From patchwork Fri Dec 22 14:32:31 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dongsu Park X-Patchwork-Id: 10130583 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id BB26F60318 for ; Fri, 22 Dec 2017 14:33:44 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id B284529FA9 for ; Fri, 22 Dec 2017 14:33:44 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id A780129FE9; Fri, 22 Dec 2017 14:33:44 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.0 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, RCVD_IN_DNSWL_HI autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 4316229FA9 for ; Fri, 22 Dec 2017 14:33:44 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756410AbdLVOci (ORCPT ); Fri, 22 Dec 2017 09:32:38 -0500 Received: from mail-wm0-f68.google.com ([74.125.82.68]:41998 "EHLO mail-wm0-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756184AbdLVOb1 (ORCPT ); Fri, 22 Dec 2017 09:31:27 -0500 Received: by mail-wm0-f68.google.com with SMTP id b199so22295194wme.1 for ; Fri, 22 Dec 2017 06:31:27 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kinvolk.io; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=VG7YtuYg/4iE4s2SpedWjBTYTsZKmzrIa77SW8brISo=; b=Ql7rcHC74VMs5bphjA1OXOyft4GYsvKK6Fuy9tf4rXWPofywNz6HNUGDGYYuaY1rgv sg41G72Gnpf6xX5ceyp7m7x2O3XlGqRpgC+QoKNXa8ojp5nKxvGOYXO5iLTX1M0PF6qR lzg02wgK3E0tesC32DxMl7PJUFTejhxrs12vk= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=VG7YtuYg/4iE4s2SpedWjBTYTsZKmzrIa77SW8brISo=; b=NEHA+0sR6Lt3XApEiK69AwEZ06t58gpkteQQcKLO2UO94v6xXhukzrGWd5tyqFdWV2 dtQhO6O5x2AjZwML2D4Rs1oOH/2n4T4/aOambLoiBYzNI0y6Q8oV5ROgCgukVBOsQ0JG Dc8gDnjux/GeWvWtQHtmsrDFa6tOZoF/SnrdEMXbiu8iCL67T8jDlrykUDGsRSLeBI9e agccivEA1gEXzV+KvVi+1UgSwhIlnDUm64mf6AKKcILyEkfQL6YmzrYK80Qs0eJP+D6X ulsOTjSFw694f17seQJUH9F4TThhnx/BJjAKFnvuLRctyxg3jmclv+qTOmm4EQeYofX4 T8tQ== X-Gm-Message-State: AKGB3mJQzIPSKon1bX6wtRUDjQnHbh+7GXLE7qYtITJcZE3jch2QRrzA k6tKffgvq+rUiVljO60PWjdYrg== X-Google-Smtp-Source: ACJfBou92uR23uTGMPD398IwPfstRHQmdLBCosNcfRv93OGZfs0YH9qxJ0LY66WQi1U51WVBDeHeBA== X-Received: by 10.80.165.41 with SMTP id y38mr15297130edb.72.1513953086556; Fri, 22 Dec 2017 06:31:26 -0800 (PST) Received: from dberlin.localdomain ([178.19.216.175]) by smtp.gmail.com with ESMTPSA id j39sm19698065ede.38.2017.12.22.06.31.25 (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Fri, 22 Dec 2017 06:31:26 -0800 (PST) From: Dongsu Park To: linux-kernel@vger.kernel.org Cc: containers@lists.linux-foundation.org, Alban Crequy , "Eric W . Biederman" , Miklos Szeredi , Seth Forshee , Sargun Dhillon , Dongsu Park , linux-fsdevel@vger.kernel.org, Alexander Viro Subject: [PATCH 07/11] fs: Allow CAP_SYS_ADMIN in s_user_ns to freeze and thaw filesystems Date: Fri, 22 Dec 2017 15:32:31 +0100 Message-Id: <61a37f0b159dd56825696d8d3beb8eaffdf1f72f.1512041070.git.dongsu@kinvolk.io> X-Mailer: git-send-email 2.13.6 In-Reply-To: References: Sender: linux-fsdevel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-fsdevel@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Seth Forshee The user in control of a super block should be allowed to freeze and thaw it. Relax the restrictions on the FIFREEZE and FITHAW ioctls to require CAP_SYS_ADMIN in s_user_ns. Cc: linux-fsdevel@vger.kernel.org Cc: linux-kernel@vger.kernel.org Cc: Alexander Viro Signed-off-by: Seth Forshee Signed-off-by: Dongsu Park Reviewed-by: Serge Hallyn --- fs/ioctl.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/ioctl.c b/fs/ioctl.c index 5ace7efb..8c628a8d 100644 --- a/fs/ioctl.c +++ b/fs/ioctl.c @@ -549,7 +549,7 @@ static int ioctl_fsfreeze(struct file *filp) { struct super_block *sb = file_inode(filp)->i_sb; - if (!capable(CAP_SYS_ADMIN)) + if (!ns_capable(sb->s_user_ns, CAP_SYS_ADMIN)) return -EPERM; /* If filesystem doesn't support freeze feature, return. */ @@ -566,7 +566,7 @@ static int ioctl_fsthaw(struct file *filp) { struct super_block *sb = file_inode(filp)->i_sb; - if (!capable(CAP_SYS_ADMIN)) + if (!ns_capable(sb->s_user_ns, CAP_SYS_ADMIN)) return -EPERM; /* Thaw */