The rootid is a kuid_t, but it contains an id which maped into a mount
idmapping, so it is really a vfsuid. This is confusing and creates
potential for misuse of the value, so change it to vfsuid_t.
Acked-by: Paul Moore <paul@xxxxxxxxxxxxxx>
Signed-off-by: Seth Forshee (DigitalOcean) <sforshee@xxxxxxxxxx>
---
include/linux/capability.h | 3 ++-
kernel/auditsc.c | 5 +++--
security/commoncap.c | 2 +-
3 files changed, 6 insertions(+), 4 deletions(-)
diff --git a/include/linux/capability.h b/include/linux/capability.h
index c24477e660fc..eb46d346bbbc 100644
--- a/include/linux/capability.h
+++ b/include/linux/capability.h
@@ -16,6 +16,7 @@
#include <uapi/linux/capability.h>
#include <linux/uidgid.h>
#include <linux/bits.h>
+#include <linux/vfsid.h>
#define _KERNEL_CAPABILITY_VERSION _LINUX_CAPABILITY_VERSION_3
@@ -26,7 +27,7 @@ typedef struct { u64 val; } kernel_cap_t;
/* same as vfs_ns_cap_data but in cpu endian and always filled completely */
struct vfs_caps {
__u32 magic_etc;
- kuid_t rootid;
+ vfsuid_t rootid;
kernel_cap_t permitted;
kernel_cap_t inheritable;
};
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 783d0bf69ca5..65691450b080 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -65,6 +65,7 @@
#include <uapi/linux/netfilter/nf_tables.h>
#include <uapi/linux/openat2.h> // struct open_how
#include <uapi/linux/fanotify.h>
+#include <linux/mnt_idmapping.h>
#include "audit.h"
@@ -2260,7 +2261,7 @@ static inline int audit_copy_fcaps(struct audit_names *name,
name->fcap.permitted = caps.permitted;
name->fcap.inheritable = caps.inheritable;
name->fcap.fE = !!(caps.magic_etc & VFS_CAP_FLAGS_EFFECTIVE);
- name->fcap.rootid = caps.rootid;
+ name->fcap.rootid = AS_KUIDT(caps.rootid);
name->fcap_ver = (caps.magic_etc & VFS_CAP_REVISION_MASK) >>
VFS_CAP_REVISION_SHIFT;
@@ -2816,7 +2817,7 @@ int __audit_log_bprm_fcaps(struct linux_binprm *bprm,
ax->fcap.permitted = vcaps.permitted;
ax->fcap.inheritable = vcaps.inheritable;
ax->fcap.fE = !!(vcaps.magic_etc & VFS_CAP_FLAGS_EFFECTIVE);
- ax->fcap.rootid = vcaps.rootid;
+ ax->fcap.rootid = AS_KUIDT(vcaps.rootid);
ax->fcap_ver = (vcaps.magic_etc & VFS_CAP_REVISION_MASK) >> VFS_CAP_REVISION_SHIFT;
ax->old_pcap.permitted = old->cap_permitted;
diff --git a/security/commoncap.c b/security/commoncap.c
index 7cda247dc7e9..a0b5c9740759 100644
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -711,7 +711,7 @@ int get_vfs_caps_from_disk(struct mnt_idmap *idmap,
cpu_caps->permitted.val &= CAP_VALID_MASK;
cpu_caps->inheritable.val &= CAP_VALID_MASK;
- cpu_caps->rootid = vfsuid_into_kuid(rootvfsuid);
+ cpu_caps->rootid = rootvfsuid;
return 0;
}
--
2.43.0
