summaryrefslogtreecommitdiffstats
path: root/fs/super.c
diff options
context:
space:
mode:
authorEric W. Biederman <ebiederm@xmission.com>2016-05-23 14:51:59 -0500
committerEric W. Biederman <ebiederm@xmission.com>2016-06-23 15:41:53 -0500
commitd91ee87d8d85a0808c01787e8b4a6b48f2ba487b (patch)
tree1399ccf15d61a3a1dbdd5b89e1673a01325588ae /fs/super.c
parentb236017acffa73d52eac9427f42d8993067d20fb (diff)
downloadlinux-stable-d91ee87d8d85a0808c01787e8b4a6b48f2ba487b.tar.gz
linux-stable-d91ee87d8d85a0808c01787e8b4a6b48f2ba487b.tar.bz2
linux-stable-d91ee87d8d85a0808c01787e8b4a6b48f2ba487b.zip
vfs: Pass data, ns, and ns->userns to mount_ns
Today what is normally called data (the mount options) is not passed to fill_super through mount_ns. Pass the mount options and the namespace separately to mount_ns so that filesystems such as proc that have mount options, can use mount_ns. Pass the user namespace to mount_ns so that the standard permission check that verifies the mounter has permissions over the namespace can be performed in mount_ns instead of in each filesystems .mount method. Thus removing the duplication between mqueuefs and proc in terms of permission checks. The extra permission check does not currently affect the rpc_pipefs filesystem and the nfsd filesystem as those filesystems do not currently allow unprivileged mounts. Without unpvileged mounts it is guaranteed that the caller has already passed capable(CAP_SYS_ADMIN) which guarantees extra permission check will pass. Update rpc_pipefs and the nfsd filesystem to ensure that the network namespace reference is always taken in fill_super and always put in kill_sb so that the logic is simpler and so that errors originating inside of fill_super do not cause a network namespace leak. Acked-by: Seth Forshee <seth.forshee@canonical.com> Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Diffstat (limited to 'fs/super.c')
-rw-r--r--fs/super.c13
1 files changed, 10 insertions, 3 deletions
diff --git a/fs/super.c b/fs/super.c
index d78b9847e6cb..fd65667832e5 100644
--- a/fs/super.c
+++ b/fs/super.c
@@ -918,12 +918,19 @@ static int ns_set_super(struct super_block *sb, void *data)
return set_anon_super(sb, NULL);
}
-struct dentry *mount_ns(struct file_system_type *fs_type, int flags,
- void *data, int (*fill_super)(struct super_block *, void *, int))
+struct dentry *mount_ns(struct file_system_type *fs_type,
+ int flags, void *data, void *ns, struct user_namespace *user_ns,
+ int (*fill_super)(struct super_block *, void *, int))
{
struct super_block *sb;
- sb = sget(fs_type, ns_test_super, ns_set_super, flags, data);
+ /* Don't allow mounting unless the caller has CAP_SYS_ADMIN
+ * over the namespace.
+ */
+ if (!(flags & MS_KERNMOUNT) && !ns_capable(user_ns, CAP_SYS_ADMIN))
+ return ERR_PTR(-EPERM);
+
+ sb = sget(fs_type, ns_test_super, ns_set_super, flags, ns);
if (IS_ERR(sb))
return ERR_CAST(sb);