generic: check CAP_LINUX_IMMUTABLE capability

It should return error while changing IMMUTABLE_FL and APPEND_FL if the
process has no capability CAP_LINUX_IMMUTABLE.

However, it's not true on overlayfs after kernel version v4.19 since
the process's subjective cred is overridden with ofs->creator_cred
before calling real vfs_ioctl.

The following patch for ovl fix the problem:
  "ovl: check the capability before cred overridden"

Add this testcase to cover this bug.

Signed-off-by: Jiufei Xue <jiufei.xue@linux.alibaba.com>
Reviewed-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Eryu Guan <guaneryu@gmail.com>
This commit is contained in:
Jiufei Xue
2019-05-08 15:10:00 +08:00
committed by Eryu Guan
parent 9820d643ea
commit 80bac2129b
4 changed files with 85 additions and 0 deletions
+1
View File
@@ -196,6 +196,7 @@ export SQLITE3_PROG="$(type -P sqlite3)"
export TIMEOUT_PROG="$(type -P timeout)"
export SETCAP_PROG="$(type -P setcap)"
export GETCAP_PROG="$(type -P getcap)"
export CAPSH_PROG="$(type -P capsh)"
export CHECKBASHISMS_PROG="$(type -P checkbashisms)"
export XFS_INFO_PROG="$(type -P xfs_info)"
export DUPEREMOVE_PROG="$(type -P duperemove)"