linux-stable.git/fs/namespace.c, branch linux-4.0.y

mnt: Modify fs_fully_visible to deal with locked ro nodev and atime

2015-07-21T17:10:11+00:00

commit 8c6cf9cc829fcd0b179b59f7fe288941d0e31108 upstream.

Ignore an existing mount if the locked readonly, nodev or atime
attributes are less permissive than the desired attributes
of the new mount.

On success ensure the new mount locks all of the same readonly, nodev and
atime attributes as the old mount.

The nosuid and noexec attributes are not checked here as this change
is destined for stable and enforcing those attributes causes a
regression in lxc and libvirt-lxc where those applications will not
start and there are no known executables on sysfs or proc and no known
way to create exectuables without code modifications

Fixes: e51db73532955 ("userns: Better restrictions on when proc and sysfs can be mounted")
Signed-off-by: "Eric W. Biederman" 
Signed-off-by: Greg Kroah-Hartman

mnt: Refactor the logic for mounting sysfs and proc in a user namespace

2015-07-21T17:10:11+00:00

commit 1b852bceb0d111e510d1a15826ecc4a19358d512 upstream.

Fresh mounts of proc and sysfs are a very special case that works very
much like a bind mount.  Unfortunately the current structure can not
preserve the MNT_LOCK... mount flags.  Therefore refactor the logic
into a form that can be modified to preserve those lock bits.

Add a new filesystem flag FS_USERNS_VISIBLE that requires some mount
of the filesystem be fully visible in the current mount namespace,
before the filesystem may be mounted.

Move the logic for calling fs_fully_visible from proc and sysfs into
fs/namespace.c where it has greater access to mount namespace state.

Signed-off-by: "Eric W. Biederman" 
Signed-off-by: Greg Kroah-Hartman

mnt: Update fs_fully_visible to test for permanently empty directories

2015-07-21T17:10:10+00:00

commit 7236c85e1be51a9e25ba0f6e087a66ca89605a49 upstream.

fs_fully_visible attempts to make fresh mounts of proc and sysfs give
the mounter no more access to proc and sysfs than if they could have
by creating a bind mount.  One aspect of proc and sysfs that makes
this particularly tricky is that there are other filesystems that
typically mount on top of proc and sysfs.  As those filesystems are
mounted on empty directories in practice it is safe to ignore them.
However testing to ensure filesystems are mounted on empty directories
has not been something the in kernel data structures have supported so
the current test for an empty directory which checks to see
if nlink <= 2 is a bit lacking.

proc and sysfs have recently been modified to use the new empty_dir
infrastructure to create all of their dedicated mount points.  Instead
of testing for S_ISDIR(inode->i_mode) && i_nlink <= 2 to see if a
directory is empty, test for is_empty_dir_inode(inode).  That small
change guaranteess mounts found on proc and sysfs really are safe to
ignore, because the directories are not only empty but nothing can
ever be added to them.  This guarantees there is nothing to worry
about when mounting proc and sysfs.

Signed-off-by: "Eric W. Biederman" 
Signed-off-by: Greg Kroah-Hartman

vfs: Ignore unlocked mounts in fs_fully_visible

2015-07-10T16:45:43+00:00

commit ceeb0e5d39fcdf4dca2c997bf225c7fc49200b37 upstream.

Limit the mounts fs_fully_visible considers to locked mounts.
Unlocked can always be unmounted so considering them adds hassle
but no security benefit.

Signed-off-by: "Eric W. Biederman" 
Signed-off-by: Greg Kroah-Hartman

mnt: Fail collect_mounts when applied to unmounted mounts

2015-06-06T15:20:47+00:00

commit cd4a40174b71acd021877341684d8bb1dc8ea4ae upstream.

The only users of collect_mounts are in audit_tree.c

In audit_trim_trees and audit_add_tree_rule the path passed into
collect_mounts is generated from kern_path passed an audit_tree
pathname which is guaranteed to be an absolute path.   In those cases
collect_mounts is obviously intended to work on mounted paths and
if a race results in paths that are unmounted when collect_mounts
it is reasonable to fail early.

The paths passed into audit_tag_tree don't have the absolute path
check.  But are used to play with fsnotify and otherwise interact with
the audit_trees, so again operating only on mounted paths appears
reasonable.

Avoid having to worry about what happens when we try and audit
unmounted filesystems by restricting collect_mounts to mounts
that appear in the mount tree.

Signed-off-by: "Eric W. Biederman" 
Signed-off-by: Greg Kroah-Hartman

mnt: Fix fs_fully_visible to verify the root directory is visible

2015-05-17T16:55:06+00:00

commit 7e96c1b0e0f495c5a7450dc4aa7c9a24ba4305bd upstream.

This fixes a dumb bug in fs_fully_visible that allows proc or sys to
be mounted if there is a bind mount of part of /proc/ or /sys/ visible.

Reported-by: Eric Windisch 
Signed-off-by: "Eric W. Biederman" 
Signed-off-by: Greg Kroah-Hartman

mnt: Update detach_mounts to leave mounts connected

2015-05-06T20:03:51+00:00

commit e0c9c0afd2fc958ffa34b697972721d81df8a56f upstream.

Now that it is possible to lazily unmount an entire mount tree and
leave the individual mounts connected to each other add a new flag
UMOUNT_CONNECTED to umount_tree to force this behavior and use
this flag in detach_mounts.

This closes a bug where the deletion of a file or directory could
trigger an unmount and reveal data under a mount point.

Signed-off-by: "Eric W. Biederman" 
Signed-off-by: Greg Kroah-Hartman

mnt: Fix the error check in __detach_mounts

2015-05-06T20:03:51+00:00

commit f53e57975151f54ad8caa1b0ac8a78091cd5700a upstream.

lookup_mountpoint can return either NULL or an error value.
Update the test in __detach_mounts to test for an error value
to avoid pathological cases causing a NULL pointer dereferences.

The callers of __detach_mounts should prevent it from ever being
called on an unlinked dentry but don't take any chances.

Signed-off-by: "Eric W. Biederman" 
Signed-off-by: Greg Kroah-Hartman

mnt: Honor MNT_LOCKED when detaching mounts

2015-05-06T20:03:51+00:00

commit ce07d891a0891d3c0d0c2d73d577490486b809e1 upstream.

Modify umount(MNT_DETACH) to keep mounts in the hash table that are
locked to their parent mounts, when the parent is lazily unmounted.

In mntput_no_expire detach the children from the hash table, depending
on mnt_pin_kill in cleanup_mnt to decrement the mnt_count of the children.

In __detach_mounts if there are any mounts that have been unmounted
but still are on the list of mounts of a mountpoint, remove their
children from the mount hash table and those children to the unmounted
list so they won't linger potentially indefinitely waiting for their
final mntput, now that the mounts serve no purpose.

Signed-off-by: "Eric W. Biederman" 
Signed-off-by: Greg Kroah-Hartman

mnt: Factor umount_mnt from umount_tree

2015-05-06T20:03:51+00:00

commit 6a46c5735c29175da55b2fa9d53775182422cdd7 upstream.

For future use factor out a function umount_mnt from umount_tree.
This function unhashes a mount and remembers where the mount
was mounted so that eventually when the code makes it to a
sleeping context the mountpoint can be dput.

Signed-off-by: "Eric W. Biederman" 
Signed-off-by: Greg Kroah-Hartman