From patchwork Mon Aug 10 21:05:13 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Seth Forshee X-Patchwork-Id: 6986241 Return-Path: X-Original-To: patchwork-linux-fsdevel@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork2.web.kernel.org (Postfix) with ESMTP id 40E99C05AC for ; Mon, 10 Aug 2015 21:07:34 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 180242078F for ; Mon, 10 Aug 2015 21:07:33 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 1016F2078D for ; Mon, 10 Aug 2015 21:07:32 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932790AbbHJVH3 (ORCPT ); Mon, 10 Aug 2015 17:07:29 -0400 Received: from mail-ig0-f177.google.com ([209.85.213.177]:33318 "EHLO mail-ig0-f177.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S933137AbbHJVFk (ORCPT ); Mon, 10 Aug 2015 17:05:40 -0400 Received: by igbpg9 with SMTP id pg9so78174705igb.0 for ; Mon, 10 Aug 2015 14:05:39 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=61AtKpRaI5S/zKWUOUsWNwZB3Drc0ph2OiOmFv5c4iQ=; b=g1kTsfp8VMF/8uAY8XObsqYAp5n95BjKl1N04ael9Q8hvoykG9tHPw66vvXaQ0zxCw OtR+SK4SKpyc1Cb7R5QOD30BwyXXJRE5krWpDSkgCu8e6erhEmsE5iQZyH4qXkj6bDjL 9IT6KncqheQbat8HR5Ry8ed/4O0Uq/f2iwYwqWjFOrf3Pv46R0dGb1BxJVduLflXvIT2 WaShx8I0C7WLxr9DYADn5IRpJCORcA7kT0rwR1rH9ZKaR+wmEO07Ozqu83aLsyXuL7PI QG0vaOYXueeVwiH8+gN1ulugYFjkHSN5WdKm+fJLnPZrPNHGw474GCGSVUAIxJSvqlR4 eadg== X-Gm-Message-State: ALoCoQndO82sNgQfc/h23UFzy0zG93Jk0FL1x9PpW13N/eUB1PPtfEjW2x/n+erAYp4wHPH5M22E X-Received: by 10.50.61.144 with SMTP id p16mr12865057igr.22.1439240739076; Mon, 10 Aug 2015 14:05:39 -0700 (PDT) Received: from localhost (199-87-125-144.dyn.kc.surewest.net. [199.87.125.144]) by smtp.gmail.com with ESMTPSA id rr5sm38379igb.7.2015.08.10.14.05.38 (version=TLSv1.2 cipher=RC4-SHA bits=128/128); Mon, 10 Aug 2015 14:05:38 -0700 (PDT) From: Seth Forshee To: "Eric W. Biederman" , Alexander Viro , Jeff Layton , "J. Bruce Fields" Cc: Serge Hallyn , Andy Lutomirski , linux-fsdevel@vger.kernel.org, linux-security-module@vger.kernel.org, selinux@tycho.nsa.gov, linux-kernel@vger.kernel.org, linux-mtd@lists.infradead.org Subject: [PATCH v2 2/7] userns: Simpilify MNT_NODEV handling. Date: Mon, 10 Aug 2015 16:05:13 -0500 Message-Id: <1439240719-46850-3-git-send-email-seth.forshee@canonical.com> X-Mailer: git-send-email 1.9.1 In-Reply-To: <1439240719-46850-1-git-send-email-seth.forshee@canonical.com> References: <1439240719-46850-1-git-send-email-seth.forshee@canonical.com> Sender: linux-fsdevel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-fsdevel@vger.kernel.org X-Spam-Status: No, score=-6.9 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: "Eric W. Biederman" - Consolidate the testing if a device node may be opened in a new function may_open_dev. - Move the check for allowing access to device nodes on filesystems not mounted in the initial user namespace from mount time to open time and include it in may_open_dev. This set of changes removes the implicit adding of MNT_NODEV which simplifies the logic in fs/namespace.c and removes a potentially problematic user visible difference in how normal and unprivileged mount namespaces work. Signed-off-by: "Eric W. Biederman" --- fs/block_dev.c | 2 +- fs/namei.c | 9 ++++++++- fs/namespace.c | 18 ++++-------------- include/linux/fs.h | 1 + 4 files changed, 14 insertions(+), 16 deletions(-) diff --git a/fs/block_dev.c b/fs/block_dev.c index 198243717da5..f8ce371c437c 100644 --- a/fs/block_dev.c +++ b/fs/block_dev.c @@ -1729,7 +1729,7 @@ struct block_device *lookup_bdev(const char *pathname) if (!S_ISBLK(inode->i_mode)) goto fail; error = -EACCES; - if (path.mnt->mnt_flags & MNT_NODEV) + if (!may_open_dev(&path)) goto fail; error = -ENOMEM; bdev = bd_acquire(inode); diff --git a/fs/namei.c b/fs/namei.c index fbbcf0993312..59444c066f47 100644 --- a/fs/namei.c +++ b/fs/namei.c @@ -2640,6 +2640,13 @@ int vfs_create(struct inode *dir, struct dentry *dentry, umode_t mode, } EXPORT_SYMBOL(vfs_create); +bool may_open_dev(const struct path *path) +{ + return !(path->mnt->mnt_flags & MNT_NODEV) && + ((path->mnt->mnt_sb->s_user_ns == &init_user_ns) || + (path->mnt->mnt_sb->s_type->fs_flags & FS_USERNS_DEV_MOUNT)); +} + static int may_open(struct path *path, int acc_mode, int flag) { struct dentry *dentry = path->dentry; @@ -2662,7 +2669,7 @@ static int may_open(struct path *path, int acc_mode, int flag) break; case S_IFBLK: case S_IFCHR: - if (path->mnt->mnt_flags & MNT_NODEV) + if (!may_open_dev(path)) return -EACCES; /*FALLTHRU*/ case S_IFIFO: diff --git a/fs/namespace.c b/fs/namespace.c index d023a353dc63..e48fa1c23378 100644 --- a/fs/namespace.c +++ b/fs/namespace.c @@ -2177,13 +2177,7 @@ static int do_remount(struct path *path, int flags, int mnt_flags, } if ((mnt->mnt.mnt_flags & MNT_LOCK_NODEV) && !(mnt_flags & MNT_NODEV)) { - /* Was the nodev implicitly added in mount? */ - if ((mnt->mnt_ns->user_ns != &init_user_ns) && - !(sb->s_type->fs_flags & FS_USERNS_DEV_MOUNT)) { - mnt_flags |= MNT_NODEV; - } else { - return -EPERM; - } + return -EPERM; } if ((mnt->mnt.mnt_flags & MNT_LOCK_NOSUID) && !(mnt_flags & MNT_NOSUID)) { @@ -2396,13 +2390,6 @@ static int do_new_mount(struct path *path, const char *fstype, int flags, put_filesystem(type); return -EPERM; } - /* Only in special cases allow devices from mounts - * created outside the initial user namespace. - */ - if (!(type->fs_flags & FS_USERNS_DEV_MOUNT)) { - flags |= MS_NODEV; - mnt_flags |= MNT_NODEV | MNT_LOCK_NODEV; - } if (type->fs_flags & FS_USERNS_VISIBLE) { if (!fs_fully_visible(type, &mnt_flags)) return -EPERM; @@ -3238,6 +3225,9 @@ static bool fs_fully_visible(struct file_system_type *type, int *new_mnt_flags) mnt_flags = mnt->mnt.mnt_flags; if (mnt->mnt.mnt_sb->s_iflags & SB_I_NOEXEC) mnt_flags &= ~(MNT_LOCK_NOSUID | MNT_LOCK_NOEXEC); + if (current_user_ns() != &init_user_ns && + !(mnt->mnt.mnt_sb->s_type->fs_flags & FS_USERNS_DEV_MOUNT)) + mnt_flags &= ~(MNT_LOCK_NODEV); /* Verify the mount flags are equal to or more permissive * than the proposed new mount. diff --git a/include/linux/fs.h b/include/linux/fs.h index 6242e9629fe6..4a60e76f86ac 100644 --- a/include/linux/fs.h +++ b/include/linux/fs.h @@ -1527,6 +1527,7 @@ extern void dentry_unhash(struct dentry *dentry); */ extern void inode_init_owner(struct inode *inode, const struct inode *dir, umode_t mode); +extern bool may_open_dev(const struct path *path); /* * VFS FS_IOC_FIEMAP helper definitions. */