path: root/security/smack
diff options
authorTycho Andersen <>2021-01-21 14:19:28 +0100
committerChristian Brauner <>2021-01-24 14:27:17 +0100
commitc7c7a1a18af4c3bb7749d33e3df3acdf0a95bbb5 (patch)
tree70987010043f447700ed119e1b05b8fb429af5dd /security/smack
parente65ce2a50cf6af216bea6fd80d771fcbb4c0aaa1 (diff)
xattr: handle idmapped mounts
When interacting with extended attributes the vfs verifies that the caller is privileged over the inode with which the extended attribute is associated. For posix access and posix default extended attributes a uid or gid can be stored on-disk. Let the functions handle posix extended attributes on idmapped mounts. If the inode is accessed through an idmapped mount we need to map it according to the mount's user namespace. Afterwards the checks are identical to non-idmapped mounts. This has no effect for e.g. security xattrs since they don't store uids or gids and don't perform permission checks on them like posix acls do. Link: Cc: Christoph Hellwig <> Cc: David Howells <> Cc: Al Viro <> Cc: Reviewed-by: Christoph Hellwig <> Reviewed-by: James Morris <> Signed-off-by: Tycho Andersen <> Signed-off-by: Christian Brauner <>
Diffstat (limited to 'security/smack')
1 files changed, 5 insertions, 3 deletions
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index f69c3dd9a0c6..746e5743accc 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -3425,7 +3425,7 @@ static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode)
if (isp->smk_flags & SMK_INODE_CHANGED) {
isp->smk_flags &= ~SMK_INODE_CHANGED;
- rc = __vfs_setxattr(dp, inode,
+ rc = __vfs_setxattr(&init_user_ns, dp, inode,
@@ -4597,12 +4597,14 @@ static int smack_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
static int smack_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
- return smack_inode_setsecurity(inode, XATTR_SMACK_SUFFIX, ctx, ctxlen, 0);
+ return smack_inode_setsecurity(inode, XATTR_SMACK_SUFFIX, ctx,
+ ctxlen, 0);
static int smack_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
- return __vfs_setxattr_noperm(dentry, XATTR_NAME_SMACK, ctx, ctxlen, 0);
+ return __vfs_setxattr_noperm(&init_user_ns, dentry, XATTR_NAME_SMACK,
+ ctx, ctxlen, 0);
static int smack_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)