mnt: Move the FS_USERNS_MOUNT check into sget_userns (a001e74c) · Commits · 戴 / test

Allowing a filesystem to be mounted by other than root in the initial user namespace is a filesystem property not a mount namespace property and as such should be checked in filesystem specific code. Move the FS_USERNS_MOUNT test into super.c:sget_userns(). Acked-by:

Seth Forshee <seth.forshee@canonical.com> Signed-off-by:

"Eric W. Biederman" <ebiederm@xmission.com>

fs/namespace.c

+0 −4

Original line number	Diff line number	Diff line
		@@ -2397,10 +2397,6 @@ static int do_new_mount(struct path path, const char fstype, int flags,
		return -ENODEV;

		if (user_ns != &init_user_ns) {
		if (!(type->fs_flags & FS_USERNS_MOUNT)) {
		put_filesystem(type);
		return -EPERM;
		}
		/* Only in special cases allow devices from mounts
		* created outside the initial user namespace.
		*/

fs/super.c

+4 −0

Original line number	Diff line number	Diff line
		@@ -466,6 +466,10 @@ struct super_block sget_userns(struct file_system_type type,
		struct super_block *old;
		int err;

		if (!(flags & MS_KERNMOUNT) &&
		!(type->fs_flags & FS_USERNS_MOUNT) &&
		!capable(CAP_SYS_ADMIN))
		return ERR_PTR(-EPERM);
		retry:
		spin_lock(&sb_lock);
		if (test) {

Admin message