2020-04-22 14:56:53

by Christian Brauner

Subject: [PATCH v2 3/7] loop: use ns_capable for some loop operations

The following LOOP_GET_STATUS, LOOP_SET_STATUS, and LOOP_SET_BLOCK_SIZE
operations are now allowed in non-initial namespaces. Most other
operations were already possible before.

Cc: Jens Axboe <[email protected]>
Cc: Seth Forshee <[email protected]>
Cc: Tom Gundersen <[email protected]>
Cc: Tejun Heo <[email protected]>
Cc: Christian Kellner <[email protected]>
Cc: Greg Kroah-Hartman <[email protected]>
Cc: "David S. Miller" <[email protected]>
Cc: David Rheinsberg <[email protected]>
Cc: Dmitry Vyukov <[email protected]>
Cc: "Rafael J. Wysocki" <[email protected]>
Signed-off-by: Christian Brauner <[email protected]>
---
/* v2 */
- Christian Brauner <[email protected]>:
- Adapated loop_capable() based on changes in the loopfs
implementation patchset. Otherwise it is functionally equivalent to
the v1 version.
---
drivers/block/loop.c | 20 +++++++++++++++-----
1 file changed, 15 insertions(+), 5 deletions(-)

diff --git a/drivers/block/loop.c b/drivers/block/loop.c
index 52f7583dd17d..8e21d4b33e01 100644
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -1352,6 +1352,16 @@ void loopfs_evict_locked(struct loop_device *lo)
}
mutex_unlock(&loop_ctl_mutex);
}
+
+static bool loop_capable(const struct loop_device *lo, int cap)
+{
+ return ns_capable(loopfs_ns(lo), cap);
+}
+#else /* !CONFIG_BLK_DEV_LOOPFS */
+static inline bool loop_capable(const struct loop_device *lo, int cap)
+{
+ return capable(cap);
+}
#endif /* CONFIG_BLK_DEV_LOOPFS */

static int
@@ -1368,7 +1378,7 @@ loop_set_status(struct loop_device *lo, const struct loop_info64 *info)
return err;
if (lo->lo_encrypt_key_size &&
!uid_eq(lo->lo_key_owner, uid) &&
- !capable(CAP_SYS_ADMIN)) {
+ !loop_capable(lo, CAP_SYS_ADMIN)) {
err = -EPERM;
goto out_unlock;
}
@@ -1499,7 +1509,7 @@ loop_get_status(struct loop_device *lo, struct loop_info64 *info)
memcpy(info->lo_crypt_name, lo->lo_crypt_name, LO_NAME_SIZE);
info->lo_encrypt_type =
lo->lo_encryption ? lo->lo_encryption->number : 0;
- if (lo->lo_encrypt_key_size && capable(CAP_SYS_ADMIN)) {
+ if (lo->lo_encrypt_key_size && loop_capable(lo, CAP_SYS_ADMIN)) {
info->lo_encrypt_key_size = lo->lo_encrypt_key_size;
memcpy(info->lo_encrypt_key, lo->lo_encrypt_key,
lo->lo_encrypt_key_size);
@@ -1723,7 +1733,7 @@ static int lo_ioctl(struct block_device *bdev, fmode_t mode,
return loop_clr_fd(lo);
case LOOP_SET_STATUS:
err = -EPERM;
- if ((mode & FMODE_WRITE) || capable(CAP_SYS_ADMIN)) {
+ if ((mode & FMODE_WRITE) || loop_capable(lo, CAP_SYS_ADMIN)) {
err = loop_set_status_old(lo,
(struct loop_info __user *)arg);
}
@@ -1732,7 +1742,7 @@ static int lo_ioctl(struct block_device *bdev, fmode_t mode,
return loop_get_status_old(lo, (struct loop_info __user *) arg);
case LOOP_SET_STATUS64:
err = -EPERM;
- if ((mode & FMODE_WRITE) || capable(CAP_SYS_ADMIN)) {
+ if ((mode & FMODE_WRITE) || loop_capable(lo, CAP_SYS_ADMIN)) {
err = loop_set_status64(lo,
(struct loop_info64 __user *) arg);
}
@@ -1742,7 +1752,7 @@ static int lo_ioctl(struct block_device *bdev, fmode_t mode,
case LOOP_SET_CAPACITY:
case LOOP_SET_DIRECT_IO:
case LOOP_SET_BLOCK_SIZE:
- if (!(mode & FMODE_WRITE) && !capable(CAP_SYS_ADMIN))
+ if (!(mode & FMODE_WRITE) && !loop_capable(lo, CAP_SYS_ADMIN))
return -EPERM;
/* Fall through */
default:
--
2.26.1

