Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit cf9a6784 authored by Miklos Szeredi's avatar Miklos Szeredi
Browse files

ovl: setattr: check permissions before copy-up 



Without this copy-up of a file can be forced, even without actually being
allowed to do anything on the file.

[Arnd Bergmann] include <linux/pagemap.h> for PAGE_CACHE_SIZE (used by
MAX_LFS_FILESIZE definition).

Signed-off-by: default avatarMiklos Szeredi <miklos@szeredi.hu>
Cc: <stable@vger.kernel.org>
parent ed06e069

fs/overlayfs/inode.c

+13 −0
Original line number Diff line number Diff line
@@ -45,6 +45,19 @@ int ovl_setattr(struct dentry *dentry, struct iattr *attr) 
	int err;

	struct dentry *upperdentry;



	/*

	 * Check for permissions before trying to copy-up.  This is redundant

	 * since it will be rechecked later by ->setattr() on upper dentry.  But

	 * without this, copy-up can be triggered by just about anybody.

	 *

	 * We don't initialize inode->size, which just means that

	 * inode_newsize_ok() will always check against MAX_LFS_FILESIZE and not

	 * check for a swapfile (which this won't be anyway).

	 */

	err = inode_change_ok(dentry->d_inode, attr);

	if (err)

		return err;



	err = ovl_want_write(dentry);

	if (err)

		goto out;

fs/overlayfs/super.c

+2 −0
Original line number Diff line number Diff line
@@ -9,6 +9,7 @@ 


#include <linux/fs.h>

#include <linux/namei.h>

#include <linux/pagemap.h>

#include <linux/xattr.h>

#include <linux/security.h>

#include <linux/mount.h>
@@ -936,6 +937,7 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent) 
	}



	sb->s_stack_depth = 0;

	sb->s_maxbytes = MAX_LFS_FILESIZE;

	if (ufs->config.upperdir) {

		if (!ufs->config.workdir) {

			pr_err("overlayfs: missing 'workdir'\n");