Revert 95ebabde382c ("capabilities: Don't allow writing ambiguous v3 file capabilities")

It turns out that there are in fact userspace implementations that
care and this recent change caused a regression.

https://github.com/containers/buildah/issues/3071

As the motivation for the original change was future development,
and the impact is existing real world code just revert this change
and allow the ambiguity in v3 file caps.

Cc: [email protected]
Fixes: 95ebabde382c ("capabilities: Don't allow writing ambiguous v3 file capabilities")
Signed-off-by: Eric W. Biederman <[email protected]>

diff --git a/security/commoncap.c b/security/commoncap.c
index 28f4d25480dfa018afd0703f714443f14843079d..1c519c87521765a0a474100a8b4309c44f44c3c5 100644 (file)
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -543,8 +543,7 @@ int cap_convert_nscap(struct user_namespace *mnt_userns, struct dentry *dentry,
        __u32 magic, nsmagic;
        struct inode *inode = d_backing_inode(dentry);
        struct user_namespace *task_ns = current_user_ns(),
-               *fs_ns = inode->i_sb->s_user_ns,
-               *ancestor;
+               *fs_ns = inode->i_sb->s_user_ns;
        kuid_t rootid;
        size_t newsize;
 
@@ -567,15 +566,6 @@ int cap_convert_nscap(struct user_namespace *mnt_userns, struct dentry *dentry,
        if (nsrootid == -1)
                return -EINVAL;
 
-       /*
-        * Do not allow allow adding a v3 filesystem capability xattr
-        * if the rootid field is ambiguous.
-        */
-       for (ancestor = task_ns->parent; ancestor; ancestor = ancestor->parent) {
-               if (from_kuid(ancestor, rootid) == 0)
-                       return -EINVAL;
-       }
-
        newsize = sizeof(struct vfs_ns_cap_data);
        nscap = kmalloc(newsize, GFP_ATOMIC);
        if (!nscap)