From d4728821182ae4f401fe855dd814d3a8d1b99d2d Mon Sep 17 00:00:00 2001 From: Daniel Rosenberg Date: Mon, 1 Jul 2024 15:18:20 -0700 Subject: [PATCH] ANDROID: fuse: Allow passthrough without CAP_SYS_ADMIN Android already restricts this to Media Provider, and we'd prefer not to elevate Media Provider's permissions unless absolutely necessary. Change-Id: I56301d1da1f4bb5e84585712b6cd36344f1c82d6 Bug: 333497409 Test: Can Open File in Passthrough Mode Signed-off-by: Daniel Rosenberg --- fs/fuse/passthrough.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/fs/fuse/passthrough.c b/fs/fuse/passthrough.c index 9666d13884ce..339aa74c456c 100644 --- a/fs/fuse/passthrough.c +++ b/fs/fuse/passthrough.c @@ -220,9 +220,13 @@ int fuse_backing_open(struct fuse_conn *fc, struct fuse_backing_map *map) pr_debug("%s: fd=%d flags=0x%x\n", __func__, map->fd, map->flags); /* TODO: relax CAP_SYS_ADMIN once backing files are visible to lsof */ + /* Android already restricts access here, and we don't want to grant extra + * Permissions to the daemon */ +#if 0 res = -EPERM; if (!fc->passthrough || !capable(CAP_SYS_ADMIN)) goto out; +#endif res = -EINVAL; if (map->flags || map->padding) @@ -275,9 +279,13 @@ int fuse_backing_close(struct fuse_conn *fc, int backing_id) pr_debug("%s: backing_id=%d\n", __func__, backing_id); /* TODO: relax CAP_SYS_ADMIN once backing files are visible to lsof */ + /* Android already restricts access here, and we don't want to grant extra + * Permissions to the daemon */ +#if 0 err = -EPERM; if (!fc->passthrough || !capable(CAP_SYS_ADMIN)) goto out; +#endif err = -EINVAL; if (backing_id <= 0)