tree 0c4a927cc4377a53b413c798416b664164aa1fad
parent c51f72eeb3ce34d55793d9ccbd8ff667559c5992
author Christian Brauner <christian@brauner.io> 1553026512 +0100
committer Christian Brauner <christian@brauner.io> 1553127544 +0100
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE7btrcuORLb1XUhEwjrBW1T7ssS0FAlyS2HsACgkQjrBW1T7s
 sS3e8hAA4OAUc6GbhQXS1ONcNogZYtVddkXgJ7XNJv69YZSbycG5wJW2Jb8oqr3G
 DVrJBOReMOi/lGfvaAstCOl6hm/WItzrSxMVtw7w1TWMIJPWhRZl1JPYd8UP6xJk
 uWPeQh8Qv6NU5/aN9Mph3DTgCU7iwH1tzb8b6ZKqn4+E334fw8Nqi+KfuObz0dlO
 hHeuoSZJqpauiNiDbDk0jkEz1pTYUz7+cEYoLglxq3AC3fDgZJHJuOkbvmEHfgtR
 Eb/SEKrzU6ygteS+Sr9VbLkCiM25QQKhdIMyaxrEiqjTR0cXGB1vTrvVIGHFN1ro
 dNtdnMQgOszcP9Qw9SKb/zSI8jpgkOmXIDZ048bdewNIGEh8zbpFP+nTwa+5uP9V
 1+yuRPVHmiO5D3uz6hvDToHS/mbfe/j6Dm+QvgA3kRVFr/4S1vexpoV+CX9qd9VR
 wKEdhM+IU5ey/nlNL+XdBbs/YmNStPE7P+am5bcPSMm/UlyCmvFrKNWY8GtKzhe5
 Ihon8UBxAWwoBSFtUctOHD82UQ6uk1xHmy1c88z8gZ6FPtqV7cshbg14M/2X7aVP
 yqJk2N/SGk6geLSd3EU1u6ES0AdGrdsbrARG6oAJlM6ntLthKKz1ruUFixZhiVSf
 WMlsdzqWr/JfgZ56OgFdIp3Fm+hzenpjzGiOkEppWa9svAe8QsI=
 =jzLf
 -----END PGP SIGNATURE-----

[HERE BE DRAGONS]: shiftfs: support some btrfs ioctls

Shiftfs currently only passes through a few ioctl()s to the underlay. These
are ioctl()s that are generally considered safe. Doing it for random
ioctl()s would be a security issue. Permissions for ioctl()s are not
checked before the filesystem gets involved so if we were to override
credentials we e.g. could do a btrfs tree search in the underlay which we
normally wouldn't be allowed to do.
However, the btrfs filesystem allows unprivileged users to perform various
operations through its ioctl() interface. With shiftfs these ioctl() are
currently not working. To not regress users that expect btrfs ioctl()s to
work in unprivileged containers we can create a whitelist of ioctl()s that
we allow to go through to the underlay and for which we also switch
credentials.
The main problem is how we switch credentials. Since permissions checks for
ioctl()s are
done by the actual file system and not by the vfs this would mean that any
additional capable(<cap>)-based checks done by the filesystem would
unconditonally pass after we switch credentials. So to make credential
switching safe we drop *all* capabilities when switching credentials. This
means that only inode-based permission checks will pass.

Btrfs also allows unprivileged users to delete snapshots when the
filesystem is mounted with user_subvol_rm_allowed mount option or if the
the callers is capable(CAP_SYS_ADMIN). The latter should never be the case
with unprivileged users. To make sure we only allow removal of snapshots in
the former case we drop all capabilities (see above) when switching
credentials.

Additonally, btrfs allows the creation of snapshots. To make this work we
need to be (too) clever. When doing snapshots btrfs requires that an fd to
the directory the snapshot is supposed to be created in be passed along.
This fd obviously references a shiftfs file and as such a shiftfs dentry
and inode.  This will cause btrfs to yell EXDEV. To circumnavigate this
problem we need to silently temporarily replace the passed in fd with an fd
that refers to a file that references a btrfs dentry and inode.

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>