[PATCH] fuse: Ensure posix acls are translated outside of init_user_ns
seth.forshee at canonical.com
Tue May 8 13:37:50 UTC 2018
On Fri, May 04, 2018 at 11:47:28AM -0500, Eric W. Biederman wrote:
> Ensure the translation happens by failing to read or write
> posix acls when the filesystem has not indicated it supports
> posix acls.
> This ensures that modern cached posix acl support is available
> and used when dealing with posix acls. This is important
> because only that path has the code to convernt the uids and
> gids in posix acls into the user namespace of a fuse filesystem.
> Signed-off-by: "Eric W. Biederman" <ebiederm at xmission.com>
> Miklos after several attempts to handle this better last cycle. I
> figure we should go with the stupid version for now. I think I know
> how to do better but I don't want that to gate forward progress on
> fully unprivileged fuse mounts. Especially as this is the last known
> issue to deal with.
This seems reasonable as a short-term measure.
Acked-by: Seth Forshee <seth.forshee at canonical.com>
More information about the Containers