From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755149AbcFGMJ0 (ORCPT ); Tue, 7 Jun 2016 08:09:26 -0400 Received: from out03.mta.xmission.com ([166.70.13.233]:44075 "EHLO out03.mta.xmission.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752958AbcFGMJX (ORCPT ); Tue, 7 Jun 2016 08:09:23 -0400 From: ebiederm@xmission.com (Eric W. Biederman) To: Linus Torvalds Cc: Seth Forshee , Linux Containers , , Date: Tue, 07 Jun 2016 06:57:36 -0500 Message-ID: <874m95ky8f.fsf@x220.int.ebiederm.org> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.5 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain X-XM-AID: U2FsdGVkX19Z+e3uzePwSoMQuvgVQi2A4iTTWURTkus= X-SA-Exim-Connect-IP: 67.3.226.120 X-SA-Exim-Mail-From: ebiederm@xmission.com X-Spam-Report: * -1.0 ALL_TRUSTED Passed through trusted hosts only via SMTP * 0.0 TVD_RCVD_IP Message was received from an IP address * 0.8 BAYES_50 BODY: Bayes spam probability is 40 to 60% * [score: 0.5000] * -0.0 DCC_CHECK_NEGATIVE Not listed in DCC * [sa05 1397; Body=1 Fuz1=1 Fuz2=1] * 0.0 T_TooManySym_01 4+ unique symbols in subject * 1.2 XMSubMetaSxObfu_03 Obfuscated Sexy Noun-People * 1.0 XMSubMetaSx_00 1+ Sexy Words X-Spam-DCC: XMission; sa05 1397; Body=1 Fuz1=1 Fuz2=1 X-Spam-Combo: **;Linus Torvalds X-Spam-Relay-Country: X-Spam-Timing: total 357 ms - load_scoreonly_sql: 0.05 (0.0%), signal_user_changed: 4.8 (1.4%), b_tie_ro: 3.7 (1.0%), parse: 0.95 (0.3%), extract_message_metadata: 3.4 (0.9%), get_uri_detail_list: 1.36 (0.4%), tests_pri_-1000: 3.6 (1.0%), tests_pri_-950: 1.26 (0.4%), tests_pri_-900: 0.98 (0.3%), tests_pri_-400: 20 (5.5%), check_bayes: 19 (5.2%), b_tokenize: 5 (1.5%), b_tok_get_all: 6 (1.6%), b_comp_prob: 1.75 (0.5%), b_tok_touch_all: 2.8 (0.8%), b_finish: 0.70 (0.2%), tests_pri_0: 307 (86.0%), check_dkim_signature: 0.52 (0.1%), check_dkim_adsp: 88 (24.6%), tests_pri_500: 5 (1.5%), rewrite_mail: 0.00 (0.0%) Subject: [GIT PULL] userns related fixes for v4.7-rc3 X-Spam-Flag: No X-SA-Exim-Version: 4.2.1 (built Thu, 05 May 2016 13:38:54 -0600) X-SA-Exim-Scanned: Yes (on in01.mta.xmission.com) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Linus, Please pull the for-linus branch from the git tree: git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace.git for-linus HEAD: d71ed6c930ac7d8f88f3cef6624a7e826392d61f mnt: fs_fully_visible test the proper mount for MNT_LOCKED This contains two small but significant fixes to fs/namespace.c. The first adds a drops the filesystem refcount drop on error. The second corrects a test in fs_fully_visible which could be abused to allow mounting of proc or sysfs, when that should not be allowed. To keep myself honest I have tested to ensure the incorrect test in fs_fully_visible actually allows improper mounting of proc before the fix and that when fixed the improper mounting is not allowed. Eric W. Biederman (2): mnt: If fs_fully_visible fails call put_filesystem. mnt: fs_fully_visible test the proper mount for MNT_LOCKED fs/namespace.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/fs/namespace.c b/fs/namespace.c index 4fb1691b4355..a7ec92c051f5 100644 --- a/fs/namespace.c +++ b/fs/namespace.c @@ -2409,8 +2409,10 @@ static int do_new_mount(struct path *path, const char *fstype, int flags, mnt_flags |= MNT_NODEV | MNT_LOCK_NODEV; } if (type->fs_flags & FS_USERNS_VISIBLE) { - if (!fs_fully_visible(type, &mnt_flags)) + if (!fs_fully_visible(type, &mnt_flags)) { + put_filesystem(type); return -EPERM; + } } } @@ -3271,7 +3273,7 @@ static bool fs_fully_visible(struct file_system_type *type, int *new_mnt_flags) list_for_each_entry(child, &mnt->mnt_mounts, mnt_child) { struct inode *inode = child->mnt_mountpoint->d_inode; /* Only worry about locked mounts */ - if (!(mnt_flags & MNT_LOCKED)) + if (!(child->mnt.mnt_flags & MNT_LOCKED)) continue; /* Is the directory permanetly empty? */ if (!is_empty_dir_inode(inode)) Eric