@@ -1294,6 +1294,25 @@ void loopfs_remove_locked(struct loop_device *lo)
loop_remove(lo);
mutex_unlock(&loop_ctl_mutex);
}
+
+static bool loop_capable(const struct loop_device *lo, int cap)
+{
+ struct super_block *sb;
+ struct user_namespace *ns;
+
+ sb = loopfs_i_sb(lo->lo_loopfs_i);
+ if (sb)
+ ns = sb->s_user_ns;
+ else
+ ns = &init_user_ns;
+
+ return ns_capable(ns, cap);
+}
+#else /* !CONFIG_BLK_DEV_LOOPFS */
+static inline bool loop_capable(const struct loop_device *lo, int cap)
+{
+ return capable(cap);
+}
#endif /* CONFIG_BLK_DEV_LOOPFS */
static int
@@ -1310,7 +1329,7 @@ loop_set_status(struct loop_device *lo, const struct loop_info64 *info)
return err;
if (lo->lo_encrypt_key_size &&
!uid_eq(lo->lo_key_owner, uid) &&
- !capable(CAP_SYS_ADMIN)) {
+ !loop_capable(lo, CAP_SYS_ADMIN)) {
err = -EPERM;
goto out_unlock;
}
@@ -1441,7 +1460,7 @@ loop_get_status(struct loop_device *lo, struct loop_info64 *info)
memcpy(info->lo_crypt_name, lo->lo_crypt_name, LO_NAME_SIZE);
info->lo_encrypt_type =
lo->lo_encryption ? lo->lo_encryption->number : 0;
- if (lo->lo_encrypt_key_size && capable(CAP_SYS_ADMIN)) {
+ if (lo->lo_encrypt_key_size && loop_capable(lo, CAP_SYS_ADMIN)) {
info->lo_encrypt_key_size = lo->lo_encrypt_key_size;
memcpy(info->lo_encrypt_key, lo->lo_encrypt_key,
lo->lo_encrypt_key_size);
@@ -1665,7 +1684,7 @@ static int lo_ioctl(struct block_device *bdev, fmode_t mode,
return loop_clr_fd(lo);
case LOOP_SET_STATUS:
err = -EPERM;
- if ((mode & FMODE_WRITE) || capable(CAP_SYS_ADMIN)) {
+ if ((mode & FMODE_WRITE) || loop_capable(lo, CAP_SYS_ADMIN)) {
err = loop_set_status_old(lo,
(struct loop_info __user *)arg);
}
@@ -1674,7 +1693,7 @@ static int lo_ioctl(struct block_device *bdev, fmode_t mode,
return loop_get_status_old(lo, (struct loop_info __user *) arg);
case LOOP_SET_STATUS64:
err = -EPERM;
- if ((mode & FMODE_WRITE) || capable(CAP_SYS_ADMIN)) {
+ if ((mode & FMODE_WRITE) || loop_capable(lo, CAP_SYS_ADMIN)) {
err = loop_set_status64(lo,
(struct loop_info64 __user *) arg);
}
@@ -1684,7 +1703,7 @@ static int lo_ioctl(struct block_device *bdev, fmode_t mode,
case LOOP_SET_CAPACITY:
case LOOP_SET_DIRECT_IO:
case LOOP_SET_BLOCK_SIZE:
- if (!(mode & FMODE_WRITE) && !capable(CAP_SYS_ADMIN))
+ if (!(mode & FMODE_WRITE) && !loop_capable(lo, CAP_SYS_ADMIN))
return -EPERM;
/* Fall through */
default:
The following LOOP_GET_STATUS, LOOP_SET_STATUS, and LOOP_SET_BLOCK_SIZE operations are now allowed in non-initial namespaces. Most other operations were already possible before. Cc: Jens Axboe <axboe@kernel.dk> Cc: Seth Forshee <seth.forshee@canonical.com> Cc: Tom Gundersen <teg@jklm.no> Cc: Tejun Heo <tj@kernel.org> Cc: Christian Kellner <ckellner@redhat.com> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: "David S. Miller" <davem@davemloft.net> Cc: David Rheinsberg <david.rheinsberg@gmail.com> Cc: Dmitry Vyukov <dvyukov@google.com> Cc: "Rafael J. Wysocki" <rafael@kernel.org> Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com> --- drivers/block/loop.c | 29 ++++++++++++++++++++++++----- 1 file changed, 24 insertions(+), 5 deletions(-)