shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-06-07 03:15:31 +09:00
Code Issues Packages Projects Releases Wiki Activity

ovl: drop CAP_SYS_RESOURCE from saved mounter's credentials

Browse Source 
commit 51f8f3c4e2 upstream.

If overlay was mounted by root then quota set for upper layer does not work
because overlay now always use mounter's credentials for operations.
Also overlay might deplete reserved space and inodes in ext4.

This patch drops capability SYS_RESOURCE from saved credentials.
This affects creation new files, whiteouts, and copy-up operations.

Signed-off-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
Fixes: 1175b6b8d9 ("ovl: do operations on underlying file system in mounter's context")
Cc: Vivek Goyal <vgoyal@redhat.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Cc: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Konstantin Khlebnikov
2017-01-10 21:30:21 +03:00
committed by Greg Kroah-Hartman
parent 0fb615f9ca
commit fee760fc6c
1 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
fs/overlayfs/super.c
View File

@@ -1146,6 +1146,7 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent)
unsigned int stacklen = 0;
unsigned int i;
bool remote = false;
struct cred *cred;
int err;
err = -ENOMEM;
@@ -1309,10 +1310,13 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent)
else
sb->s_d_op = &ovl_dentry_operations;
ufs->creator_cred = prepare_creds();
if (!ufs->creator_cred)
ufs->creator_cred = cred = prepare_creds();
if (!cred)
goto out_put_lower_mnt;
/* Never override disk quota limits or use reserved space */
cap_lower(cred->cap_effective, CAP_SYS_RESOURCE);
err = -ENOMEM;
oe = ovl_alloc_entry(numlower);
if (!oe)