UBUNTU: SAUCE: (namespace) fs: Don't remove suid for CAP_FSETID for userns root

Expand the check in should_remove_suid() to keep privileges for
CAP_FSETID in s_user_ns rather than init_user_ns.

--EWB Changed from ns_capable(sb->s_user_ns, ) to capable_wrt_inode_uidgid

Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>

diff --git a/fs/inode.c b/fs/inode.c
index 88110fd0b282e49246dc9cd93a1d6e173d951d7b..046cc930d8542656613c9e182bcdb51a1a764a00 100644 (file)
--- a/fs/inode.c
+++ b/fs/inode.c
@@ -1736,7 +1736,8 @@ EXPORT_SYMBOL(touch_atime);
  */
 int should_remove_suid(struct dentry *dentry)
 {
-       umode_t mode = d_inode(dentry)->i_mode;
+       struct inode *inode = d_inode(dentry);
+       umode_t mode = inode->i_mode;
        int kill = 0;
 
        /* suid always must be killed */
@@ -1750,7 +1751,8 @@ int should_remove_suid(struct dentry *dentry)
        if (unlikely((mode & S_ISGID) && (mode & S_IXGRP)))
                kill |= ATTR_KILL_SGID;
 
-       if (unlikely(kill && !capable(CAP_FSETID) && S_ISREG(mode)))
+       if (unlikely(kill && !capable_wrt_inode_uidgid(inode, CAP_FSETID) &&
+                    S_ISREG(mode)))
                return kill;
 
        return 0;