This is a note to let you know that I've just added the patch titled
filelocks: use mount idmapping for setlease permission check
to the 6.1-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
filelocks-use-mount-idmapping-for-setlease-permission-check.patch
and it can be found in the queue-6.1 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 42d0c4bdf753063b6eec55415003184d3ca24f6e Mon Sep 17 00:00:00 2001
From: Seth Forshee <sforshee@xxxxxxxxxx>
Date: Thu, 9 Mar 2023 14:39:09 -0600
Subject: filelocks: use mount idmapping for setlease permission check
From: Seth Forshee <sforshee@xxxxxxxxxx>
commit 42d0c4bdf753063b6eec55415003184d3ca24f6e upstream.
A user should be allowed to take out a lease via an idmapped mount if
the fsuid matches the mapped uid of the inode. generic_setlease() is
checking the unmapped inode uid, causing these operations to be denied.
Fix this by comparing against the mapped inode uid instead of the
unmapped uid.
Fixes: 9caccd41541a ("fs: introduce MOUNT_ATTR_IDMAP")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Seth Forshee (DigitalOcean) <sforshee@xxxxxxxxxx>
Signed-off-by: Christian Brauner (Microsoft) <brauner@xxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
fs/locks.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/fs/locks.c
+++ b/fs/locks.c
@@ -1862,9 +1862,10 @@ int generic_setlease(struct file *filp,
void **priv)
{
struct inode *inode = locks_inode(filp);
+ vfsuid_t vfsuid = i_uid_into_vfsuid(file_mnt_user_ns(filp), inode);
int error;
- if ((!uid_eq(current_fsuid(), inode->i_uid)) && !capable(CAP_LEASE))
+ if ((!vfsuid_eq_kuid(vfsuid, current_fsuid())) && !capable(CAP_LEASE))
return -EACCES;
if (!S_ISREG(inode->i_mode))
return -EINVAL;
Patches currently in stable-queue which might be from sforshee@xxxxxxxxxx are
queue-6.1/filelocks-use-mount-idmapping-for-setlease-permission-check.patch
