[RFC PATCH v2 13/41] ublk: refuse unprivileged devices to UUID and GUID users

[Jan Koester]

The owner of an unprivileged ublk device is recorded in 32 bit fields of
struct ublksrv_ctrl_dev_info, and only the owner may open the disk. A
UUID or GUID user comes out as -1 there, like every other one, so they
could open each other's devices.

Fail the creation of unprivileged devices by such users with
-EOVERFLOW, and never let such a user pass the owner check.

Assisted-by: Claude:claude-opus-5-5

Signed-off-by: Jan Koester <jan.koester@xxxxxxxxx>
---
 drivers/block/ublk_drv.c | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c
index 66eb55e716..8125b79c87 100644
--- a/drivers/block/ublk_drv.c
+++ b/drivers/block/ublk_drv.c
@@ -1324,7 +1324,12 @@ static void ublk_free_disk(struct gendisk *disk)
 	ublk_put_device(ub);
 }
 
-static void ublk_store_owner_uid_gid(unsigned int *owner_uid,
+/*
+ * The owner of an unprivileged device is kept in 32 bits: -EOVERFLOW for
+ * a UUID or GUID user or group, which all would come out as -1 and so
+ * pass for each other.
+ */
+static int ublk_store_owner_uid_gid(unsigned int *owner_uid,
 		unsigned int *owner_gid)
 {
 	kuid_t uid;
@@ -1334,6 +1339,7 @@ static void ublk_store_owner_uid_gid(unsigned int *owner_uid,
 
 	*owner_uid = from_kuid(&init_user_ns, uid);
 	*owner_gid = from_kgid(&init_user_ns, gid);
+	return uid_is_legacy(uid) && gid_is_legacy(gid) ? 0 : -EOVERFLOW;
 }
 
 static int ublk_open(struct gendisk *disk, blk_mode_t mode)
@@ -1355,9 +1361,8 @@ static int ublk_open(struct gendisk *disk, blk_mode_t mode)
 	if (ub->dev_info.flags & UBLK_F_UNPRIVILEGED_DEV) {
 		unsigned int curr_uid, curr_gid;
 
-		ublk_store_owner_uid_gid(&curr_uid, &curr_gid);
-
-		if (curr_uid != ub->dev_info.owner_uid || curr_gid !=
+		if (ublk_store_owner_uid_gid(&curr_uid, &curr_gid) ||
+		    curr_uid != ub->dev_info.owner_uid || curr_gid !=
 				ub->dev_info.owner_gid)
 			return -EPERM;
 	}
@@ -4744,7 +4749,9 @@ static int ublk_ctrl_add_dev(const struct ublksrv_ctrl_cmd *header)
 	}
 
 	/* the created device is always owned by current user */
-	ublk_store_owner_uid_gid(&info.owner_uid, &info.owner_gid);
+	if (ublk_store_owner_uid_gid(&info.owner_uid, &info.owner_gid) &&
+	    (info.flags & UBLK_F_UNPRIVILEGED_DEV))
+		return -EOVERFLOW;
 
 	if (header->dev_id != info.dev_id) {
 		pr_warn("%s: dev id not match %u %u\n",
-- 
2.56.0