Merge tag 'idmapped-mounts-v5.12' of git://git.kernel.org/pub/scm/linux/kernel/git...

[platform/kernel/linux-rpi.git] / security / commoncap.c

diff --git a/security/commoncap.c b/security/commoncap.c
index 234b074..28f4d25 100644 (file)
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -380,10 +380,11 @@ int cap_inode_getsecurity(struct user_namespace *mnt_userns,
 {
        int size, ret;
        kuid_t kroot;
+       u32 nsmagic, magic;
        uid_t root, mappedroot;
        char *tmpbuf = NULL;
        struct vfs_cap_data *cap;
-       struct vfs_ns_cap_data *nscap;
+       struct vfs_ns_cap_data *nscap = NULL;
        struct dentry *dentry;
        struct user_namespace *fs_ns;
 
@@ -405,20 +406,15 @@ int cap_inode_getsecurity(struct user_namespace *mnt_userns,
        fs_ns = inode->i_sb->s_user_ns;
        cap = (struct vfs_cap_data *) tmpbuf;
        if (is_v2header((size_t) ret, cap)) {
-               /* If this is sizeof(vfs_cap_data) then we're ok with the
-                * on-disk value, so return that.  */
-               if (alloc)
-                       *buffer = tmpbuf;
-               else
-                       kfree(tmpbuf);
-               return ret;
-       } else if (!is_v3header((size_t) ret, cap)) {
-               kfree(tmpbuf);
-               return -EINVAL;
+               root = 0;
+       } else if (is_v3header((size_t) ret, cap)) {
+               nscap = (struct vfs_ns_cap_data *) tmpbuf;
+               root = le32_to_cpu(nscap->rootid);
+       } else {
+               size = -EINVAL;
+               goto out_free;
        }
 
-       nscap = (struct vfs_ns_cap_data *) tmpbuf;
-       root = le32_to_cpu(nscap->rootid);
        kroot = make_kuid(fs_ns, root);
 
        /* If this is an idmapped mount shift the kuid. */
@@ -428,26 +424,46 @@ int cap_inode_getsecurity(struct user_namespace *mnt_userns,
         * this as a nscap. */
        mappedroot = from_kuid(current_user_ns(), kroot);
        if (mappedroot != (uid_t)-1 && mappedroot != (uid_t)0) {
+               size = sizeof(struct vfs_ns_cap_data);
                if (alloc) {
-                       *buffer = tmpbuf;
+                       if (!nscap) {
+                               /* v2 -> v3 conversion */
+                               nscap = kzalloc(size, GFP_ATOMIC);
+                               if (!nscap) {
+                                       size = -ENOMEM;
+                                       goto out_free;
+                               }
+                               nsmagic = VFS_CAP_REVISION_3;
+                               magic = le32_to_cpu(cap->magic_etc);
+                               if (magic & VFS_CAP_FLAGS_EFFECTIVE)
+                                       nsmagic |= VFS_CAP_FLAGS_EFFECTIVE;
+                               memcpy(&nscap->data, &cap->data, sizeof(__le32) * 2 * VFS_CAP_U32);
+                               nscap->magic_etc = cpu_to_le32(nsmagic);
+                       } else {
+                               /* use allocated v3 buffer */
+                               tmpbuf = NULL;
+                       }
                        nscap->rootid = cpu_to_le32(mappedroot);
-               } else
-                       kfree(tmpbuf);
-               return size;
+                       *buffer = nscap;
+               }
+               goto out_free;
        }
 
        if (!rootid_owns_currentns(kroot)) {
-               kfree(tmpbuf);
-               return -EOPNOTSUPP;
+               size = -EOVERFLOW;
+               goto out_free;
        }
 
        /* This comes from a parent namespace.  Return as a v2 capability */
        size = sizeof(struct vfs_cap_data);
        if (alloc) {
-               *buffer = kmalloc(size, GFP_ATOMIC);
-               if (*buffer) {
-                       struct vfs_cap_data *cap = *buffer;
-                       __le32 nsmagic, magic;
+               if (nscap) {
+                       /* v3 -> v2 conversion */
+                       cap = kzalloc(size, GFP_ATOMIC);
+                       if (!cap) {
+                               size = -ENOMEM;
+                               goto out_free;
+                       }
                        magic = VFS_CAP_REVISION_2;
                        nsmagic = le32_to_cpu(nscap->magic_etc);
                        if (nsmagic & VFS_CAP_FLAGS_EFFECTIVE)
@@ -455,9 +471,12 @@ int cap_inode_getsecurity(struct user_namespace *mnt_userns,
                        memcpy(&cap->data, &nscap->data, sizeof(__le32) * 2 * VFS_CAP_U32);
                        cap->magic_etc = cpu_to_le32(magic);
                } else {
-                       size = -ENOMEM;
+                       /* use unconverted v2 */
+                       tmpbuf = NULL;
                }
+               *buffer = cap;
        }
+out_free:
        kfree(tmpbuf);
        return size;
 }
@@ -524,7 +543,8 @@ int cap_convert_nscap(struct user_namespace *mnt_userns, struct dentry *dentry,
        __u32 magic, nsmagic;
        struct inode *inode = d_backing_inode(dentry);
        struct user_namespace *task_ns = current_user_ns(),
-               *fs_ns = inode->i_sb->s_user_ns;
+               *fs_ns = inode->i_sb->s_user_ns,
+               *ancestor;
        kuid_t rootid;
        size_t newsize;
 
@@ -547,6 +567,15 @@ int cap_convert_nscap(struct user_namespace *mnt_userns, struct dentry *dentry,
        if (nsrootid == -1)
                return -EINVAL;
 
+       /*
+        * Do not allow allow adding a v3 filesystem capability xattr
+        * if the rootid field is ambiguous.
+        */
+       for (ancestor = task_ns->parent; ancestor; ancestor = ancestor->parent) {
+               if (from_kuid(ancestor, rootid) == 0)
+                       return -EINVAL;
+       }
+
        newsize = sizeof(struct vfs_ns_cap_data);
        nscap = kmalloc(newsize, GFP_ATOMIC);
        if (!nscap)