| Message ID | 20160620172130.15712-7-ebiederm@xmission.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
On Mon, Jun 20, 2016 at 12:21:24PM -0500, Eric W. Biederman wrote: > Allowing a filesystem to be mounted by other than root in the initial > user namespace is a filesystem property not a mount namespace property > and as such should be checked in filesystem specific code. Move the > FS_USERNS_MOUNT test into super.c:sget_userns(). > > Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com> Acked-by: Seth Forshee <seth.forshee@canonical.com> -- To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/fs/namespace.c b/fs/namespace.c index 1a69aa786975..2e13f6cfe5df 100644 --- a/fs/namespace.c +++ b/fs/namespace.c @@ -2397,10 +2397,6 @@ static int do_new_mount(struct path *path, const char *fstype, int flags, return -ENODEV; if (user_ns != &init_user_ns) { - if (!(type->fs_flags & FS_USERNS_MOUNT)) { - put_filesystem(type); - return -EPERM; - } /* Only in special cases allow devices from mounts * created outside the initial user namespace. */ diff --git a/fs/super.c b/fs/super.c index 874c7e3ebb8f..78790ada7191 100644 --- a/fs/super.c +++ b/fs/super.c @@ -466,6 +466,10 @@ struct super_block *sget_userns(struct file_system_type *type, struct super_block *old; int err; + if (!(flags & MS_KERNMOUNT) && + !(type->fs_flags & FS_USERNS_MOUNT) && + !capable(CAP_SYS_ADMIN)) + return ERR_PTR(-EPERM); retry: spin_lock(&sb_lock); if (test) {
Allowing a filesystem to be mounted by other than root in the initial user namespace is a filesystem property not a mount namespace property and as such should be checked in filesystem specific code. Move the FS_USERNS_MOUNT test into super.c:sget_userns(). Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com> --- fs/namespace.c | 4 ---- fs/super.c | 4 ++++ 2 files changed, 4 insertions(+), 4 deletions(-)