[PATCH v3 0/2] vfs, afs, bash: Fix miscomparison of foreign user IDs in the VFS

[Christian Brauner]

On 2026-07-28 15:13 +0100, David Howells wrote:
> Hi Al, Christian,
> 
> Here's a pair of fixes that deal with some places the VFS mishandles
> foreign user ID checks.  By "foreign" I mean that the user IDs from the
> filesystem do not belong in the same number space as the system's user IDs.
> Network filesystems are prime examples of this, but it may also impact
> things like USB drives or cdroms.
> 
> Take AFS as example: Whilst each file does have a numeric user ID, the file
> may be accessed from a world-accessible public-facing server from some
> other organisation with its own idea of what that user ID refers to.  IDs
> from AFS may also collide with the system's own set of IDs and may also be
> unrepresentable as a 32-bit UID (in the case of AuriStor servers).
> 
> Further, kAFS uses a key containing an authentication token to specify the
> subject doing an RPC operation to the server - and, as such, this needs to
> be used instead of current_fsuid() in determining whether the current user
> has ownership rights over a file.
> 
> Additionally, filesystems (CIFS being a notable example) may also have user
> identifiers that aren't simple integers.
> 
> Now the problem in the VFS is that there are a number of places where it
> assumes it can directly compare i_uid (possibly id-mapped) to either than
> on another inode or a UID drawn from elsewhere (e.g. current_uid()) - but
> this doesn't work right.
> 
> This causes the write-to-sticky check to work incorrectly for AFS (though
> this is currently masked by a workaround in bash that has now been removed
> as of bash-5.3) whereby open(O_CREAT) of such a file will fail when it
> shouldn't.
> 
> Two patches are provided:
> 
>  (1) Add a pair of inode operations, one to compare the ownership of a pair
>      of inodes and the other to see if the current process has ownership
>      rights over an inode with an IOP flag to control access to them.
> 
>      Usage of this is then extended out into the VFS, replacing comparisons
>      between i_uid and i_uid and between i_uid and current_fsuid().  The
>      default, it the inode ops are unimplemented, is to do those direct i_uid
>      comparisons.
> 
>  (2) Fixes the bash workaround issue with regard to AFS, overriding the
>      checks as to whether two inodes have the same owner and the check as
>      to whether the current user owns an inode to work within the AFS
>      model.
> 
> kAFS uses the result of a status-fetch with a suitable key to determine
> file ownership (if the ADMINISTER bit is set) and just compares the 64-bit
> owner IDs to determine if two inodes have the same ownership.
> 
> Note that chown may also need modifying in some way - but that can't
> necessarily supply the information required (for instance, an AuriStor YFS ID
> is 64 bits, but chown can only handle a 32-bit integer; CIFS might use a
> GUID).

Seems that some other changes are required for this. I'll take a look
once a new version is out.