Skip to content

Commit 2d2f2d7

Browse files
author
Miklos Szeredi
committed
ovl: user xattr
Optionally allow using "user.overlay." namespace instead of "trusted.overlay." This is necessary for overlayfs to be able to be mounted in an unprivileged namepsace. Make the option explicit, since it makes the filesystem format be incompatible. Disable redirect_dir and metacopy options, because these would allow privilege escalation through direct manipulation of the "user.overlay.redirect" or "user.overlay.metacopy" xattrs. Signed-off-by: Miklos Szeredi <[email protected]> Reviewed-by: Amir Goldstein <[email protected]>
1 parent 82a763e commit 2d2f2d7

File tree

6 files changed

+82
-18
lines changed

6 files changed

+82
-18
lines changed

‎Documentation/filesystems/overlayfs.rst

+11-2
Original file line numberDiff line numberDiff line change
@@ -102,8 +102,8 @@ but not all filesystems that are mountable by Linux have the features
102102
needed for OverlayFS to work. The lower filesystem does not need to be
103103
writable. The lower filesystem can even be another overlayfs. The upper
104104
filesystem will normally be writable and if it is it must support the
105-
creation of trusted.* extended attributes, and must provide valid d_type in
106-
readdir responses, so NFS is not suitable.
105+
creation of trusted.* and/or user.* extended attributes, and must provide
106+
valid d_type in readdir responses, so NFS is not suitable.
107107

108108
A read-only overlay of two read-only filesystems may use any
109109
filesystem type.
@@ -594,6 +594,15 @@ fresh one. In very limited cases where the user knows that the system has
594594
not crashed and contents of upperdir are intact, The "volatile" directory
595595
can be removed.
596596

597+
598+
User xattr
599+
----------
600+
601+
The the "-o userxattr" mount option forces overlayfs to use the
602+
"user.overlay." xattr namespace instead of "trusted.overlay.". This is
603+
useful for unprivileged mounting of overlayfs.
604+
605+
597606
Testsuite
598607
---------
599608

‎fs/overlayfs/inode.c

+9-3
Original file line numberDiff line numberDiff line change
@@ -329,8 +329,14 @@ static const char *ovl_get_link(struct dentry *dentry,
329329

330330
bool ovl_is_private_xattr(struct super_block *sb, const char *name)
331331
{
332-
return strncmp(name, OVL_XATTR_PREFIX,
333-
sizeof(OVL_XATTR_PREFIX) - 1) == 0;
332+
struct ovl_fs *ofs = sb->s_fs_info;
333+
334+
if (ofs->config.userxattr)
335+
return strncmp(name, OVL_XATTR_USER_PREFIX,
336+
sizeof(OVL_XATTR_USER_PREFIX) - 1) == 0;
337+
else
338+
return strncmp(name, OVL_XATTR_TRUSTED_PREFIX,
339+
sizeof(OVL_XATTR_TRUSTED_PREFIX) - 1) == 0;
334340
}
335341

336342
int ovl_xattr_set(struct dentry *dentry, struct inode *inode, const char *name,
@@ -690,7 +696,7 @@ static void ovl_fill_inode(struct inode *inode, umode_t mode, dev_t rdev)
690696
* For the first, copy up case, the union nlink does not change, whether the
691697
* operation succeeds or fails, but the upper inode nlink may change.
692698
* Therefore, before copy up, we store the union nlink value relative to the
693-
* lower inode nlink in the index inode xattr trusted.overlay.nlink.
699+
* lower inode nlink in the index inode xattr .overlay.nlink.
694700
*
695701
* For the second, upper hardlink case, the union nlink should be incremented
696702
* or decremented IFF the operation succeeds, aligned with nlink change of the

‎fs/overlayfs/overlayfs.h

+5-3
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,9 @@ enum ovl_path_type {
2222
#define OVL_TYPE_MERGE(type) ((type) & __OVL_PATH_MERGE)
2323
#define OVL_TYPE_ORIGIN(type) ((type) & __OVL_PATH_ORIGIN)
2424

25-
#define OVL_XATTR_PREFIX XATTR_TRUSTED_PREFIX "overlay."
25+
#define OVL_XATTR_NAMESPACE "overlay."
26+
#define OVL_XATTR_TRUSTED_PREFIX XATTR_TRUSTED_PREFIX OVL_XATTR_NAMESPACE
27+
#define OVL_XATTR_USER_PREFIX XATTR_USER_PREFIX OVL_XATTR_NAMESPACE
2628

