Commit 2c3de1c2 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace 

Pull userns fixes from Eric W Biederman:
 "The bulk of the changes are fixing the worst consequences of the user
  namespace design oversight in not considering what happens when one
  namespace starts off as a clone of another namespace, as happens with
  the mount namespace.

  The rest of the changes are just plain bug fixes.

  Many thanks to Andy Lutomirski for pointing out many of these issues."

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace:
  userns: Restrict when proc and sysfs can be mounted
  ipc: Restrict mounting the mqueue filesystem
  vfs: Carefully propogate mounts across user namespaces
  vfs: Add a mount flag to lock read only bind mounts
  userns:  Don't allow creation if the user is chrooted
  yama:  Better permission check for ptraceme
  pid: Handle the exit of a multi-threaded init.
  scm: Require CAP_SYS_ADMIN over the current pidns to spoof pids.
parents 90641712 87a8ebd6

fs/namespace.c

+53 −1
Original line number Diff line number Diff line
@@ -798,6 +798,10 @@ static struct mount *clone_mnt(struct mount *old, struct dentry *root, 
	}



	mnt->mnt.mnt_flags = old->mnt.mnt_flags & ~MNT_WRITE_HOLD;

	/* Don't allow unprivileged users to change mount flags */

	if ((flag & CL_UNPRIVILEGED) && (mnt->mnt.mnt_flags & MNT_READONLY))

		mnt->mnt.mnt_flags |= MNT_LOCK_READONLY;



	atomic_inc(&sb->s_active);

	mnt->mnt.mnt_sb = sb;

	mnt->mnt.mnt_root = dget(root);
@@ -1713,6 +1717,9 @@ static int change_mount_flags(struct vfsmount *mnt, int ms_flags) 
	if (readonly_request == __mnt_is_readonly(mnt))

		return 0;



	if (mnt->mnt_flags & MNT_LOCK_READONLY)

		return -EPERM;



	if (readonly_request)

		error = mnt_make_readonly(real_mount(mnt));

	else
@@ -2339,7 +2346,7 @@ static struct mnt_namespace *dup_mnt_ns(struct mnt_namespace *mnt_ns, 
	/* First pass: copy the tree topology */

	copy_flags = CL_COPY_ALL | CL_EXPIRE;

	if (user_ns != mnt_ns->user_ns)

		copy_flags |= CL_SHARED_TO_SLAVE;

		copy_flags |= CL_SHARED_TO_SLAVE | CL_UNPRIVILEGED;

	new = copy_tree(old, old->mnt.mnt_root, copy_flags);

	if (IS_ERR(new)) {

		up_write(&namespace_sem);
@@ -2732,6 +2739,51 @@ bool our_mnt(struct vfsmount *mnt) 
	return check_mnt(real_mount(mnt));

}



bool current_chrooted(void)

{

	/* Does the current process have a non-standard root */

	struct path ns_root;

	struct path fs_root;

	bool chrooted;



	/* Find the namespace root */

	ns_root.mnt = &current->nsproxy->mnt_ns->root->mnt;

	ns_root.dentry = ns_root.mnt->mnt_root;

	path_get(&ns_root);

	while (d_mountpoint(ns_root.dentry) && follow_down_one(&ns_root))

		;



	get_fs_root(current->fs, &fs_root);



	chrooted = !path_equal(&fs_root, &ns_root);



	path_put(&fs_root);

	path_put(&ns_root);



	return chrooted;

}



void update_mnt_policy(struct user_namespace *userns)

{

	struct mnt_namespace *ns = current->nsproxy->mnt_ns;

	struct mount *mnt;



	down_read(&namespace_sem);

	list_for_each_entry(mnt, &ns->list, mnt_list) {

		switch (mnt->mnt.mnt_sb->s_magic) {

		case SYSFS_MAGIC:

			userns->may_mount_sysfs = true;

			break;

		case PROC_SUPER_MAGIC:

			userns->may_mount_proc = true;

			break;

		}

		if (userns->may_mount_sysfs && userns->may_mount_proc)

			break;

	}

	up_read(&namespace_sem);

}



static void *mntns_get(struct task_struct *task)

{

	struct mnt_namespace *ns = NULL;

fs/pnode.c

+6 −0
Original line number Diff line number Diff line
@@ -9,6 +9,7 @@ 
#include <linux/mnt_namespace.h>

#include <linux/mount.h>

#include <linux/fs.h>

#include <linux/nsproxy.h>

#include "internal.h"

#include "pnode.h"
@@ -220,6 +221,7 @@ static struct mount *get_source(struct mount *dest, 
int propagate_mnt(struct mount *dest_mnt, struct dentry *dest_dentry,

		    struct mount *source_mnt, struct list_head *tree_list)

{

	struct user_namespace *user_ns = current->nsproxy->mnt_ns->user_ns;

	struct mount *m, *child;

	int ret = 0;

	struct mount *prev_dest_mnt = dest_mnt;
@@ -237,6 +239,10 @@ int propagate_mnt(struct mount *dest_mnt, struct dentry *dest_dentry, 


		source =  get_source(m, prev_dest_mnt, prev_src_mnt, &type);



		/* Notice when we are propagating across user namespaces */

		if (m->mnt_ns->user_ns != user_ns)

			type |= CL_UNPRIVILEGED;



		child = copy_tree(source, source->mnt.mnt_root, type);

		if (IS_ERR(child)) {

			ret = PTR_ERR(child);

fs/pnode.h

+1 −0
Original line number Diff line number Diff line
@@ -23,6 +23,7 @@ 
#define CL_MAKE_SHARED 		0x08

#define CL_PRIVATE 		0x10

#define CL_SHARED_TO_SLAVE	0x20

#define CL_UNPRIVILEGED		0x40



static inline void set_mnt_shared(struct mount *mnt)

{

fs/proc/root.c

+4 −0
Original line number Diff line number Diff line
@@ -16,6 +16,7 @@ 
#include <linux/sched.h>

#include <linux/module.h>

#include <linux/bitops.h>

#include <linux/user_namespace.h>

#include <linux/mount.h>

#include <linux/pid_namespace.h>

#include <linux/parser.h>
@@ -108,6 +109,9 @@ static struct dentry *proc_mount(struct file_system_type *fs_type, 
	} else {

		ns = task_active_pid_ns(current);

		options = data;



		if (!current_user_ns()->may_mount_proc)

			return ERR_PTR(-EPERM);

	}



	sb = sget(fs_type, proc_test_super, proc_set_super, flags, ns);

fs/sysfs/mount.c

+4 −0
Original line number Diff line number Diff line
@@ -19,6 +19,7 @@ 
#include <linux/module.h>

#include <linux/magic.h>

#include <linux/slab.h>

#include <linux/user_namespace.h>



#include "sysfs.h"
@@ -111,6 +112,9 @@ static struct dentry *sysfs_mount(struct file_system_type *fs_type, 
	struct super_block *sb;

	int error;



	if (!(flags & MS_KERNMOUNT) && !current_user_ns()->may_mount_sysfs)

		return ERR_PTR(-EPERM);



	info = kzalloc(sizeof(*info), GFP_KERNEL);

	if (!info)

		return ERR_PTR(-ENOMEM);

CRA Git | Maintained and supported by SUSTech CRA and CCSE