Re: [PATCH 0/2] capability conversion fixes

2021-01-19 Thread Miklos Szeredi
On Tue, Jan 19, 2021 at 10:15 PM Eric W. Biederman wrote: > > Miklos Szeredi writes: > > > It turns out overlayfs is actually okay wrt. mutliple conversions, because > > it uses the right context for lower operations. I.e. before calling > > vfs_{set,get}xattr() on underlying fs, it overrides

Re: [PATCH 0/2] capability conversion fixes

2021-01-19 Thread Eric W. Biederman
Miklos Szeredi writes: > It turns out overlayfs is actually okay wrt. mutliple conversions, because > it uses the right context for lower operations. I.e. before calling > vfs_{set,get}xattr() on underlying fs, it overrides creds with that of the > mounter, so the current user ns will now match

[PATCH 0/2] capability conversion fixes

2021-01-19 Thread Miklos Szeredi
It turns out overlayfs is actually okay wrt. mutliple conversions, because it uses the right context for lower operations. I.e. before calling vfs_{set,get}xattr() on underlying fs, it overrides creds with that of the mounter, so the current user ns will now match that of overlay_sb->s_user_ns,