• Eric W. Biederman's avatar
    fuse: Support fuse filesystems outside of init_user_ns · 8cb08329
    Eric W. Biederman authored
    In order to support mounts from namespaces other than init_user_ns, fuse
    must translate uids and gids to/from the userns of the process servicing
    requests on /dev/fuse. This patch does that, with a couple of restrictions
    on the namespace:
    
     - The userns for the fuse connection is fixed to the namespace
       from which /dev/fuse is opened.
    
     - The namespace must be the same as s_user_ns.
    
    These restrictions simplify the implementation by avoiding the need to pass
    around userns references and by allowing fuse to rely on the checks in
    setattr_prepare for ownership changes.  Either restriction could be relaxed
    in the future if needed.
    
    For cuse the userns used is the opener of /dev/cuse.  Semantically the cuse
    support does not appear safe for unprivileged users.  Practically the
    permissions on /dev/cuse only make it accessible to the global root user.
    If something slips through the cracks in a user namespace the only users
    who will be able to use the cuse device are those users mapped into the
    user namespace.
    
    Translation in the posix acl is updated to use the uuser namespace of the
    filesystem.  Avoiding cases which might bypass this translation is handled
    in a following change.
    
    This change is stronlgy based on a similar change from Seth Forshee and
    Dongsu Park.
    
    Cc: Seth Forshee <seth.forshee@canonical.com>
    Cc: Dongsu Park <dongsu@kinvolk.io>
    Signed-off-by: default avatarEric W. Biederman <ebiederm@xmission.com>
    Signed-off-by: default avatarMiklos Szeredi <mszeredi@redhat.com>
    8cb08329
cuse.c 15.6 KB