2020-04-22 20:58:58

by Serge E. Hallyn

Subject: Re: [PATCH v2 3/7] loop: use ns_capable for some loop operations

On Wed, Apr 22, 2020 at 04:54:33PM +0200, Christian Brauner wrote:
> The following LOOP_GET_STATUS, LOOP_SET_STATUS, and LOOP_SET_BLOCK_SIZE
> operations are now allowed in non-initial namespaces. Most other
> operations were already possible before.
>
> Cc: Jens Axboe <[email protected]>
> Cc: Seth Forshee <[email protected]>
> Cc: Tom Gundersen <[email protected]>
> Cc: Tejun Heo <[email protected]>
> Cc: Christian Kellner <[email protected]>
> Cc: Greg Kroah-Hartman <[email protected]>
> Cc: "David S. Miller" <[email protected]>
> Cc: David Rheinsberg <[email protected]>
> Cc: Dmitry Vyukov <[email protected]>
> Cc: "Rafael J. Wysocki" <[email protected]>
> Signed-off-by: Christian Brauner <[email protected]>

Reviewed-by: Serge Hallyn <[email protected]>

> ---
> /* v2 */
> - Christian Brauner <[email protected]>:
> - Adapated loop_capable() based on changes in the loopfs
> implementation patchset. Otherwise it is functionally equivalent to
> the v1 version.
> ---
> drivers/block/loop.c | 20 +++++++++++++++-----
> 1 file changed, 15 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/block/loop.c b/drivers/block/loop.c
> index 52f7583dd17d..8e21d4b33e01 100644
> --- a/drivers/block/loop.c
> +++ b/drivers/block/loop.c
> @@ -1352,6 +1352,16 @@ void loopfs_evict_locked(struct loop_device *lo)
> }
> mutex_unlock(&loop_ctl_mutex);
> }
> +
> +static bool loop_capable(const struct loop_device *lo, int cap)
> +{
> + return ns_capable(loopfs_ns(lo), cap);
> +}
> +#else /* !CONFIG_BLK_DEV_LOOPFS */
> +static inline bool loop_capable(const struct loop_device *lo, int cap)
> +{
> + return capable(cap);
> +}
> #endif /* CONFIG_BLK_DEV_LOOPFS */
>
> static int
> @@ -1368,7 +1378,7 @@ loop_set_status(struct loop_device *lo, const struct loop_info64 *info)
> return err;
> if (lo->lo_encrypt_key_size &&
> !uid_eq(lo->lo_key_owner, uid) &&
> - !capable(CAP_SYS_ADMIN)) {
> + !loop_capable(lo, CAP_SYS_ADMIN)) {
> err = -EPERM;
> goto out_unlock;
> }
> @@ -1499,7 +1509,7 @@ loop_get_status(struct loop_device *lo, struct loop_info64 *info)
> memcpy(info->lo_crypt_name, lo->lo_crypt_name, LO_NAME_SIZE);
> info->lo_encrypt_type =
> lo->lo_encryption ? lo->lo_encryption->number : 0;
> - if (lo->lo_encrypt_key_size && capable(CAP_SYS_ADMIN)) {
> + if (lo->lo_encrypt_key_size && loop_capable(lo, CAP_SYS_ADMIN)) {
> info->lo_encrypt_key_size = lo->lo_encrypt_key_size;
> memcpy(info->lo_encrypt_key, lo->lo_encrypt_key,
> lo->lo_encrypt_key_size);
> @@ -1723,7 +1733,7 @@ static int lo_ioctl(struct block_device *bdev, fmode_t mode,
> return loop_clr_fd(lo);
> case LOOP_SET_STATUS:
> err = -EPERM;
> - if ((mode & FMODE_WRITE) || capable(CAP_SYS_ADMIN)) {
> + if ((mode & FMODE_WRITE) || loop_capable(lo, CAP_SYS_ADMIN)) {
> err = loop_set_status_old(lo,
> (struct loop_info __user *)arg);
> }
> @@ -1732,7 +1742,7 @@ static int lo_ioctl(struct block_device *bdev, fmode_t mode,
> return loop_get_status_old(lo, (struct loop_info __user *) arg);
> case LOOP_SET_STATUS64:
> err = -EPERM;
> - if ((mode & FMODE_WRITE) || capable(CAP_SYS_ADMIN)) {
> + if ((mode & FMODE_WRITE) || loop_capable(lo, CAP_SYS_ADMIN)) {
> err = loop_set_status64(lo,
> (struct loop_info64 __user *) arg);
> }
> @@ -1742,7 +1752,7 @@ static int lo_ioctl(struct block_device *bdev, fmode_t mode,
> case LOOP_SET_CAPACITY:
> case LOOP_SET_DIRECT_IO:
> case LOOP_SET_BLOCK_SIZE:
> - if (!(mode & FMODE_WRITE) && !capable(CAP_SYS_ADMIN))
> + if (!(mode & FMODE_WRITE) && !loop_capable(lo, CAP_SYS_ADMIN))
> return -EPERM;
> /* Fall through */
> default:
> --
> 2.26.1