Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2e727b8a authored by Seth Forshee's avatar Seth Forshee Committed by Greg Kroah-Hartman
Browse files

vfs: open() with O_CREAT should not create inodes with unknown ids 




[ Upstream commit 1328c727004d432bbdfba0ffa02a166df04c7305 ]

may_create() rejects creation of inodes with ids which lack a
mapping into s_user_ns. However for O_CREAT may_o_create() is
is used instead. Add a similar check there.

Fixes: 036d5236 ("vfs: Don't create inodes with a uid or gid unknown to the vfs")
Signed-off-by: default avatarSeth Forshee <seth.forshee@canonical.com>
Signed-off-by: default avatar"Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: default avatarSasha Levin <alexander.levin@verizon.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 7ec661f5

fs/namei.c

+6 −0
Original line number Diff line number Diff line
@@ -2971,10 +2971,16 @@ static inline int open_to_namei_flags(int flag) 


static int may_o_create(const struct path *dir, struct dentry *dentry, umode_t mode)

{

	struct user_namespace *s_user_ns;

	int error = security_path_mknod(dir, dentry, mode, 0);

	if (error)

		return error;



	s_user_ns = dir->dentry->d_sb->s_user_ns;

	if (!kuid_has_mapping(s_user_ns, current_fsuid()) ||

	    !kgid_has_mapping(s_user_ns, current_fsgid()))

		return -EOVERFLOW;



	error = inode_permission(dir->dentry->d_inode, MAY_WRITE | MAY_EXEC);

	if (error)

		return error;