xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

mnt: Move the FS_USERNS_MOUNT check into sget_userns

Browse Source 
Allowing a filesystem to be mounted by other than root in the initial
user namespace is a filesystem property not a mount namespace property
and as such should be checked in filesystem specific code.  Move the
FS_USERNS_MOUNT test into super.c:sget_userns().

Acked-by: Seth Forshee <seth.forshee@canonical.com>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
This commit is contained in:
Eric W. Biederman
2016-06-06 15:48:04 -05:00
parent 6e4eab577a
commit a001e74cef
2 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
fs/namespace.c
View File

@@ -2397,10 +2397,6 @@ static int do_new_mount(struct path *path, const char *fstype, int flags,
return -ENODEV; return -ENODEV;
if (user_ns != &init_user_ns) { if (user_ns != &init_user_ns) {
if (!(type->fs_flags & FS_USERNS_MOUNT)) {
put_filesystem(type);
return -EPERM;
}
/* Only in special cases allow devices from mounts /* Only in special cases allow devices from mounts
* created outside the initial user namespace. * created outside the initial user namespace.
*/ */

4
fs/super.c
View File

@@ -466,6 +466,10 @@ struct super_block *sget_userns(struct file_system_type *type,
struct super_block *old; struct super_block *old;
int err; int err;
if (!(flags & MS_KERNMOUNT) &&
!(type->fs_flags & FS_USERNS_MOUNT) &&
!capable(CAP_SYS_ADMIN))
return ERR_PTR(-EPERM);
retry: retry:
spin_lock(&sb_lock); spin_lock(&sb_lock);
if (test) { if (test) {