Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 949b9c3d authored by Andreas Gruenbacher's avatar Andreas Gruenbacher Committed by Linus Torvalds
Browse files

userns: relax the posix_acl_valid() checks 



So far, POSIX ACLs are using a canonical representation that keeps all ACL
entries in a strict order; the ACL_USER and ACL_GROUP entries for specific
users and groups are ordered by user and group identifier, respectively.
The user-space code provides ACL entries in this order; the kernel
verifies that the ACL entry order is correct in posix_acl_valid().

User namespaces allow to arbitrary map user and group identifiers which
can cause the ACL_USER and ACL_GROUP entry order to differ between user
space and the kernel; posix_acl_valid() would then fail.

Work around this by allowing ACL_USER and ACL_GROUP entries to be in any
order in the kernel.  The effect is only minor: file permission checks
will pick the first matching ACL_USER entry, and check all matching
ACL_GROUP entries.

(The libacl user-space library and getfacl / setfacl tools will not create
ACLs with duplicate user or group idenfifiers; they will handle ACLs with
entries in an arbitrary order correctly.)

Signed-off-by: default avatarAndreas Gruenbacher <agruen@linbit.com>
Cc: Eric W. Biederman <ebiederm@xmission.com>
Cc: Theodore Tso <tytso@mit.edu>
Cc: Christoph Hellwig <hch@infradead.org>
Cc: Andreas Dilger <adilger.kernel@dilger.ca>
Cc: Jan Kara <jack@suse.cz>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent e376ed7c

fs/posix_acl.c

+0 −10
Original line number Diff line number Diff line
@@ -149,8 +149,6 @@ posix_acl_valid(const struct posix_acl *acl) 
{

	const struct posix_acl_entry *pa, *pe;

	int state = ACL_USER_OBJ;

	kuid_t prev_uid = INVALID_UID;

	kgid_t prev_gid = INVALID_GID;

	int needs_mask = 0;



	FOREACH_ACL_ENTRY(pa, acl, pe) {
@@ -169,10 +167,6 @@ posix_acl_valid(const struct posix_acl *acl) 
					return -EINVAL;

				if (!uid_valid(pa->e_uid))

					return -EINVAL;

				if (uid_valid(prev_uid) &&

				    uid_lte(pa->e_uid, prev_uid))

					return -EINVAL;

				prev_uid = pa->e_uid;

				needs_mask = 1;

				break;
@@ -188,10 +182,6 @@ posix_acl_valid(const struct posix_acl *acl) 
					return -EINVAL;

				if (!gid_valid(pa->e_gid))

					return -EINVAL;

				if (gid_valid(prev_gid) &&

				    gid_lte(pa->e_gid, prev_gid))

					return -EINVAL;

				prev_gid = pa->e_gid;

				needs_mask = 1;

				break;