2729
enum ovl_xattr {
2830
OVL_XATTR_OPAQUE,
@@ -113,10 +115,10 @@ struct ovl_fh {
113115
#define OVL_FH_FID_OFFSET (OVL_FH_WIRE_OFFSET + \
114116
offsetof(struct ovl_fb, fid))
115117

116-
extern const char *ovl_xattr_table[];
118+
extern const char *const ovl_xattr_table[][2];
117119
static inline const char *ovl_xattr(struct ovl_fs *ofs, enum ovl_xattr ox)
118120
{
119-
return ovl_xattr_table[ox];
121+
return ovl_xattr_table[ox][ofs->config.userxattr];
120122
}
121123

122124
static inline int ovl_do_rmdir(struct inode *dir, struct dentry *dentry)

‎fs/overlayfs/ovl_entry.h

+1
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ struct ovl_config {
1818
bool nfs_export;
1919
int xino;
2020
bool metacopy;
21+
bool userxattr;
2122
bool ovl_volatile;
2223
};
2324

‎fs/overlayfs/super.c

+53-8
Original file line numberDiff line numberDiff line change
@@ -418,6 +418,7 @@ enum {
418418
OPT_UUID_ON,
419419
OPT_UUID_OFF,
420420
OPT_NFS_EXPORT_ON,
421+
OPT_USERXATTR,
421422
OPT_NFS_EXPORT_OFF,
422423
OPT_XINO_ON,
423424
OPT_XINO_OFF,
@@ -436,6 +437,7 @@ static const match_table_t ovl_tokens = {
436437
{OPT_REDIRECT_DIR, "redirect_dir=%s"},
437438
{OPT_INDEX_ON, "index=on"},
438439
{OPT_INDEX_OFF, "index=off"},
440+
{OPT_USERXATTR, "userxattr"},
439441
{OPT_UUID_ON, "uuid=on"},
440442
{OPT_UUID_OFF, "uuid=off"},
441443
{OPT_NFS_EXPORT_ON, "nfs_export=on"},
@@ -602,6 +604,10 @@ static int ovl_parse_opt(char *opt, struct ovl_config *config)
602604
config->ovl_volatile = true;
603605
break;
604606

607+
case OPT_USERXATTR:
608+
config->userxattr = true;
609+
break;
610+
605611
default:
606612
pr_err("unrecognized mount option \"%s\" or missing value\n",
607613
p);
@@ -705,6 +711,28 @@ static int ovl_parse_opt(char *opt, struct ovl_config *config)
705711
}
706712
}
707713

714+
715+
/* Resolve userxattr -> !redirect && !metacopy dependency */
716+
if (config->userxattr) {
717+
if (config->redirect_follow && redirect_opt) {
718+
pr_err("conflicting options: userxattr,redirect_dir=%s\n",
719+
config->redirect_mode);
720+
return -EINVAL;
721+
}
722+
if (config->metacopy && metacopy_opt) {
723+
pr_err("conflicting options: userxattr,metacopy=on\n");
724+
return -EINVAL;
725+
}
726+
/*
727+
* Silently disable default setting of redirect and metacopy.
728+
* This shall be the default in the future as well: these
729+
* options must be explicitly enabled if used together with
730+
* userxattr.
731+
*/
732+
config->redirect_dir = config->redirect_follow = false;
733+
config->metacopy = false;
734+
}
735+
708736
return 0;
709737
}
710738

@@ -1054,8 +1082,14 @@ ovl_posix_acl_default_xattr_handler = {
10541082
.set = ovl_posix_acl_xattr_set,
10551083
};
10561084

1057-
static const struct xattr_handler ovl_own_xattr_handler = {
1058-
.prefix = OVL_XATTR_PREFIX,
1085+
static const struct xattr_handler ovl_own_trusted_xattr_handler = {
1086+
.prefix = OVL_XATTR_TRUSTED_PREFIX,
1087+
.get = ovl_own_xattr_get,
1088+
.set = ovl_own_xattr_set,
1089+
};
1090+
1091+
static const struct xattr_handler ovl_own_user_xattr_handler = {
1092+
.prefix = OVL_XATTR_USER_PREFIX,
10591093
.get = ovl_own_xattr_get,
10601094
.set = ovl_own_xattr_set,
10611095
};
@@ -1066,12 +1100,22 @@ static const struct xattr_handler ovl_other_xattr_handler = {
10661100
.set = ovl_other_xattr_set,
10671101
};
10681102

