Matthew Garrett 49e4570444 Don't verify write permissions on lower inodes on overlayfs ...

If a user opens a file r/w on overlayfs, and if the underlying inode is
currently still on the lower fs, right now we're verifying whether selinux
policy permits writes to the selinux context on the underlying inode. This
is suboptimal, since we don't want confined processes to be able to write to
these files if they're able to escape from a container and so don't want to
permit this in policy. Have overlayfs pass down an additional flag when
verifying the permission on lower inodes, and mask off the write bits in
the selinux permissions check if that flag is set.

2015-12-22 08:03:58 +00:00

..

src/third_party/coreos-overlay

Don't verify write permissions on lower inodes on overlayfs

2015-12-22 08:03:58 +00:00