[PATCH OLK-5.10 0/2] fs: Backport two namespace fix patches
Al Viro (2): do_change_type(): refuse to operate on unmounted/not ours mounts clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns fs/namespace.c | 9 +++++++++ 1 file changed, 9 insertions(+) -- 2.34.3
From: Al Viro <viro@zeniv.linux.org.uk> mainline inclusion from mainline-v6.10-rc4 commit 12f147ddd6de7382dad54812e65f3f08d05809fc category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICGF26 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i... -------------------------------- Ensure that propagation settings can only be changed for mounts located in the caller's mount namespace. This change aligns permission checking with the rest of mount(2). Reviewed-by: Christian Brauner <brauner@kernel.org> Fixes: 07b20889e305 ("beginning of the shared-subtree proper") Reported-by: "Orlando, Noah" <Noah.Orlando@deshaw.com> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Wang Zhaolong <wangzhaolong1@huawei.com> --- fs/namespace.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/namespace.c b/fs/namespace.c index 61c88343cc94..617288486ef8 100644 --- a/fs/namespace.c +++ b/fs/namespace.c @@ -2309,10 +2309,14 @@ static int do_change_type(struct path *path, int ms_flags) type = flags_to_propagation_type(ms_flags); if (!type) return -EINVAL; namespace_lock(); + if (!check_mnt(mnt)) { + err = -EINVAL; + goto out_unlock; + } if (type == MS_SHARED) { err = invent_group_ids(mnt, recurse); if (err) goto out_unlock; } -- 2.34.3
From: Al Viro <viro@zeniv.linux.org.uk> mainline inclusion from mainline-v6.10-rc4 commit c28f922c9dcee0e4876a2c095939d77fe7e15116 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICGF26 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i... -------------------------------- What we want is to verify there is that clone won't expose something hidden by a mount we wouldn't be able to undo. "Wouldn't be able to undo" may be a result of MNT_LOCKED on a child, but it may also come from lacking admin rights in the userns of the namespace mount belongs to. clone_private_mnt() checks the former, but not the latter. There's a number of rather confusing CAP_SYS_ADMIN checks in various userns during the mount, especially with the new mount API; they serve different purposes and in case of clone_private_mnt() they usually, but not always end up covering the missing check mentioned above. Reviewed-by: Christian Brauner <brauner@kernel.org> Reported-by: "Orlando, Noah" <Noah.Orlando@deshaw.com> Fixes: 427215d85e8d ("ovl: prevent private clone if bind mount is not allowed") Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Conflicts: fs/namespace.c [Conflicts with mainline commit db04662e2f4f ("fs: allow detached mounts in clone_private_mount()") and commit 1f282cdc1d21 ("fs/fhandle.c: fix a race in call of has_locked_children()").] Signed-off-by: Wang Zhaolong <wangzhaolong1@huawei.com> --- fs/namespace.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/fs/namespace.c b/fs/namespace.c index 617288486ef8..000dc921e810 100644 --- a/fs/namespace.c +++ b/fs/namespace.c @@ -1957,10 +1957,15 @@ struct vfsmount *clone_private_mount(const struct path *path) goto invalid; if (!check_mnt(old_mnt)) goto invalid; + if (!ns_capable(old_mnt->mnt_ns->user_ns, CAP_SYS_ADMIN)) { + up_read(&namespace_sem); + return ERR_PTR(-EPERM); + } + if (has_locked_children(old_mnt, path->dentry)) goto invalid; new_mnt = clone_mnt(old_mnt, path->dentry, CL_PRIVATE); up_read(&namespace_sem); -- 2.34.3
反馈： 您发送到kernel@openeuler.org的补丁/补丁集，已成功转换为PR！ PR链接地址： https://gitee.com/openeuler/kernel/pulls/16885 邮件列表地址：https://mailweb.openeuler.org/archives/list/kernel@openeuler.org/message/6W6... FeedBack: The patch(es) which you have sent to kernel@openeuler.org mailing list has been converted to a pull request successfully! Pull request link: https://gitee.com/openeuler/kernel/pulls/16885 Mailing list address: https://mailweb.openeuler.org/archives/list/kernel@openeuler.org/message/6W6...
participants (2)
-
patchwork bot -
Wang Zhaolong