1069-
static const struct xattr_handler *ovl_xattr_handlers[] = {
1103+
static const struct xattr_handler *ovl_trusted_xattr_handlers[] = {
1104+
#ifdef CONFIG_FS_POSIX_ACL
1105+
&ovl_posix_acl_access_xattr_handler,
1106+
&ovl_posix_acl_default_xattr_handler,
1107+
#endif
1108+
&ovl_own_trusted_xattr_handler,
1109+
&ovl_other_xattr_handler,
1110+
NULL
1111+
};
1112+
1113+
static const struct xattr_handler *ovl_user_xattr_handlers[] = {
10701114
#ifdef CONFIG_FS_POSIX_ACL
10711115
&ovl_posix_acl_access_xattr_handler,
10721116
&ovl_posix_acl_default_xattr_handler,
10731117
#endif
1074-
&ovl_own_xattr_handler,
1118+
&ovl_own_user_xattr_handler,
10751119
&ovl_other_xattr_handler,
10761120
NULL
10771121
};
@@ -1334,7 +1378,7 @@ static int ovl_make_workdir(struct super_block *sb, struct ovl_fs *ofs,
13341378
pr_warn("upper fs does not support RENAME_WHITEOUT.\n");
13351379

13361380
/*
1337-
* Check if upper/work fs supports trusted.overlay.* xattr
1381+
* Check if upper/work fs supports (trusted|user).overlay.* xattr
13381382
*/
13391383
err = ovl_do_setxattr(ofs, ofs->workdir, OVL_XATTR_OPAQUE, "0", 1);
13401384
if (err) {
@@ -1473,10 +1517,10 @@ static int ovl_get_indexdir(struct super_block *sb, struct ovl_fs *ofs,
14731517

14741518
/*
14751519
* Verify upper root is exclusively associated with index dir.
1476-
* Older kernels stored upper fh in "trusted.overlay.origin"
1520+
* Older kernels stored upper fh in ".overlay.origin"
14771521
* xattr. If that xattr exists, verify that it is a match to
14781522
* upper dir file handle. In any case, verify or set xattr
1479-
* "trusted.overlay.upper" to indicate that index may have
1523+
* ".overlay.upper" to indicate that index may have
14801524
* directory entries.
14811525
*/
14821526
if (ovl_check_origin_xattr(ofs, ofs->indexdir)) {
@@ -2014,7 +2058,8 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent)
20142058
cap_lower(cred->cap_effective, CAP_SYS_RESOURCE);
20152059

20162060
sb->s_magic = OVERLAYFS_SUPER_MAGIC;
2017-
sb->s_xattr = ovl_xattr_handlers;
2061+
sb->s_xattr = ofs->config.userxattr ? ovl_user_xattr_handlers :
2062+
ovl_trusted_xattr_handlers;
20182063
sb->s_fs_info = ofs;
20192064
sb->s_flags |= SB_POSIXACL;
20202065
sb->s_iflags |= SB_I_SKIP_SYNC;

‎fs/overlayfs/util.c

+3-2
Original file line numberDiff line numberDiff line change
@@ -585,9 +585,10 @@ bool ovl_check_dir_xattr(struct super_block *sb, struct dentry *dentry,
585585
#define OVL_XATTR_METACOPY_POSTFIX "metacopy"
586586

587587
#define OVL_XATTR_TAB_ENTRY(x) \
588-
[x] = OVL_XATTR_PREFIX x ## _POSTFIX
588+
[x] = { [false] = OVL_XATTR_TRUSTED_PREFIX x ## _POSTFIX, \
589+
[true] = OVL_XATTR_USER_PREFIX x ## _POSTFIX }
589590

590-
const char *ovl_xattr_table[] = {
591+
const char *const ovl_xattr_table[][2] = {
591592
OVL_XATTR_TAB_ENTRY(OVL_XATTR_OPAQUE),
592593
OVL_XATTR_TAB_ENTRY(OVL_XATTR_REDIRECT),
593594
OVL_XATTR_TAB_ENTRY(OVL_XATTR_ORIGIN),

0 commit comments

Comments
 (0)