Unverified Commit 4b789936 authored by Christian Brauner's avatar Christian Brauner
Browse files

fat: handle idmapped mounts 

Let fat handle idmapped mounts. This allows to have the same fat mount
appear in multiple locations with different id mappings. This allows to
expose a vfat formatted USB stick to multiple user with different ids on
the host or in user namespaces allowing for dac permissions:

mount -o uid=1000,gid=1000 /dev/sdb /mnt

u1001@f2-vm:/lower1$ ls -ln /mnt/
total 4
-rwxr-xr-x 1 1000 1000 4 Oct 28 03:44 aaa
-rwxr-xr-x 1 1000 1000 0 Oct 28 01:09 bbb
-rwxr-xr-x 1 1000 1000 0 Oct 28 01:10 ccc
-rwxr-xr-x 1 1000 1000 0 Oct 28 03:46 ddd
-rwxr-xr-x 1 1000 1000 0 Oct 28 04:01 eee

mount-idmapped --map-mount b:1000:1001:1

u1001@f2-vm:/lower1$ ls -ln /lower1/
total 4
-rwxr-xr-x 1 1001 1001 4 Oct 28 03:44 aaa
-rwxr-xr-x 1 1001 1001 0 Oct 28 01:09 bbb
-rwxr-xr-x 1 1001 1001 0 Oct 28 01:10 ccc
-rwxr-xr-x 1 1001 1001 0 Oct 28 03:46 ddd
-rwxr-xr-x 1 1001 1001 0 Oct 28 04:01 eee

u1001@f2-vm:/lower1$ touch /lower1/fff

u1001@f2-vm:/lower1$ ls -ln /lower1/fff
-rwxr-xr-x 1 1001 1001 0 Oct 28 04:03 /lower1/fff

u1001@f2-vm:/lower1$ ls -ln /mnt/fff
-rwxr-xr-x 1 1000 1000 0 Oct 28 04:03 /mnt/fff

Link: https://lore.kernel.org/r/20210121131959.646623-38-christian.brauner@ubuntu.com


Cc: Christoph Hellwig <hch@lst.de>
Cc: David Howells <dhowells@redhat.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: linux-fsdevel@vger.kernel.org
Signed-off-by: default avatarChristian Brauner <christian.brauner@ubuntu.com>
parent 01eadc8d

fs/fat/file.c

+8 −7
Original line number Diff line number Diff line
@@ -398,7 +398,7 @@ int fat_getattr(struct user_namespace *mnt_userns, const struct path *path, 
		struct kstat *stat, u32 request_mask, unsigned int flags)

{

	struct inode *inode = d_inode(path->dentry);

	generic_fillattr(&init_user_ns, inode, stat);

	generic_fillattr(mnt_userns, inode, stat);

	stat->blksize = MSDOS_SB(inode->i_sb)->cluster_size;



	if (MSDOS_SB(inode->i_sb)->options.nfs == FAT_NFS_NOSTALE_RO) {
@@ -447,12 +447,13 @@ static int fat_sanitize_mode(const struct msdos_sb_info *sbi, 
	return 0;

}



static int fat_allow_set_time(struct msdos_sb_info *sbi, struct inode *inode)

static int fat_allow_set_time(struct user_namespace *mnt_userns,

			      struct msdos_sb_info *sbi, struct inode *inode)

{

	umode_t allow_utime = sbi->options.allow_utime;



	if (!uid_eq(current_fsuid(), inode->i_uid)) {

		if (in_group_p(inode->i_gid))

	if (!uid_eq(current_fsuid(), i_uid_into_mnt(mnt_userns, inode))) {

		if (in_group_p(i_gid_into_mnt(mnt_userns, inode)))

			allow_utime >>= 3;

		if (allow_utime & MAY_WRITE)

			return 1;
@@ -477,11 +478,11 @@ int fat_setattr(struct user_namespace *mnt_userns, struct dentry *dentry, 
	/* Check for setting the inode time. */

	ia_valid = attr->ia_valid;

	if (ia_valid & TIMES_SET_FLAGS) {

		if (fat_allow_set_time(sbi, inode))

		if (fat_allow_set_time(mnt_userns, sbi, inode))

			attr->ia_valid &= ~TIMES_SET_FLAGS;

	}



	error = setattr_prepare(&init_user_ns, dentry, attr);

	error = setattr_prepare(mnt_userns, dentry, attr);

	attr->ia_valid = ia_valid;

	if (error) {

		if (sbi->options.quiet)
@@ -551,7 +552,7 @@ int fat_setattr(struct user_namespace *mnt_userns, struct dentry *dentry, 
		fat_truncate_time(inode, &attr->ia_mtime, S_MTIME);

	attr->ia_valid &= ~(ATTR_ATIME|ATTR_CTIME|ATTR_MTIME);



	setattr_copy(&init_user_ns, inode, attr);

	setattr_copy(mnt_userns, inode, attr);

	mark_inode_dirty(inode);

out:

	return error;

fs/fat/namei_msdos.c

+1 −1
Original line number Diff line number Diff line
@@ -667,7 +667,7 @@ static struct file_system_type msdos_fs_type = { 
	.name		= "msdos",

	.mount		= msdos_mount,

	.kill_sb	= kill_block_super,

	.fs_flags	= FS_REQUIRES_DEV,

	.fs_flags	= FS_REQUIRES_DEV | FS_ALLOW_IDMAP,

};

MODULE_ALIAS_FS("msdos");

fs/fat/namei_vfat.c

+1 −1
Original line number Diff line number Diff line
@@ -1063,7 +1063,7 @@ static struct file_system_type vfat_fs_type = { 
	.name		= "vfat",

	.mount		= vfat_mount,

	.kill_sb	= kill_block_super,

	.fs_flags	= FS_REQUIRES_DEV,

	.fs_flags	= FS_REQUIRES_DEV | FS_ALLOW_IDMAP,

};

MODULE_ALIAS_FS("vfat");