Received: by 2002:ac0:a594:0:0:0:0:0 with SMTP id m20-v6csp1438514imm; Wed, 23 May 2018 16:28:08 -0700 (PDT) X-Google-Smtp-Source: AB8JxZpTuRwknpMIZqSlmsIDT65Ltz1/FjHIfXI2d+OMT4jRtt72y/E6M8ZCqUD+fWFScuVCtInE X-Received: by 2002:a17:902:1347:: with SMTP id r7-v6mr4793567ple.62.1527118088743; Wed, 23 May 2018 16:28:08 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1527118088; cv=none; d=google.com; s=arc-20160816; b=GveVBc9lKDrzuH1PzQCYuZGZmkHGtPn80JGyYkhb47Vl19rTEvO4M7W2xkQv4uH57k 4oAuPCBwz3k8Am72LhoXZbOUZZyAQtECHUgGG1pz/kls43Ml04I+o3825OjYgZsqbODk jR0IdLoZzBJi93BS+KIYm7qNkbWTB7/oHC7nABbUyHBNcbSE4Ztji5GbOMV3yJdfQc4M cbTFEDuhnYnsWehqbg97+HN14CP9NuU/GI22fx7xBMlu4/XaicRbMiss/2rG7EVtfEWj woGQsEcRbbMO+s2Fi9mrlqMVn6Cm3gntLQl+l0dmvI6xehTN9H4q49LbCU+x1gHdIpVh ygEw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:subject:references:in-reply-to:message-id :date:cc:to:from:arc-authentication-results; bh=77G7GW58lYKdDoQfUhYC6LT5q4BZBJVIfqiOHZSFYPE=; b=U8jI82RoHzBl1wQOIPPKfGzu4oKdIxCPAbax3vgZx6YnLk100HwzACC6f+kxs1havl Dv+qSukU1avWnQzI6Mov/wZWcFSlQvHK7omkeoWNCxu+2ilZJPe00ikXt9fhqKhlxdD4 0Oj7+lC7+j7GpRIZYKx8gWYKlrEYND1fE2DkZLzqD2HVMqDzwUlx7M4u7q4gO0O1cI5z Wc9nSL8cnIJ6+nZshB1sMt7z9O2Co6Mb+Y2Gu1snbkVnztRMcoRD4tuyR7wiprkUcvsE mj6XtS3BillrDXnvTJOrSABs9uhII25kYrsNL1CESAwmM4O/TwbLF4HtyeubhadigKMM 718g== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id m14-v6si12953227pgd.518.2018.05.23.16.27.54; Wed, 23 May 2018 16:28:08 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S935200AbeEWX1Z (ORCPT + 99 others); Wed, 23 May 2018 19:27:25 -0400 Received: from out01.mta.xmission.com ([166.70.13.231]:48391 "EHLO out01.mta.xmission.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S934671AbeEWX0w (ORCPT ); Wed, 23 May 2018 19:26:52 -0400 Received: from in02.mta.xmission.com ([166.70.13.52]) by out01.mta.xmission.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.87) (envelope-from ) id 1fLd9f-0003Zi-Jo; Wed, 23 May 2018 17:26:51 -0600 Received: from [97.119.174.25] (helo=x220.int.ebiederm.org) by in02.mta.xmission.com with esmtpsa (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.87) (envelope-from ) id 1fLd9f-0004ID-1l; Wed, 23 May 2018 17:26:51 -0600 From: "Eric W. Biederman" To: Linux Containers Cc: linux-fsdevel@vger.kernel.org, Seth Forshee , "Serge E. Hallyn" , Christian Brauner , linux-kernel@vger.kernel.org, "Eric W . Biederman" Date: Wed, 23 May 2018 18:25:38 -0500 Message-Id: <20180523232538.4880-6-ebiederm@xmission.com> X-Mailer: git-send-email 2.14.1 In-Reply-To: <87o9h6554f.fsf@xmission.com> References: <87o9h6554f.fsf@xmission.com> X-XM-SPF: eid=1fLd9f-0004ID-1l;;;mid=<20180523232538.4880-6-ebiederm@xmission.com>;;;hst=in02.mta.xmission.com;;;ip=97.119.174.25;;;frm=ebiederm@xmission.com;;;spf=neutral X-XM-AID: