ovl: modify ovl_permission() to do checks on two inodes

Right now ovl_permission() calls __inode_permission(realinode), to do
permission checks on real inode and no checks are done on overlay inode.

Modify it to do checks both on overlay inode as well as underlying inode.
Checks on overlay inode will be done with the creds of calling task while
checks on underlying inode will be done with the creds of mounter.

Signed-off-by: Vivek Goyal <vgoyal@redhat.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Orabug: 26401569

(backport upstream commit c0ca3d70e8d3cf81e2255a217f7ca402f5ed0862)

Signed-off-by: Shan Hai <shan.hai@oracle.com>
Reviewed-by: Somasundaram Krishnasamy <somasundaram.krishnasamy@oracle.com>

diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c
index a5931a648273ab5a2dc6c3f59a91ef5f1b12dafa..690febf7dd6ee83a1e4c73a2e0e64a2a8fb21958 100644 (file)
--- a/fs/overlayfs/inode.c
+++ b/fs/overlayfs/inode.c
@@ -96,6 +96,7 @@ int ovl_permission(struct inode *inode, int mask)
        bool is_upper;
        struct dentry *realdentry = ovl_entry_real(oe, &is_upper);
        struct inode *realinode;
+       const struct cred *old_cred;
        int err;
 
        if (ovl_is_default_permissions(inode)) {
@@ -149,7 +150,19 @@ int ovl_permission(struct inode *inode, int mask)
                        return -EROFS;
        }
 
-       return __inode_permission(realinode, mask);
+       /*
+        * Check overlay inode with the creds of task and underlying inode
+        * with creds of mounter
+        */
+       err = generic_permission(inode, mask);
+       if (err)
+               return err;
+
+       old_cred = ovl_override_creds(inode->i_sb);
+       err = __inode_permission(realinode, mask);
+       revert_creds(old_cred);
+
+       return err;
 }
 
 
@@ -343,9 +356,6 @@ struct posix_acl *ovl_get_acl(struct inode *inode, int type)
 {
        struct inode *realinode = ovl_inode_real(inode);
 
-       if (!realinode)
-               return ERR_PTR(-ENOENT);
-
        if (!IS_POSIXACL(realinode))
                return NULL;