tree f49f8354b04d8574a9b02e41e2107c4b40384377
parent ddc84c90538e1fdb0721cd41c313944c38449a34
author Seth Forshee <sforshee@digitalocean.com> 1660668472 -0500
committer Christian Brauner (Microsoft) <brauner@kernel.org> 1660728431 +0200
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCYvy0fAAKCRCRxhvAZXjc
 orqIAP91CFcrSiUjXK3h7bhnYhK/yN0tt9sxkknmNToB27ypzQD/cNZ/oRu9S1fZ
 2S8mgJGZ8YF6q5uI9OtLbx1fM1zScwk=
 =45mm
 -----END PGP SIGNATURE-----

fs: require CAP_SYS_ADMIN in target namespace for idmapped mounts

Idmapped mounts should not allow a user to map file ownsership into a
range of ids which is not under the control of that user. However, we
currently don't check whether the mounter is privileged wrt to the
target user namespace.

Currently no FS_USERNS_MOUNT filesystems support idmapped mounts, thus
this is not a problem as only CAP_SYS_ADMIN in init_user_ns is allowed
to set up idmapped mounts. But this could change in the future, so add a
check to refuse to create idmapped mounts when the mounter does not have
CAP_SYS_ADMIN in the target user namespace.

Fixes: bd303368b776 ("fs: support mapped mounts of mapped filesystems")
Signed-off-by: Seth Forshee <sforshee@digitalocean.com>
Reviewed-by: Christian Brauner (Microsoft) <brauner@kernel.org>
Link: https://lore.kernel.org/r/20220816164752.2595240-1-sforshee@digitalocean.com
Signed-off-by: Christian Brauner (Microsoft) <brauner@kernel.org>