fs,userns: Change inode_capable to capable_wrt_inode_uidgid

Browse source

The kernel has no concept of capabilities with respect to inodes; inodes
exist independently of namespaces.  For example, inode_capable(inode,
CAP_LINUX_IMMUTABLE) would be nonsense.

This patch changes inode_capable to check for uid and gid mappings and
renames it to capable_wrt_inode_uidgid, which should make it more
obvious what it does.

Fixes CVE-2014-4014.

Cc: Theodore Ts'o <tytso@mit.edu>
Cc: Serge Hallyn <serge.hallyn@ubuntu.com>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Dave Chinner <david@fromorbit.com>
Cc: stable@vger.kernel.org
Signed-off-by: Andy Lutomirski <luto@amacapital.net>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

...

This commit is contained in:

Andy Lutomirski 2014-06-10 12:45:42 -07:00 • committed by Linus Torvalds

parent 5b174fd647

commit 23adbe12ef

6 changed files with 27 additions and 26 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

8

fs/attr.c

View file

10

fs/inode.c

View file

11

fs/namei.c

View file

2

fs/xfs/xfs_ioctl.c

View file

2

include/linux/capability.h

View file

20

kernel/capability.c

View file