Christian Brauner 52edb4080e acl: move idmapping handling into posix_acl_xattr_set() ... The uapi POSIX ACL struct passed through the value argument during setxattr() contains {g,u}id values encoded via ACL_{GROUP,USER} entries that should actually be stored in the form of k{g,u}id_t (See [1] for a long explanation of the issue.). In 0c5fd887d2 ("acl: move idmapped mount fixup into vfs_{g,s}etxattr()") we took the mount's idmapping into account in order to let overlayfs handle POSIX ACLs on idmapped layers correctly. The fixup is currently performed directly in vfs_setxattr() which piles on top of the earlier hackiness by handling the mount's idmapping and stuff the vfs{g,u}id_t values into the uapi struct as well. While that is all correct and works fine it's just ugly. Now that we have introduced vfs_make_posix_acl() earlier move handling idmapped mounts out of vfs_setxattr() and into the POSIX ACL handler where it belongs. Note that we also need to call vfs_make_posix_acl() for EVM which interpretes POSIX ACLs during security_inode_setxattr(). Leave them a longer comment for future reference. All filesystems that support idmapped mounts via FS_ALLOW_IDMAP use the standard POSIX ACL xattr handlers and are covered by this change. This includes overlayfs which simply calls vfs_{g,s}etxattr(). The following filesystems use custom POSIX ACL xattr handlers: 9p, cifs, ecryptfs, and ntfs3 (and overlayfs but we've covered that in the paragraph above) and none of them support idmapped mounts yet. Link: https://lore.kernel.org/all/20220801145520.1532837-1-brauner@kernel.org/ [1] Signed-off-by: Christian Brauner (Microsoft) <brauner@kernel.org> Reviewed-by: Seth Forshee (DigitalOcean) <sforshee@kernel.org>		2022-08-31 16:37:58 +02:00
..
evm	acl: move idmapping handling into posix_acl_xattr_set()	2022-08-31 16:37:58 +02:00
ima	- Add the ability to pass early an RNG seed to the kernel from the boot	2022-08-01 10:17:19 -07:00
platform_certs	integrity-v5.19	2022-05-24 13:50:39 -07:00
digsig.c	ima: support fs-verity file digest based version 3 signatures	2022-05-05 17:41:51 -04:00
digsig_asymmetric.c	ima: fix reference leak in asymmetric_verify()	2022-01-24 18:37:36 -05:00
iint.c	evm: Load EVM key in ima_load_x509() to avoid appraisal	2021-05-21 12:47:04 -04:00
integrity.h	ima: support fs-verity file digest based version 3 signatures	2022-05-05 17:41:51 -04:00
integrity_audit.c	integrity: check the return value of audit_log_start()	2022-02-02 11:44:23 -05:00
Kconfig	integrity: Introduce a Linux keyring called machine	2022-03-08 13:55:52 +02:00
Makefile	integrity: Introduce a Linux keyring called machine	2022-03-08 13:55:52 +02:00