Jiufei Xue 98487de318 ovl: check the capability before cred overridden ... We found that it return success when we set IMMUTABLE_FL flag to a file in docker even though the docker didn't have the capability CAP_LINUX_IMMUTABLE. The commit d1d04ef857 ("ovl: stack file ops") and dab5ca8fd9 ("ovl: add lsattr/chattr support") implemented chattr operations on a regular overlay file. ovl_real_ioctl() overridden the current process's subjective credentials with ofs->creator_cred which have the capability CAP_LINUX_IMMUTABLE so that it will return success in vfs_ioctl()->cap_capable(). Fix this by checking the capability before cred overridden. And here we only care about APPEND_FL and IMMUTABLE_FL, so get these information from inode. [SzM: move check and call to underlying fs inside inode locked region to prevent two such calls from racing with each other] Signed-off-by: Jiufei Xue <jiufei.xue@linux.alibaba.com> Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>		2019-05-06 14:00:37 +02:00
..
copy_up.c	ovl: fix missing upper fs freeze protection on copy up for ioctl	2019-05-06 13:54:50 +02:00
dir.c	ovl: fix missing override creds in link of a metacopy upper	2018-11-19 16:21:29 +01:00
export.c	ovl: fix decode of dir file handle with multi lower layers	2018-11-21 10:44:48 +01:00
file.c	ovl: check the capability before cred overridden	2019-05-06 14:00:37 +02:00
inode.c	Revert "ovl: relax permission checking on underlying layers"	2018-12-04 11:31:30 +01:00
Kconfig	ovl: Provide a mount option metacopy=on/off for metadata copyup	2018-07-20 09:56:06 +02:00
Makefile	ovl: stack file ops	2018-07-18 15:44:41 +02:00
namei.c	ovl: fix error handling in ovl_verify_set_fh()	2018-10-26 23:34:39 +02:00
overlayfs.h	ovl: fix missing upper fs freeze protection on copy up for ioctl	2019-05-06 13:54:50 +02:00
ovl_entry.h	ovl: Store lower data inode in ovl_inode	2018-07-20 09:56:11 +02:00
readdir.c	ovl: fix wrong use of impure dir cache in ovl_iterate()	2018-07-17 16:04:34 +02:00
super.c	ovl: automatically enable redirect_dir on metacopy=on	2018-11-01 21:31:39 +01:00
util.c	ovl: Do not lose security.capability xattr over metadata file copy-up	2019-02-13 11:14:46 +01:00