On Mon, May 6, 2019 at 1:51 PM Amir Goldstein <amir73il@xxxxxxxxx> wrote:
>
> On Mon, May 6, 2019 at 10:41 AM Jiufei Xue <jiufei.xue@xxxxxxxxxxxxxxxxx> wrote:
> >
> > We found that it return success when we set IMMUTABLE_FL flag to a
> > file in docker even though the docker didn't have the capability
> > CAP_LINUX_IMMUTABLE.
> >
> > The commit d1d04ef8572b ("ovl: stack file ops") and
> > dab5ca8fd9dd ("ovl: add lsattr/chattr support") implemented chattr
> > operations on a regular overlay file. ovl_real_ioctl() overridden the
> > current process's subjective credentials with ofs->creator_cred which
> > have the capability CAP_LINUX_IMMUTABLE so that it will return success
> > in vfs_ioctl()->cap_capable().
> >
> > Fix this by checking the capability before cred overriden. And here we
> > only care about APPEND_FL and IMMUTABLE_FL, so get these information from
> > inode.
>
> Good idea. My idea was less good ;-)
> See one minor comment below.
>
> Will you be able to write an xfstest to cover this bug?
> See for reference tests/generic/159 and tests/generic/099
>
To clarify, I mean a generic test that will pass on non-overlayfs
and fail when xfstests are run with check -overlay without your fix.
Thanks,
Amir.
