From patchwork Wed Jun 3 21:15:10 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Eric W. Biederman" X-Patchwork-Id: 6541531 Return-Path: X-Original-To: patchwork-linux-fsdevel@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork1.web.kernel.org (Postfix) with ESMTP id 8A4939F3D1 for ; Wed, 3 Jun 2015 21:20:21 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 9FAC120710 for ; Wed, 3 Jun 2015 21:20:20 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 9C89F2071B for ; Wed, 3 Jun 2015 21:20:19 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753798AbbFCVUS (ORCPT ); Wed, 3 Jun 2015 17:20:18 -0400 Received: from out03.mta.xmission.com ([166.70.13.233]:41972 "EHLO out03.mta.xmission.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753686AbbFCVUP (ORCPT ); Wed, 3 Jun 2015 17:20:15 -0400 Received: from in02.mta.xmission.com ([166.70.13.52]) by out03.mta.xmission.com with esmtps (TLS1.2:DHE_RSA_AES_128_CBC_SHA1:128) (Exim 4.82) (envelope-from ) id 1Z0G58-0000hL-QZ; Wed, 03 Jun 2015 15:20:14 -0600 Received: from 67-3-205-90.omah.qwest.net ([67.3.205.90] helo=x220.int.ebiederm.org.xmission.com) by in02.mta.xmission.com with esmtpsa (TLS1.2:DHE_RSA_AES_128_CBC_SHA1:128) (Exim 4.82) (envelope-from ) id 1Z0G58-0002mM-1C; Wed, 03 Jun 2015 15:20:14 -0600 From: ebiederm@xmission.com (Eric W. Biederman) To: Andy Lutomirski Cc: Kenton Varda , Serge Hallyn , Seth Forshee , Linux API , Linux Containers , Greg Kroah-Hartman , Michael Kerrisk-manpages , Richard Weinberger , Linux FS Devel , Tejun Heo References: <87pp63jcca.fsf@x220.int.ebiederm.org> <87siaxuvik.fsf@x220.int.ebiederm.org> <87wq004im1.fsf@x220.int.ebiederm.org> <20150528140839.GD28842@ubuntumail> <87lhg8pwvz.fsf@x220.int.ebiederm.org> <87fv6gikfn.fsf@x220.int.ebiederm.org> <87fv6g80g7.fsf@x220.int.ebiederm.org> <87k2vkebri.fsf@x220.int.ebiederm.org> Date: Wed, 03 Jun 2015 16:15:10 -0500 In-Reply-To: <87k2vkebri.fsf@x220.int.ebiederm.org> (Eric W. Biederman's message of "Wed, 03 Jun 2015 16:13:21 -0500") Message-ID: <87eglseboh.fsf_-_@x220.int.ebiederm.org> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.3 (gnu/linux) MIME-Version: 1.0 X-XM-AID: U2FsdGVkX1/XtkY9XXruMoxMwtcvEhLGUtli5c/a1rs= X-SA-Exim-Connect-IP: 67.3.205.90 X-SA-Exim-Mail-From: ebiederm@xmission.com X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Spam-Status: No, score=-6.9 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, T_RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-DCC: XMission; sa04 1397; Body=1 Fuz1=1 Fuz2=1 X-Spam-Combo: ***;Andy Lutomirski X-Spam-Relay-Country: X-Spam-Timing: total 301 ms - load_scoreonly_sql: 0.04 (0.0%), signal_user_changed: 3.4 (1.1%), b_tie_ro: 2.3 (0.8%), parse: 1.16 (0.4%), extract_message_metadata: 18 (5.9%), get_uri_detail_list: 2.6 (0.9%), tests_pri_-1000: 6 (1.9%), tests_pri_-950: 1.12 (0.4%), tests_pri_-900: 0.94 (0.3%), tests_pri_-400: 31 (10.4%), check_bayes: 30 (10.0%), b_tokenize: 13 (4.2%), b_tok_get_all: 8 (2.7%), b_comp_prob: 3.4 (1.1%), b_tok_touch_all: 3.0 (1.0%), b_finish: 0.76 (0.3%), tests_pri_0: 232 (77.2%), tests_pri_500: 3.8 (1.3%), rewrite_mail: 0.00 (0.0%) Subject: [CFT][PATCH 11/10] mnt: Avoid unnecessary regressions in fs_fully_visible X-SA-Exim-Version: 4.2.1 (built Wed, 24 Sep 2014 11:00:52 -0600) X-SA-Exim-Scanned: Yes (on in02.mta.xmission.com) Sender: linux-fsdevel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-fsdevel@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Not allowing programs to clear nosuid, nodev, and noexec on new mounts of sysfs or proc will cause lxc and libvirt-lxc to fail to start (a regression). There are no device nodes or executables on sysfs or proc today which means clearing these flags is harmless today. Instead of failing the fresh mounts of sysfs and proc emit a warning when these flags are improprely cleared. We only reach this point because lxc and libvirt-lxc clear flags they mount flags had not intended to. In a couple of kernel releases when lxc and libvirt-lxc have been fixed we can start failing fresh mounts proc and sysfs that clear nosuid, nodev and noexec. Userspace clearly means to enforce those attributes and historically they have avoided bugs. Cc: stable@vger.kernel.org Signed-off-by: "Eric W. Biederman" --- fs/namespace.c | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/fs/namespace.c b/fs/namespace.c index eccd925c6e82..eaa49b628d28 100644 --- a/fs/namespace.c +++ b/fs/namespace.c @@ -3198,6 +3198,7 @@ static bool fs_fully_visible(struct file_system_type *type, int *new_mnt_flags) if ((mnt->mnt.mnt_flags & MNT_LOCK_READONLY) && !(new_flags & MNT_READONLY)) continue; +#if 0 /* Avoid unnecessary regressions */ if ((mnt->mnt.mnt_flags & MNT_LOCK_NODEV) && !(new_flags & MNT_NODEV)) continue; @@ -3207,6 +3208,7 @@ static bool fs_fully_visible(struct file_system_type *type, int *new_mnt_flags) if ((mnt->mnt.mnt_flags & MNT_LOCK_NOEXEC) && !(new_flags & MNT_NOEXEC)) continue; +#endif if ((mnt->mnt.mnt_flags & MNT_LOCK_ATIME) && ((mnt->mnt.mnt_flags & MNT_ATIME_MASK) != (new_flags & MNT_ATIME_MASK))) continue; @@ -3226,10 +3228,35 @@ static bool fs_fully_visible(struct file_system_type *type, int *new_mnt_flags) } /* Preserve the locked attributes */ *new_mnt_flags |= mnt->mnt.mnt_flags & (MNT_LOCK_READONLY | \ + /* Avoid unnecessary regressions \ MNT_LOCK_NODEV | \ MNT_LOCK_NOSUID | \ MNT_LOCK_NOEXEC | \ + */ \ MNT_LOCK_ATIME); + /* For now, warn about the "harmless" but invalid mnt flags */ + { + bool nodev = false, nosuid = false, noexec = false; + if ((mnt->mnt.mnt_flags & MNT_LOCK_NODEV) && + !(new_flags & MNT_NODEV)) + nodev = true; + if ((mnt->mnt.mnt_flags & MNT_LOCK_NOSUID) && + !(new_flags & MNT_NOSUID)) + nosuid = true; + if ((mnt->mnt.mnt_flags & MNT_LOCK_NOEXEC) && + !(new_flags & MNT_NOEXEC)) + noexec = true; + + if ((nodev || nosuid || noexec) && printk_ratelimit()) { + printk(KERN_INFO + "warning: process `%s' clears %s%s%sin mount of %s\n", + current->comm, + nodev ? "nodev ":"", + nosuid ? "nosuid ":"", + noexec ? "noexec ":"", + type->name); + } + } visible = true; goto found; next: ;