static int ovl_create_or_link(struct dentry *dentry, struct inode *inode, 
		if (attr->hardlink)

			return ovl_create_handle_whiteouts(dentry, inode, attr);



		scoped_class(ovl_override_creator_creds, cred, dentry, inode, attr->mode) {

		scoped_class(ovl_override_creator_creds, cred, original_creds, dentry, inode, attr->mode) {

			if (IS_ERR(cred))

				return PTR_ERR(cred);

			return ovl_create_handle_whiteouts(dentry, inode, attr);
@@ -1364,8 +1368,8 @@ static int ovl_create_tmpfile(struct file *file, struct dentry *dentry, 
	int flags = file->f_flags | OVL_OPEN_FLAGS;

	int err;



	with_ovl_creds(dentry->d_sb) {

		scoped_class(ovl_override_creator_creds, cred, dentry, inode, mode) {

	scoped_class(override_creds_ovl, original_creds, dentry->d_sb) {

		scoped_class(ovl_override_creator_creds, cred, original_creds, dentry, inode, mode) {

			if (IS_ERR(cred))

				return PTR_ERR(cred);