U2FsdGVkX1/I61cfMWaen0e5W957GYQ4fe/6YGdNFRE= X-SA-Exim-Connect-IP: 97.119.174.25 X-SA-Exim-Mail-From: ebiederm@xmission.com X-Spam-Checker-Version: SpamAssassin 3.4.1 (2015-04-28) on sa06.xmission.com X-Spam-Level: *** X-Spam-Status: No, score=3.5 required=8.0 tests=ALL_TRUSTED,BAYES_50, DCC_CHECK_NEGATIVE,TR_Symld_Words,T_TM2_M_HEADER_IN_MSG,T_TooManySym_01, XMNoVowels,XMSubLong autolearn=disabled version=3.4.1 X-Spam-Report: * -1.0 ALL_TRUSTED Passed through trusted hosts only via SMTP * 1.5 XMNoVowels Alpha-numberic number with no vowels * 0.7 XMSubLong Long Subject * 1.5 TR_Symld_Words too many words that have symbols inside * 0.0 T_TM2_M_HEADER_IN_MSG BODY: No description available. * 0.8 BAYES_50 BODY: Bayes spam probability is 40 to 60% * [score: 0.5000] * -0.0 DCC_CHECK_NEGATIVE Not listed in DCC * [sa06 1397; Body=1 Fuz1=1 Fuz2=1] * 0.0 T_TooManySym_01 4+ unique symbols in subject X-Spam-DCC: XMission; sa06 1397; Body=1 Fuz1=1 Fuz2=1 X-Spam-Combo: ***;Linux Containers X-Spam-Relay-Country: X-Spam-Timing: total 162 ms - load_scoreonly_sql: 0.03 (0.0%), signal_user_changed: 2.8 (1.7%), b_tie_ro: 1.89 (1.2%), parse: 0.67 (0.4%), extract_message_metadata: 12 (7.7%), get_uri_detail_list: 0.97 (0.6%), tests_pri_-1000: 7 (4.1%), tests_pri_-950: 1.15 (0.7%), tests_pri_-900: 0.95 (0.6%), tests_pri_-400: 16 (9.9%), check_bayes: 15 (9.3%), b_tokenize: 4.8 (3.0%), b_tok_get_all: 4.5 (2.8%), b_comp_prob: 1.38 (0.9%), b_tok_touch_all: 2.5 (1.5%), b_finish: 0.60 (0.4%), tests_pri_0: 115 (71.0%), check_dkim_signature: 0.43 (0.3%), check_dkim_adsp: 2.7 (1.7%), tests_pri_500: 4.0 (2.5%), rewrite_mail: 0.00 (0.0%) Subject: [REVIEW][PATCH 6/6] fs: Allow CAP_SYS_ADMIN in s_user_ns to freeze and thaw filesystems X-Spam-Flag: No X-SA-Exim-Version: 4.2.1 (built Thu, 05 May 2016 13:38:54 -0600) X-SA-Exim-Scanned: Yes (on in02.mta.xmission.com) Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Seth Forshee The user in control of a super block should be allowed to freeze and thaw it. Relax the restrictions on the FIFREEZE and FITHAW ioctls to require CAP_SYS_ADMIN in s_user_ns. Signed-off-by: Seth Forshee Signed-off-by: Eric W. Biederman --- fs/ioctl.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/ioctl.c b/fs/ioctl.c index 4823431d1c9d..b445b13fc59b 100644 --- a/fs/ioctl.c +++ b/fs/ioctl.c @@ -549,7 +549,7 @@ static int ioctl_fsfreeze(struct file *filp) { struct super_block *sb = file_inode(filp)->i_sb; - if (!capable(CAP_SYS_ADMIN)) + if (!ns_capable(sb->s_user_ns, CAP_SYS_ADMIN)) return -EPERM; /* If filesystem doesn't support freeze feature, return. */ @@ -566,7 +566,7 @@ static int ioctl_fsthaw(struct file *filp) { struct super_block *sb = file_inode(filp)->i_sb; - if (!capable(CAP_SYS_ADMIN)) + if (!ns_capable(sb->s_user_ns, CAP_SYS_ADMIN)) return -EPERM; /* Thaw */ -- 2.14.1