Zhang Tianci 5b0db51215 ovl: Use ovl mounter's fsuid and fsgid in ovl_link() ... There is a wrong case of link() on overlay: $ mkdir /lower /fuse /merge $ mount -t fuse /fuse $ mkdir /fuse/upper /fuse/work $ mount -t overlay /merge -o lowerdir=/lower,upperdir=/fuse/upper,\ workdir=work $ touch /merge/file $ chown bin.bin /merge/file // the file's caller becomes "bin" $ ln /merge/file /merge/lnkfile Then we will get an error(EACCES) because fuse daemon checks the link()'s caller is "bin", it denied this request. In the changing history of ovl_link(), there are two key commits: The first is commit bb0d2b8ad2 ("ovl: fix sgid on directory") which overrides the cred's fsuid/fsgid using the new inode. The new inode's owner is initialized by inode_init_owner(), and inode->fsuid is assigned to the current user. So the override fsuid becomes the current user. We know link() is actually modifying the directory, so the caller must have the MAY_WRITE permission on the directory. The current caller may should have this permission. This is acceptable to use the caller's fsuid. The second is commit 51f7e52dc9 ("ovl: share inode for hard link") which removed the inode creation in ovl_link(). This commit move inode_init_owner() into ovl_create_object(), so the ovl_link() just give the old inode to ovl_create_or_link(). Then the override fsuid becomes the old inode's fsuid, neither the caller nor the overlay's mounter! So this is incorrect. Fix this bug by using ovl mounter's fsuid/fsgid to do underlying fs's link(). Link: https://lore.kernel.org/all/20220817102952.xnvesg3a7rbv576x@wittgenstein/T Link: https://lore.kernel.org/lkml/20220825130552.29587-1-zhangtianci.1997@bytedance.com/t Signed-off-by: Zhang Tianci <zhangtianci.1997@bytedance.com> Signed-off-by: Jiachen Zhang <zhangjiachen.jaycee@bytedance.com> Reviewed-by: Christian Brauner (Microsoft) <brauner@kernel.org> Fixes: 51f7e52dc9 ("ovl: share inode for hard link") Cc: <stable@vger.kernel.org> # v4.8 Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>		2022-12-08 10:49:46 +01:00
..
copy_up.c	tmpfile API change	2022-10-10 19:45:17 -07:00
dir.c	ovl: Use ovl mounter's fsuid and fsgid in ovl_link()	2022-12-08 10:49:46 +01:00
export.c	ovl: Use "buf" flexible array for memcpy() destination	2022-12-08 10:49:46 +01:00
file.c	ovl: update ->f_iocb_flags when ovl_change_flags() modifies ->f_flags	2022-11-28 11:53:28 +01:00
inode.c	whack-a-mole: constifying struct path *	2022-10-06 17:31:02 -07:00
Kconfig	docs: fix broken references to text files	2020-04-20 15:35:59 -06:00
Makefile	treewide: Add SPDX license identifier - Makefile/Kconfig	2019-05-21 10:50:46 +02:00
namei.c	overlayfs: constify path	2022-09-01 17:38:07 -04:00
overlayfs.h	ovl: Use "buf" flexible array for memcpy() destination	2022-12-08 10:49:46 +01:00
ovl_entry.h	ovl: support idmapped layers	2022-04-28 16:31:12 +02:00
readdir.c	whack-a-mole: constifying struct path *	2022-10-06 17:31:02 -07:00
super.c	ovl: fix use inode directly in rcu-walk mode	2022-11-28 11:33:05 +01:00
util.c	ovl: use vfs_tmpfile_open() helper	2022-09-24 07:00:00 +02:00