Commit 43c082e7 authored by Linus Torvalds's avatar Linus Torvalds

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace

Pull userns fixes from Eric Biederman:
 "This contains two small but significant fixes to fs/namespace.c.

  The first adds a filesystem refcount drop on error.  The second
  corrects a test in fs_fully_visible which could be abused to allow
  mounting of proc or sysfs, when that should not be allowed.

  To keep myself honest I have tested to ensure the incorrect test in
  fs_fully_visible actually allows improper mounting of proc before the
  fix and that when fixed the improper mounting is not allowed"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace:
  mnt: fs_fully_visible test the proper mount for MNT_LOCKED
  mnt: If fs_fully_visible fails call put_filesystem.
parents 3613a624 d71ed6c9
...@@ -2409,8 +2409,10 @@ static int do_new_mount(struct path *path, const char *fstype, int flags, ...@@ -2409,8 +2409,10 @@ static int do_new_mount(struct path *path, const char *fstype, int flags,
mnt_flags |= MNT_NODEV | MNT_LOCK_NODEV; mnt_flags |= MNT_NODEV | MNT_LOCK_NODEV;
} }
if (type->fs_flags & FS_USERNS_VISIBLE) { if (type->fs_flags & FS_USERNS_VISIBLE) {
if (!fs_fully_visible(type, &mnt_flags)) if (!fs_fully_visible(type, &mnt_flags)) {
put_filesystem(type);
return -EPERM; return -EPERM;
}
} }
} }
...@@ -3271,7 +3273,7 @@ static bool fs_fully_visible(struct file_system_type *type, int *new_mnt_flags) ...@@ -3271,7 +3273,7 @@ static bool fs_fully_visible(struct file_system_type *type, int *new_mnt_flags)
list_for_each_entry(child, &mnt->mnt_mounts, mnt_child) { list_for_each_entry(child, &mnt->mnt_mounts, mnt_child) {
struct inode *inode = child->mnt_mountpoint->d_inode; struct inode *inode = child->mnt_mountpoint->d_inode;
/* Only worry about locked mounts */ /* Only worry about locked mounts */
if (!(mnt_flags & MNT_LOCKED)) if (!(child->mnt.mnt_flags & MNT_LOCKED))
continue; continue;
/* Is the directory permanetly empty? */ /* Is the directory permanetly empty? */
if (!is_empty_dir_inode(inode)) if (!is_empty_dir_inode(inode))
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment