5 files changed, 15 insertions, 8 deletions

diff --git a/fs/orangefs/devorangefs-req.c b/fs/orangefs/devorangefs-req.c
index db170beba797..a287a66d94e3 100644
--- a/fs/orangefs/devorangefs-req.c
+++ b/fs/orangefs/devorangefs-req.c
@@ -116,6 +116,13 @@ static int orangefs_devreq_open(struct inode *inode, struct file *file)
 {
         int ret = -EINVAL;
 
+        /* in order to ensure that the filesystem driver sees correct UIDs */
+        if (file->f_cred->user_ns != &init_user_ns) {
+                gossip_err("%s: device cannot be opened outside init_user_ns\n",
+                           __func__);
+                goto out;
+        }
+
         if (!(file->f_flags & O_NONBLOCK)) {
                 gossip_err("%s: device cannot be opened in blocking mode\n",
                            __func__);
diff --git a/fs/orangefs/orangefs-cache.c b/fs/orangefs/orangefs-cache.c
index 900a2e38e11b..b6edbe9fb309 100644
--- a/fs/orangefs/orangefs-cache.c
+++ b/fs/orangefs/orangefs-cache.c
@@ -136,10 +136,10 @@ struct orangefs_kernel_op_s *op_alloc(__s32 type)
                              llu(new_op->tag),
                              get_opname_string(new_op));
 
-                new_op->upcall.uid = from_kuid(current_user_ns(),
+                new_op->upcall.uid = from_kuid(&init_user_ns,
                                                current_fsuid());
 
-                new_op->upcall.gid = from_kgid(current_user_ns(),
+                new_op->upcall.gid = from_kgid(&init_user_ns,
                                                current_fsgid());
         } else {
                 gossip_err("op_alloc: kmem_cache_zalloc failed!\n");
diff --git a/fs/orangefs/orangefs-kernel.h b/fs/orangefs/orangefs-kernel.h
index 7b542f168d44..c1181e5529af 100644
--- a/fs/orangefs/orangefs-kernel.h
+++ b/fs/orangefs/orangefs-kernel.h
@@ -587,8 +587,8 @@ int service_operation(struct orangefs_kernel_op_s *op,
 
 #define fill_default_sys_attrs(sys_attr, type, mode)                    \
 do {                                                                    \
-        sys_attr.owner = from_kuid(current_user_ns(), current_fsuid()); \
-        sys_attr.group = from_kgid(current_user_ns(), current_fsgid()); \
+        sys_attr.owner = from_kuid(&init_user_ns, current_fsuid()); \
+        sys_attr.group = from_kgid(&init_user_ns, current_fsgid()); \
         sys_attr.perms = ORANGEFS_util_translate_mode(mode);            \
         sys_attr.mtime = 0;                                             \
         sys_attr.atime = 0;                                             \
diff --git a/fs/orangefs/orangefs-utils.c b/fs/orangefs/orangefs-utils.c
index 2d129b5886ee..c5fbc62357c6 100644
--- a/fs/orangefs/orangefs-utils.c
+++ b/fs/orangefs/orangefs-utils.c
@@ -153,12 +153,12 @@ static inline int copy_attributes_from_inode(struct inode *inode,
          */
         attrs->mask = 0;
         if (iattr->ia_valid & ATTR_UID) {
-                attrs->owner = from_kuid(current_user_ns(), iattr->ia_uid);
+                attrs->owner = from_kuid(&init_user_ns, iattr->ia_uid);
                 attrs->mask |= ORANGEFS_ATTR_SYS_UID;
                 gossip_debug(GOSSIP_UTILS_DEBUG, "(UID) %d\n", attrs->owner);
         }
         if (iattr->ia_valid & ATTR_GID) {
-                attrs->group = from_kgid(current_user_ns(), iattr->ia_gid);
+                attrs->group = from_kgid(&init_user_ns, iattr->ia_gid);
                 attrs->mask |= ORANGEFS_ATTR_SYS_GID;
                 gossip_debug(GOSSIP_UTILS_DEBUG, "(GID) %d\n", attrs->group);
         }
diff --git a/fs/orangefs/xattr.c b/fs/orangefs/xattr.c
index 73a0c3411d4b..2a9f07f06d10 100644
--- a/fs/orangefs/xattr.c
+++ b/fs/orangefs/xattr.c
@@ -79,8 +79,8 @@ ssize_t orangefs_inode_getxattr(struct inode *inode, const char *name,
                 return -EINVAL;
         }
 
-        fsuid = from_kuid(current_user_ns(), current_fsuid());
-        fsgid = from_kgid(current_user_ns(), current_fsgid());
+        fsuid = from_kuid(&init_user_ns, current_fsuid());
+        fsgid = from_kgid(&init_user_ns, current_fsgid());
 
         gossip_debug(GOSSIP_XATTR_DEBUG,
                      "getxattr on inode %pU, name %s "