2021-05-30 14:21:36

by tianyu zhou

[permalink] [raw]
Subject: Check for CAP_SYS_ADMIN before thaw/freeze block device

Hi, from commit "fs: Allow CAP_SYS_ADMIN in s_user_ns to freeze and
thaw filesystems" (SHA: f3f1a18330ac1b717cd7a32adff38d965f365aa2), I
learned that "The user in control of a super block should be allowed
to freeze and thaw it".

However, unlike ioctl_fsthaw and ioctl_fsfreeze which use ns_capable
to check CAP_SYS_ADMIN in super block's user ns, function thaw_bdev
and freeze_bdev in fs/block_dev.c also do the same thaw/freeze
operation to super block, with no check for CAP_SYS_ADMIN.

I searched these two functions' callers, and found there are check for
CAP_SYS_ADMIN before the callers call them, however, the check is
using capable which is inconsistent with the the commit I mentioned

Here is an example:
// fs/ext4/ioctl.c
static int ext4_shutdown(struct super_block *sb, unsigned long arg)
if (!capable(CAP_SYS_ADMIN))
return -EPERM;
switch (flags) {

So it is possible to change this kind of CAP_SYS_ADMIN check from
capable() to ns_capable() to keep consistency with the former commit?


Best regards,