Ubuntu
linux-armadaxp package

  1. Trusty (14.04)
  2. Bug #1535150
  3. Comment #6

Comment 6 for bug 1535150

Revision history for this message
Seth Forshee (sforshee) wrote : Re: overlayfs over fuse should refuse copy_up of files if uid/gid not mapped

I've confirmed the bug, using fuseext2 to mount a filesystem containing an suid-root executable.

Tyler: file_remove_privs() only gets called on write. overlayfs copies up the file as soon as it is opened read/write, no writing necessary. The suid file gets copied into upperdir, then it can be executed from init_user_ns.