On Tue, Jan 27, 2015 at 02:14:43PM +1100, Dave Chinner wrote:
> From: Dave Chinner <dchinner@xxxxxxxxxx>
>
> Currently XFS_IOCTL_SETXATTR will fail if run in a user namespace as
> it it not allowed to change project IDs. The current code, however,
> also prevents any other change being made as well, so things like
> extent size hints cannot be set in user namespaces. This is wrong,
> so only disallow access to project IDs and related flags from inside
> the init namespace.
>
> Signed-off-by: Dave Chinner <dchinner@xxxxxxxxxx>
> ---
> fs/xfs/xfs_ioctl.c | 22 +++++++++++++---------
> 1 file changed, 13 insertions(+), 9 deletions(-)
>
> diff --git a/fs/xfs/xfs_ioctl.c b/fs/xfs/xfs_ioctl.c
> index 563d2b4..ae6e1e3 100644
> --- a/fs/xfs/xfs_ioctl.c
> +++ b/fs/xfs/xfs_ioctl.c
> @@ -1120,6 +1120,19 @@ xfs_ioctl_setattr(
> return -EINVAL;
>
> /*
> + * Project Quota ID state is only allowed to change from within the init
> + * namespace. Enforce that restriction only if we are trying to change
> + * the quota ID state. Everything else is allowed in user namespaces.
> + */
> + if (current_user_ns() != &init_user_ns) {
> + if (xfs_get_projid(ip) != fa->fsx_projid)
> + return -EINVAL;
> + if ((fa->fsx_xflags & XFS_XFLAG_PROJINHERIT) ^
> + (ip->i_d.di_flags & XFS_DIFLAG_PROJINHERIT))
Why not use != here? Looks fine, anyways:
Reviewed-by: Brian Foster <bfoster@xxxxxxxxxx>
> + return -EINVAL;
> + }
> +
> + /*
> * If disk quotas is on, we make sure that the dquots do exist on disk,
> * before we start any other transactions. Trying to do this later
> * is messy. We don't care to take a readlock to look at the ids
> @@ -1139,15 +1152,6 @@ xfs_ioctl_setattr(
> if (IS_ERR(tp))
> return PTR_ERR(tp);
>
> - /*
> - * Do a quota reservation only if projid is actually going to change.
> - * Only allow changing of projid from init_user_ns since it is a
> - * non user namespace aware identifier.
> - */
> - if (current_user_ns() != &init_user_ns) {
> - code = -EINVAL;
> - goto error_return;
> - }
>
> if (XFS_IS_QUOTA_RUNNING(mp) && XFS_IS_PQUOTA_ON(mp) &&
> xfs_get_projid(ip) != fa->fsx_projid) {
> --
> 2.0.0
>
> _______________________________________________
> xfs mailing list
> xfs@xxxxxxxxxxx
> http://oss.sgi.com/mailman/listinfo/xfs
_______________________________________________
xfs mailing list
xfs@xxxxxxxxxxx
http://oss.sgi.com/mailman/listinfo/xfs
