diff options
| author | David Howells <[email protected]> | 2023-05-19 18:21:20 +0100 |
|---|---|---|
| committer | Christian Brauner <[email protected]> | 2023-06-05 10:55:15 +0200 |
| commit | 79aa28494638f03a9e664163cb4620eb0482aaa2 (patch) | |
| tree | 953922f131954fbfbe94dcff4ad3e6b05e74eb84 | |
| parent | 26e293f73fd76eeadfbad24d7d73481e211e5966 (diff) | |
cachefiles: Allow the cache to be non-root
Set mode 0600 on files in the cache so that cachefilesd can run as an
unprivileged user rather than leaving the files all with 0. Directories
are already set to 0700.
Userspace then needs to set the uid and gid before issuing the "bind"
command and the cache must've been chown'd to those IDs.
Signed-off-by: David Howells <[email protected]>
Reviewed-by: Jeff Layton <[email protected]>
Reviewed-by: Gao Xiang <[email protected]>
cc: David Howells <[email protected]>
cc: Jeff Layton <[email protected]>
cc: [email protected]
cc: [email protected]
cc: [email protected]
Message-Id: <[email protected]>
Signed-off-by: Christian Brauner <[email protected]>
| -rw-r--r-- | fs/cachefiles/namei.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/fs/cachefiles/namei.c b/fs/cachefiles/namei.c index 82219a8f6084..66482c193e86 100644 --- a/fs/cachefiles/namei.c +++ b/fs/cachefiles/namei.c @@ -451,7 +451,8 @@ struct file *cachefiles_create_tmpfile(struct cachefiles_object *object) ret = cachefiles_inject_write_error(); if (ret == 0) { - file = vfs_tmpfile_open(&nop_mnt_idmap, &parentpath, S_IFREG, + file = vfs_tmpfile_open(&nop_mnt_idmap, &parentpath, + S_IFREG | 0600, O_RDWR | O_LARGEFILE | O_DIRECT, cache->cache_cred); ret = PTR_ERR_OR_ZERO(file); |