diff options
author | Eric W. Biederman <ebiederm@xmission.com> | 2013-03-22 04:08:05 -0700 |
---|---|---|
committer | Eric W. Biederman <ebiederm@xmission.com> | 2013-03-27 07:50:05 -0700 |
commit | 132c94e31b8bca8ea921f9f96a57d684fa4ae0a9 (patch) | |
tree | 52db12073a31f62301367416b2a3afec185975ef /fs/pnode.c | |
parent | 90563b198e4c6674c63672fae1923da467215f45 (diff) | |
download | kernel_goldelico_gta04-132c94e31b8bca8ea921f9f96a57d684fa4ae0a9.zip kernel_goldelico_gta04-132c94e31b8bca8ea921f9f96a57d684fa4ae0a9.tar.gz kernel_goldelico_gta04-132c94e31b8bca8ea921f9f96a57d684fa4ae0a9.tar.bz2 |
vfs: Carefully propogate mounts across user namespaces
As a matter of policy MNT_READONLY should not be changable if the
original mounter had more privileges than creator of the mount
namespace.
Add the flag CL_UNPRIVILEGED to note when we are copying a mount from
a mount namespace that requires more privileges to a mount namespace
that requires fewer privileges.
When the CL_UNPRIVILEGED flag is set cause clone_mnt to set MNT_NO_REMOUNT
if any of the mnt flags that should never be changed are set.
This protects both mount propagation and the initial creation of a less
privileged mount namespace.
Cc: stable@vger.kernel.org
Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
Reported-by: Andy Lutomirski <luto@amacapital.net>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Diffstat (limited to 'fs/pnode.c')
-rw-r--r-- | fs/pnode.c | 6 |
1 files changed, 6 insertions, 0 deletions
@@ -9,6 +9,7 @@ #include <linux/mnt_namespace.h> #include <linux/mount.h> #include <linux/fs.h> +#include <linux/nsproxy.h> #include "internal.h" #include "pnode.h" @@ -220,6 +221,7 @@ static struct mount *get_source(struct mount *dest, int propagate_mnt(struct mount *dest_mnt, struct dentry *dest_dentry, struct mount *source_mnt, struct list_head *tree_list) { + struct user_namespace *user_ns = current->nsproxy->mnt_ns->user_ns; struct mount *m, *child; int ret = 0; struct mount *prev_dest_mnt = dest_mnt; @@ -237,6 +239,10 @@ int propagate_mnt(struct mount *dest_mnt, struct dentry *dest_dentry, source = get_source(m, prev_dest_mnt, prev_src_mnt, &type); + /* Notice when we are propagating across user namespaces */ + if (m->mnt_ns->user_ns != user_ns) + type |= CL_UNPRIVILEGED; + child = copy_tree(source, source->mnt.mnt_root, type); if (IS_ERR(child)) { ret = PTR_ERR(child); |