Commit 43c082e7 authored Jun 07, 2016 by Linus Torvalds

user-namespace

Pull userns fixes from Eric Biederman:
 "This contains two small but significant fixes to fs/namespace.c.

  The first adds a filesystem refcount drop on error.  The second
  corrects a test in fs_fully_visible which could be abused to allow
  mounting of proc or sysfs, when that should not be allowed.

  To keep myself honest I have tested to ensure the incorrect test in
  fs_fully_visible actually allows improper mounting of proc before the
  fix and that when fixed the improper mounting is not allowed"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace:
  mnt: fs_fully_visible test the proper mount for MNT_LOCKED
  mnt: If fs_fully_visible fails call put_filesystem.

parents 3613a624 d71ed6c9

fs/namespace.c

+4 −2

Original line number	Diff line number	Diff line
		@@ -2409,10 +2409,12 @@ static int do_new_mount(struct path path, const char fstype, int flags,
		mnt_flags \|= MNT_NODEV \| MNT_LOCK_NODEV;
		}
		if (type->fs_flags & FS_USERNS_VISIBLE) {
		if (!fs_fully_visible(type, &mnt_flags))
		if (!fs_fully_visible(type, &mnt_flags)) {
		put_filesystem(type);
		return -EPERM;
		}
		}
		}

		mnt = vfs_kern_mount(type, flags, name, data);
		if (!IS_ERR(mnt) && (type->fs_flags & FS_HAS_SUBTYPE) &&
		@@ -3271,7 +3273,7 @@ static bool fs_fully_visible(struct file_system_type type, int new_mnt_flags)
		list_for_each_entry(child, &mnt->mnt_mounts, mnt_child) {
		struct inode *inode = child->mnt_mountpoint->d_inode;
		/* Only worry about locked mounts */
		if (!(mnt_flags & MNT_LOCKED))
		if (!(child->mnt.mnt_flags & MNT_LOCKED))
		continue;
		/* Is the directory permanetly empty? */
		if (!is_empty_dir_inode(inode))