| Message ID | 20250217-work-overlayfs-v2-1-41dfe7718963@kernel.org (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | ovl: add override_creds mount option | expand |
On Mon, Feb 17, 2025 at 11:20 AM Christian Brauner <brauner@kernel.org> wrote: > > Currently overlayfs uses the mounter's credentials for it's > override_creds() calls. That provides a consistent permission model. > > This patches allows a caller to instruct overlayfs to use its > credentials instead. The caller must be located in the same user > namespace as the user namespace the overlayfs instance will be mounted > in. This provides a consistent and simple security model. > > With this it is possible to e.g., mount an overlayfs instance where the > mounter must have CAP_SYS_ADMIN but the credentials used for > override_creds() have dropped CAP_SYS_ADMIN. It also allows the usage of > custom fs{g,u}id different from the callers and other tweaks. > > Signed-off-by: Christian Brauner <brauner@kernel.org> For the code: Reviewed-by: Amir Goldstein <amir73il@gmail.com> For non-RFC patch please add something to the 'Permission model' section in overlayfs.rst This section refers to the "mounting task" which implies that the "mounting task" credentials are constant throughout the mount (which made sense until the new mount API). I would add a [*] near "mounting task" and write a footnote that "mounting task" credentials is referring to the mounting task credentials at the time of mount() system call or at the some of executing FSCONFIG_CMD_CREATE fsconfig() command or (since kernel xxx) at the time of setting the mount option "override_creds" using the fsconfig() system call. Feel free to rephrase as you see fit. Thanks, Amir. > --- > fs/overlayfs/params.c | 22 ++++++++++++++++++++++ > fs/overlayfs/super.c | 11 ++++++++++- > 2 files changed, 32 insertions(+), 1 deletion(-) > > diff --git a/fs/overlayfs/params.c b/fs/overlayfs/params.c > index 1115c22deca0..f2bc8acf6bf1 100644 > --- a/fs/overlayfs/params.c > +++ b/fs/overlayfs/params.c > @@ -59,6 +59,7 @@ enum ovl_opt { > Opt_metacopy, > Opt_verity, > Opt_volatile, > + Opt_override_creds, > }; > > static const struct constant_table ovl_parameter_bool[] = { > @@ -155,6 +156,7 @@ const struct fs_parameter_spec ovl_parameter_spec[] = { > fsparam_enum("metacopy", Opt_metacopy, ovl_parameter_bool), > fsparam_enum("verity", Opt_verity, ovl_parameter_verity), > fsparam_flag("volatile", Opt_volatile), > + fsparam_flag_no("override_creds", Opt_override_creds), > {} > }; > > @@ -662,6 +664,26 @@ static int ovl_parse_param(struct fs_context *fc, struct fs_parameter *param) > case Opt_userxattr: > config->userxattr = true; > break; > + case Opt_override_creds: { > + const struct cred *cred = ofs->creator_cred; > + > + if (!result.negated) { > + if (fc->user_ns != current_user_ns()) { > + err = -EINVAL; > + break; > + } > + > + ofs->creator_cred = prepare_creds(); > + if (!ofs->creator_cred) { > + err = -EINVAL; > + break; > + } > + } else { > + ofs->creator_cred = NULL; > + } > + put_cred(cred); > + break; > + } > default: > pr_err("unrecognized mount option \"%s\" or missing value\n", > param->key); > diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c > index 86ae6f6da36b..a85071fe18fd 100644 > --- a/fs/overlayfs/super.c > +++ b/fs/overlayfs/super.c > @@ -1305,6 +1305,7 @@ int ovl_fill_super(struct super_block *sb, struct fs_context *fc) > { > struct ovl_fs *ofs = sb->s_fs_info; > struct ovl_fs_context *ctx = fc->fs_private; > + const struct cred *old_cred = NULL; > struct dentry *root_dentry; > struct ovl_entry *oe; > struct ovl_layer *layers; > @@ -1318,10 +1319,15 @@ int ovl_fill_super(struct super_block *sb, struct fs_context *fc) > sb->s_d_op = &ovl_dentry_operations; > > err = -ENOMEM; > - ofs->creator_cred = cred = prepare_creds(); > + if (!ofs->creator_cred) > + ofs->creator_cred = cred = prepare_creds(); > + else > + cred = (struct cred *)ofs->creator_cred; > if (!cred) > goto out_err; > > + old_cred = ovl_override_creds(sb); > + > err = ovl_fs_params_verify(ctx, &ofs->config); > if (err) > goto out_err; > @@ -1481,6 +1487,7 @@ int ovl_fill_super(struct super_block *sb, struct fs_context *fc) > > sb->s_root = root_dentry; > > + ovl_revert_creds(old_cred); > return 0; > > out_free_oe: > @@ -1488,6 +1495,8 @@ int ovl_fill_super(struct super_block *sb, struct fs_context *fc) > out_err: > ovl_free_fs(ofs); > sb->s_fs_info = NULL; > + if (old_cred) > + ovl_revert_creds(old_cred); > return err; > } > > > -- > 2.47.2 >
diff --git a/fs/overlayfs/params.c b/fs/overlayfs/params.c index 1115c22deca0..f2bc8acf6bf1 100644 --- a/fs/overlayfs/params.c +++ b/fs/overlayfs/params.c @@ -59,6 +59,7 @@ enum ovl_opt { Opt_metacopy, Opt_verity, Opt_volatile, + Opt_override_creds, }; static const struct constant_table ovl_parameter_bool[] = { @@ -155,6 +156,7 @@ const struct fs_parameter_spec ovl_parameter_spec[] = { fsparam_enum("metacopy", Opt_metacopy, ovl_parameter_bool), fsparam_enum("verity", Opt_verity, ovl_parameter_verity), fsparam_flag("volatile", Opt_volatile), + fsparam_flag_no("override_creds", Opt_override_creds), {} }; @@ -662,6 +664,26 @@ static int ovl_parse_param(struct fs_context *fc, struct fs_parameter *param) case Opt_userxattr: config->userxattr = true; break; + case Opt_override_creds: { + const struct cred *cred = ofs->creator_cred; + + if (!result.negated) { + if (fc->user_ns != current_user_ns()) { + err = -EINVAL; + break; + } + + ofs->creator_cred = prepare_creds(); + if (!ofs->creator_cred) { + err = -EINVAL; + break; + } + } else { + ofs->creator_cred = NULL; + } + put_cred(cred); + break; + } default: pr_err("unrecognized mount option \"%s\" or missing value\n", param->key); diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c index 86ae6f6da36b..a85071fe18fd 100644 --- a/fs/overlayfs/super.c +++ b/fs/overlayfs/super.c @@ -1305,6 +1305,7 @@ int ovl_fill_super(struct super_block *sb, struct fs_context *fc) { struct ovl_fs *ofs = sb->s_fs_info; struct ovl_fs_context *ctx = fc->fs_private; + const struct cred *old_cred = NULL; struct dentry *root_dentry; struct ovl_entry *oe; struct ovl_layer *layers; @@ -1318,10 +1319,15 @@ int ovl_fill_super(struct super_block *sb, struct fs_context *fc) sb->s_d_op = &ovl_dentry_operations; err = -ENOMEM; - ofs->creator_cred = cred = prepare_creds(); + if (!ofs->creator_cred) + ofs->creator_cred = cred = prepare_creds(); + else + cred = (struct cred *)ofs->creator_cred; if (!cred) goto out_err; + old_cred = ovl_override_creds(sb); + err = ovl_fs_params_verify(ctx, &ofs->config); if (err) goto out_err; @@ -1481,6 +1487,7 @@ int ovl_fill_super(struct super_block *sb, struct fs_context *fc) sb->s_root = root_dentry; + ovl_revert_creds(old_cred); return 0; out_free_oe: @@ -1488,6 +1495,8 @@ int ovl_fill_super(struct super_block *sb, struct fs_context *fc) out_err: ovl_free_fs(ofs); sb->s_fs_info = NULL; + if (old_cred) + ovl_revert_creds(old_cred); return err; }
Currently overlayfs uses the mounter's credentials for it's override_creds() calls. That provides a consistent permission model. This patches allows a caller to instruct overlayfs to use its credentials instead. The caller must be located in the same user namespace as the user namespace the overlayfs instance will be mounted in. This provides a consistent and simple security model. With this it is possible to e.g., mount an overlayfs instance where the mounter must have CAP_SYS_ADMIN but the credentials used for override_creds() have dropped CAP_SYS_ADMIN. It also allows the usage of custom fs{g,u}id different from the callers and other tweaks. Signed-off-by: Christian Brauner <brauner@kernel.org> --- fs/overlayfs/params.c | 22 ++++++++++++++++++++++ fs/overlayfs/super.c | 11 ++++++++++- 2 files changed, 32 insertions(+), 1 deletion(-)