Files
linux/include/linux
Serge Hallyn 9f0e4cd4ef fix namespaced fscaps when !CONFIG_SECURITY
[ Upstream commit ed9b25d197 ]

Namespaced file capabilities were introduced in 8db6c34f1d .
When userspace reads an xattr for a namespaced capability, a
virtualized representation of it is returned if the caller is
in a user namespace owned by the capability's owning rootid.
The function which performs this virtualization was not hooked
up if CONFIG_SECURITY=n.  Therefore in that case the original
xattr was shown instead of the virtualized one.

To test this using libcap-bin (*1),

$ v=$(mktemp)
$ unshare -Ur setcap cap_sys_admin-eip $v
$ unshare -Ur setcap -v cap_sys_admin-eip $v
/tmp/tmp.lSiIFRvt8Y: OK

"setcap -v" verifies the values instead of setting them, and
will check whether the rootid value is set.  Therefore, with
this bug un-fixed, and with CONFIG_SECURITY=n, setcap -v will
fail:

$ v=$(mktemp)
$ unshare -Ur setcap cap_sys_admin=eip $v
$ unshare -Ur setcap -v cap_sys_admin=eip $v
nsowner[got=1000, want=0],/tmp/tmp.HHDiOOl9fY differs in []

Fix this bug by calling cap_inode_getsecurity() in
security_inode_getsecurity() instead of returning
-EOPNOTSUPP, when CONFIG_SECURITY=n.

*1 - note, if libcap is too old for getcap to have the '-n'
option, then use verify-caps instead.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=209689
Cc: Hervé Guillemet <herve@guillemet.org>
Acked-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Serge Hallyn <shallyn@cisco.com>
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
Signed-off-by: James Morris <jamorris@linux.microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-12-30 11:26:06 +01:00
..
2019-12-13 08:51:18 +01:00
2019-12-17 20:35:45 +01:00
2018-05-26 09:16:44 +02:00
2018-06-15 18:10:01 -03:00
2019-10-05 13:10:03 +02:00
2019-07-03 13:14:48 +02:00
2018-05-09 17:25:13 +02:00
2017-11-15 18:21:04 -08:00
2018-06-15 18:10:01 -03:00
2018-06-19 10:06:29 -07:00
2018-03-26 15:09:38 +02:00
2018-08-22 10:52:48 -07:00
2018-01-01 12:40:27 -07:00
2019-11-24 08:19:14 +01:00
2018-07-12 10:04:29 -04:00
2017-11-13 01:41:20 +01:00
2020-09-03 11:24:28 +02:00
2018-07-27 09:57:23 +10:00
2020-03-25 08:06:14 +01:00
2018-06-28 20:32:51 +09:00
2019-10-17 13:45:42 -07:00
2018-03-26 08:53:43 -06:00
2018-08-08 11:06:20 +02:00
2018-06-22 13:43:27 +09:00
2019-12-13 08:52:43 +01:00
2018-04-11 10:28:38 -07:00
2017-11-15 18:21:01 -08:00
2018-07-12 21:35:28 +02:00
2017-12-01 13:09:40 -08:00
2018-04-12 09:41:19 -07:00
2018-06-05 08:50:16 -04:00
2018-06-07 17:34:35 -07:00
2018-04-11 10:28:32 -07:00
2019-12-31 16:35:38 +01:00
2020-07-29 10:16:52 +02:00
2018-06-07 17:34:39 -07:00
2018-03-26 13:14:43 -04:00
2018-03-26 13:14:43 -04:00
2018-08-22 10:52:45 -07:00
2018-01-28 22:17:24 -05:00
2018-01-08 08:22:45 -06:00
2018-07-10 17:22:35 +02:00
2018-01-08 08:22:45 -06:00
2018-06-07 17:34:36 -07:00
2018-04-11 10:28:39 -07:00
2018-01-31 17:18:37 -08:00
2017-11-09 10:23:28 +01:00
2018-07-19 11:34:23 +01:00
2020-03-18 07:14:17 +01:00
2017-11-17 16:10:04 -08:00
2018-07-21 10:43:12 -05:00
2017-11-13 01:33:48 +01:00
2017-12-16 02:05:48 +01:00
2018-08-22 10:52:46 -07:00
2018-05-31 00:13:56 +08:00
2019-06-11 12:20:52 +02:00
2018-07-20 01:11:45 +02:00
2018-05-11 17:28:45 -07:00
2018-05-11 17:28:45 -07:00
2018-03-01 08:33:05 -07:00
2017-11-07 12:22:21 +01:00
2018-06-29 08:48:06 -06:00
2020-04-17 10:48:47 +02:00
2020-04-02 15:28:22 +02:00
2018-06-07 17:34:35 -07:00
2018-07-07 17:25:23 +02:00
2018-05-03 15:55:23 -07:00
2018-08-16 12:14:42 -07:00
2018-01-15 12:07:46 -08:00
2018-06-20 11:35:56 +02:00
2018-02-06 18:32:47 -08:00
2018-11-13 11:08:51 -08:00
2020-12-11 13:25:01 +01:00
2018-02-06 18:32:44 -08:00
2017-12-20 09:53:54 -07:00
2020-04-02 15:28:23 +02:00