Revert "ovl: relax permission checking on underlying layers"

This reverts commit 007ea44892e6fa963a0876a979e34890325c64eb.

The commit broke some selinux-testsuite cases, and it looks like there's no
straightforward fix keeping the direction of this patch, so revert for now.

The original patch was trying to fix the consistency of permission checks, and
not an observed bug.  So reverting should be safe.

Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>

diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c
index 6bcc9dedc342cc7cf141abbc5220f4a0aa5ce1da..3b7ed5d2279c6a8efde8180471bde94ef1020964 100644 (file)
--- a/fs/overlayfs/inode.c
+++ b/fs/overlayfs/inode.c
@@ -286,22 +286,13 @@ int ovl_permission(struct inode *inode, int mask)
        if (err)
                return err;
 
-       /* No need to do any access on underlying for special files */
-       if (special_file(realinode->i_mode))
-               return 0;
-
-       /* No need to access underlying for execute */
-       mask &= ~MAY_EXEC;
-       if ((mask & (MAY_READ | MAY_WRITE)) == 0)
-               return 0;
-
-       /* Lower files get copied up, so turn write access into read */
-       if (!upperinode && mask & MAY_WRITE) {
+       old_cred = ovl_override_creds(inode->i_sb);
+       if (!upperinode &&
+           !special_file(realinode->i_mode) && mask & MAY_WRITE) {
                mask &= ~(MAY_WRITE | MAY_APPEND);
+               /* Make sure mounter can read file for copy up later */
                mask |= MAY_READ;
        }
-
-       old_cred = ovl_override_creds(inode->i_sb);
        err = inode_permission(realinode, mask);
        revert_creds(old_cred);