Zhang Tianci 56abf8046b ovl: Use ovl mounter's fsuid and fsgid in ovl_link() ... commit 5b0db51215 upstream. There is a wrong case of link() on overlay: $ mkdir /lower /fuse /merge $ mount -t fuse /fuse $ mkdir /fuse/upper /fuse/work $ mount -t overlay /merge -o lowerdir=/lower,upperdir=/fuse/upper,\ workdir=work $ touch /merge/file $ chown bin.bin /merge/file // the file's caller becomes "bin" $ ln /merge/file /merge/lnkfile Then we will get an error(EACCES) because fuse daemon checks the link()'s caller is "bin", it denied this request. In the changing history of ovl_link(), there are two key commits: The first is commit bb0d2b8ad2 ("ovl: fix sgid on directory") which overrides the cred's fsuid/fsgid using the new inode. The new inode's owner is initialized by inode_init_owner(), and inode->fsuid is assigned to the current user. So the override fsuid becomes the current user. We know link() is actually modifying the directory, so the caller must have the MAY_WRITE permission on the directory. The current caller may should have this permission. This is acceptable to use the caller's fsuid. The second is commit 51f7e52dc9 ("ovl: share inode for hard link") which removed the inode creation in ovl_link(). This commit move inode_init_owner() into ovl_create_object(), so the ovl_link() just give the old inode to ovl_create_or_link(). Then the override fsuid becomes the old inode's fsuid, neither the caller nor the overlay's mounter! So this is incorrect. Fix this bug by using ovl mounter's fsuid/fsgid to do underlying fs's link(). Link: https://lore.kernel.org/all/20220817102952.xnvesg3a7rbv576x@wittgenstein/T Link: https://lore.kernel.org/lkml/20220825130552.29587-1-zhangtianci.1997@bytedance.com/t Signed-off-by: Zhang Tianci <zhangtianci.1997@bytedance.com> Signed-off-by: Jiachen Zhang <zhangjiachen.jaycee@bytedance.com> Reviewed-by: Christian Brauner (Microsoft) <brauner@kernel.org> Fixes: 51f7e52dc9 ("ovl: share inode for hard link") Cc: <stable@vger.kernel.org> # v4.8 Signed-off-by: Miklos Szeredi <mszeredi@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2023-01-14 10:16:26 +01:00
..
copy_up.c
dir.c	ovl: Use ovl mounter's fsuid and fsgid in ovl_link()	2023-01-14 10:16:26 +01:00
export.c	ovl: drop WARN_ON() dentry is NULL in ovl_encode_fh()	2022-08-21 15:15:23 +02:00
file.c	ovl: fix deadlock in splice write	2021-12-08 09:03:18 +01:00
inode.c
Kconfig
Makefile
namei.c	new helper: inode_wrong_type()	2021-09-08 08:49:01 +02:00
overlayfs.h	ovl: fix warning in ovl_create_real()	2021-12-22 09:30:58 +01:00
ovl_entry.h
readdir.c
super.c	ovl: fix use inode directly in rcu-walk mode	2023-01-14 10:16:24 +01:00
util.c