lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Mon, 2 Nov 2020 14:23:38 +0100 From: Christian Brauner <christian.brauner@...ntu.com> To: Christoph Hellwig <hch@...radead.org> Cc: Alexander Viro <viro@...iv.linux.org.uk>, linux-fsdevel@...r.kernel.org, John Johansen <john.johansen@...onical.com>, James Morris <jmorris@...ei.org>, Mimi Zohar <zohar@...ux.ibm.com>, Dmitry Kasatkin <dmitry.kasatkin@...il.com>, Stephen Smalley <stephen.smalley.work@...il.com>, Casey Schaufler <casey@...aufler-ca.com>, Arnd Bergmann <arnd@...db.de>, Andreas Dilger <adilger.kernel@...ger.ca>, OGAWA Hirofumi <hirofumi@...l.parknet.co.jp>, Geoffrey Thomas <geofft@...reload.com>, Mrunal Patel <mpatel@...hat.com>, Josh Triplett <josh@...htriplett.org>, Andy Lutomirski <luto@...nel.org>, Amir Goldstein <amir73il@...il.com>, Miklos Szeredi <miklos@...redi.hu>, Theodore Tso <tytso@....edu>, Alban Crequy <alban@...volk.io>, Tycho Andersen <tycho@...ho.ws>, David Howells <dhowells@...hat.com>, James Bottomley <James.Bottomley@...senpartnership.com>, Jann Horn <jannh@...gle.com>, Seth Forshee <seth.forshee@...onical.com>, St??phane Graber <stgraber@...ntu.com>, Aleksa Sarai <cyphar@...har.com>, Lennart Poettering <lennart@...ttering.net>, "Eric W. Biederman" <ebiederm@...ssion.com>, smbarber@...omium.org, Phil Estes <estesp@...il.com>, Serge Hallyn <serge@...lyn.com>, Kees Cook <keescook@...omium.org>, Todd Kjos <tkjos@...gle.com>, Jonathan Corbet <corbet@....net>, containers@...ts.linux-foundation.org, linux-security-module@...r.kernel.org, linux-api@...r.kernel.org, linux-ext4@...r.kernel.org, linux-unionfs@...r.kernel.org, linux-audit@...hat.com, linux-integrity@...r.kernel.org, selinux@...r.kernel.org Subject: Re: [PATCH 07/34] capability: handle idmapped mounts On Sun, Nov 01, 2020 at 02:48:09PM +0000, Christoph Hellwig wrote: > > /** > > * capable_wrt_inode_uidgid - Check nsown_capable and uid and gid mapped > > * @inode: The inode in question > > @@ -501,9 +513,7 @@ bool privileged_wrt_inode_uidgid(struct user_namespace *ns, const struct inode * > > */ > > bool capable_wrt_inode_uidgid(const struct inode *inode, int cap) > > { > > + return capable_wrt_mapped_inode_uidgid(&init_user_ns, inode, cap); > > } > > EXPORT_SYMBOL(capable_wrt_inode_uidgid); > > Please avoid these silly wrappers and just switch all callers to pass > the namespaces instead of creating boilerplate code. Same for the other > functions where you do this even even worse the method calls. Christoph, Thanks for the review! Ok, so I'll switch: - all helpers to take an additional argument (capable_wrt_inode_uidgid()/inode_permission()/vfs_*() etc.) - all inode method calls to take an additional argument (I assume that's what you're referring to: ->create()/->mknod()/->mkdir() etc.) I've always assumed that this is what we'd be doing in the end anyway (I've mentioned it in the commit message for the inode_operations method's. This will be a bit of work but we can get that done!)
Powered by blists - more mailing lists