Skip to content
Permalink
Browse files

vfs: Allow userns root to call mknod on owned filesystems.

These filesystems already always set SB_I_NODEV so mknod will not be
useful for gaining control of any devices no matter their permissions.
This will allow overlayfs and applications like to fakeroot to use
device nodes to represent things on disk.

Acked-by: Seth Forshee <seth.forshee@canonical.com>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
  • Loading branch information...
ebiederm committed May 23, 2018
1 parent 593d1ce commit 55956b59df336f6738da916dbb520b6e37df9fbd
Showing with 2 additions and 1 deletion.
  1. +2 −1 fs/namei.c
@@ -3679,7 +3679,8 @@ int vfs_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
if (error)
return error;

if ((S_ISCHR(mode) || S_ISBLK(mode)) && !capable(CAP_MKNOD))
if ((S_ISCHR(mode) || S_ISBLK(mode)) &&
!ns_capable(dentry->d_sb->s_user_ns, CAP_MKNOD))
return -EPERM;

if (!dir->i_op->mknod)

0 comments on commit 55956b5

Please sign in to comment.
You can’t perform that action at this time.