From 5c4a65d72e22f094a42ef319744eb7070c041d43 Mon Sep 17 00:00:00 2001 From: Andy Whitcroft Date: Tue, 17 Jan 2012 17:58:34 +0000 Subject: [PATCH] overlayfs: apply device cgroup and security permissions to overlay files When checking permissions on an overlayfs inode we do not take into account either device cgroup restrictions nor security permissions. This allows a user to mount an overlayfs layer over a restricted device directory and by pass those permissions to open otherwise restricted files. Use devcgroup_inode_permission() and security_inode_permission() against the underlying inodes when calculating ovl_permission(). BugLink: http://bugs.launchpad.net/bugs/915941 Signed-off-by: Andy Whitcroft --- fs/overlayfs/inode.c | 7 +++++++ 1 files changed, 7 insertions(+), 0 deletions(-) diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c index ce39fab..1551032 100644 --- a/fs/overlayfs/inode.c +++ b/fs/overlayfs/inode.c @@ -10,6 +10,8 @@ #include #include #include +#include +#include #include "overlayfs.h" int ovl_setattr(struct dentry *dentry, struct iattr *attr) @@ -118,6 +120,11 @@ int ovl_permission(struct inode *inode, int mask, unsigned int flags) else err = generic_permission(realinode, mask, flags, realinode->i_op->check_acl); + + if (!err) + err = devcgroup_inode_permission(realinode, mask); + if (!err) + err = security_inode_permission(realinode, mask); out_dput: dput(alias); return err; -- 1.7.5.4