target/linux/generic/patches-4.4/051-0004-ovl-remove-posix_acl_default-from-workdir.patch

   1 From c11b9fdd6a612f376a5e886505f1c54c16d8c380 Mon Sep 17 00:00:00 2001
   2 From: Miklos Szeredi <mszeredi@redhat.com>
   3 Date: Thu, 1 Sep 2016 11:11:59 +0200
   4 Subject: [PATCH] ovl: remove posix_acl_default from workdir
   5
   6 Clear out posix acl xattrs on workdir and also reset the mode after
   7 creation so that an inherited sgid bit is cleared.
   8
   9 Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
  10 Cc: <stable@vger.kernel.org>
  11 ---
  12  fs/overlayfs/super.c | 19 +++++++++++++++++++
  13  1 file changed, 19 insertions(+)
  14
  15 --- a/fs/overlayfs/super.c
  16 +++ b/fs/overlayfs/super.c
  17 @@ -773,6 +773,10 @@ retry:
  18                 struct kstat stat = {
  19                         .mode = S_IFDIR | 0,
  20                 };
  21 +               struct iattr attr = {
  22 +                       .ia_valid = ATTR_MODE,
  23 +                       .ia_mode = stat.mode,
  24 +               };
  25
  26                 if (work->d_inode) {
  27                         err = -EEXIST;
  28 @@ -788,6 +792,21 @@ retry:
  29                 err = ovl_create_real(dir, work, &stat, NULL, NULL, true);
  30                 if (err)
  31                         goto out_dput;
  32 +
  33 +               err = vfs_removexattr(work, XATTR_NAME_POSIX_ACL_DEFAULT);
  34 +               if (err && err != -ENODATA)
  35 +                       goto out_dput;
  36 +
  37 +               err = vfs_removexattr(work, XATTR_NAME_POSIX_ACL_ACCESS);
  38 +               if (err && err != -ENODATA)
  39 +                       goto out_dput;
  40 +
  41 +               /* Clear any inherited mode bits */
  42 +               mutex_lock(&work->d_inode->i_mutex);
  43 +               err = notify_change(work, &attr, NULL);
  44 +               mutex_unlock(&work->d_inode->i_mutex);
  45 +               if (err)
  46 +                       goto out_dput;
  47         }
  48  out_unlock:
  49         mutex_unlock(&dir->i_mutex);