Eric W. Biederman 93faccbbfa
fs: Better permission checking for submounts ...
To support unprivileged users mounting filesystems two permission
checks have to be performed: a test to see if the user allowed to
create a mount in the mount namespace, and a test to see if
the user is allowed to access the specified filesystem.
The automount case is special in that mounting the original filesystem
grants permission to mount the sub-filesystems, to any user who
happens to stumble across the their mountpoint and satisfies the
ordinary filesystem permission checks.
Attempting to handle the automount case by using override_creds
almost works. It preserves the idea that permission to mount
the original filesystem is permission to mount the sub-filesystem.
Unfortunately using override_creds messes up the filesystems
ordinary permission checks.
Solve this by being explicit that a mount is a submount by introducing
vfs_submount, and using it where appropriate.
vfs_submount uses a new mount internal mount flags MS_SUBMOUNT, to let
sget and friends know that a mount is a submount so they can take appropriate
action.
sget and sget_userns are modified to not perform any permission checks
on submounts.
follow_automount is modified to stop using override_creds as that
has proven problemantic.
do_mount is modified to always remove the new MS_SUBMOUNT flag so
that we know userspace will never by able to specify it.
autofs4 is modified to stop using current_real_cred that was put in
there to handle the previous version of submount permission checking.
cifs is modified to pass the mountpoint all of the way down to vfs_submount.
debugfs is modified to pass the mountpoint all of the way down to
trace_automount by adding a new parameter. To make this change easier
a new typedef debugfs_automount_t is introduced to capture the type of
the debugfs automount function.
Cc: stable@vger.kernel.org
Fixes: 069d5ac9aeaeaa4a79fftrond.myklebust@primarydata.com >
Reviewed-by: Seth Forshee <seth.forshee@canonical.com >
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com >
2017-02-02 04:36:12 +13:00
2016-12-14 20:42:45 -08:00
2016-12-16 11:23:34 -08:00
2016-11-02 20:44:20 +01:00
2016-11-29 15:51:49 -06:00
2016-11-29 09:17:20 +01:00
2016-12-07 15:24:12 +01:00
2016-11-17 23:19:00 +01:00
2016-11-13 11:40:26 +00:00
2016-12-25 11:04:12 +01:00
2016-12-19 08:16:26 -08:00
2016-12-25 11:04:12 +01:00
2016-12-15 12:03:32 -08:00
2016-12-05 14:16:22 +01:00
2016-11-29 18:28:30 -08:00
2016-12-06 21:42:19 +01:00
2016-12-14 10:49:33 -08:00
2016-12-17 20:17:04 -08:00
2016-11-23 23:37:27 +01:00
2016-12-02 12:44:37 -05:00
2016-12-05 11:38:30 +00:00
2016-10-18 20:12:05 +05:30
2016-11-14 21:52:14 -08:00
2016-10-20 08:44:57 +02:00
2016-12-15 16:03:25 -08:00
2016-10-21 12:09:30 +01:00
2016-12-16 10:48:28 -08:00
2016-12-13 11:10:36 -08:00
2016-12-06 16:57:33 +01:00
2016-12-15 12:46:48 -08:00
2016-12-05 14:31:24 -05:00
2016-12-22 22:58:37 -05:00
2016-12-01 14:45:08 +01:00
2016-10-19 14:34:36 -04:00
2016-12-05 19:00:38 -05:00
2016-12-13 10:19:16 -08:00
2016-12-09 08:30:51 -07:00
2016-12-01 07:58:40 -07:00
2016-11-01 09:43:26 -06:00
2016-12-14 10:49:33 -08:00
2016-12-17 13:02:04 -07:00
2016-10-28 08:48:16 -06:00
2016-12-08 13:31:11 -05:00
2016-12-17 11:14:25 -05:00
2016-12-17 21:27:44 -05:00
2016-11-30 10:22:27 -05:00
2016-11-17 20:15:26 -05:00
2016-11-04 14:34:47 -06:00
2016-10-31 13:01:58 -07:00
2016-12-22 09:25:45 -08:00
2016-11-22 13:21:00 -06:00
2016-10-25 11:08:28 +08:00
2016-11-25 16:25:52 -05:00
2016-10-17 15:27:27 -07:00
2016-12-08 16:37:33 -08:00
2016-12-25 11:04:12 +01:00
2016-12-12 18:55:08 -08:00
2016-12-12 18:55:09 -08:00
2016-12-21 10:16:05 -08:00
2016-12-13 11:18:24 -08:00
2016-12-25 10:47:43 +01:00
2016-11-21 14:35:43 +01:00
2016-12-25 10:47:44 +01:00
2016-11-29 14:02:21 +01:00
2016-12-15 11:32:31 +01:00
2016-12-17 16:00:34 -08:00
2016-12-26 20:29:24 -08:00
2016-12-03 20:51:49 -05:00
2016-12-05 19:01:16 -05:00
2017-02-02 04:36:12 +13:00
2016-11-23 10:07:35 +08:00
2016-12-13 11:42:18 -08:00
2016-10-28 08:48:16 -06:00
2016-10-25 14:40:39 +02:00
2016-10-25 14:40:39 +02:00
2016-11-15 12:48:33 +01:00
2016-11-14 16:58:36 +01:00
2016-12-14 16:04:08 -08:00
2016-11-30 08:54:04 +05:30
2016-10-27 16:16:09 -04:00
2016-12-25 11:04:12 +01:00
2016-12-15 08:58:12 -02:00
2016-11-13 08:23:16 +01:00
2016-12-09 09:03:02 -07:00
2016-11-25 10:15:13 -08:00
2016-10-20 14:51:10 -04:00
2016-12-05 19:01:16 -05:00
2016-12-27 12:28:07 -05:00
2016-11-11 08:12:37 -08:00
2016-12-19 08:23:53 -08:00
2016-12-11 16:33:18 -05:00
2016-12-05 15:13:58 +01:00
2017-01-24 12:03:07 +13:00
2016-12-05 18:58:32 -05:00
2016-12-15 13:49:34 -08:00
2016-12-25 17:21:22 +01:00
2016-11-29 15:57:42 +00:00
2016-10-27 16:16:09 -04:00
2016-12-14 16:04:08 -08:00
2016-11-07 16:24:29 -08:00
2016-10-20 14:51:09 -04:00
2016-10-17 14:23:46 +02:00
2016-12-14 10:12:26 +01:00
2016-10-20 14:51:10 -04:00
2016-12-25 17:21:22 +01:00
2016-12-14 16:04:09 -08:00
2016-11-21 22:50:45 +08:00
2016-12-09 21:54:22 -08:00
2016-12-06 11:52:49 +01:00
2016-11-24 16:22:06 +01:00
2016-11-24 16:22:06 +01:00
2016-12-14 16:04:10 -08:00
2016-10-27 16:03:24 +02:00
2016-11-27 20:38:47 -05:00
2016-11-15 12:16:13 -05:00
2016-12-20 09:48:44 -08:00
2016-11-27 16:15:33 -08:00
2016-11-19 09:42:35 -08:00
2016-11-09 08:25:09 +01:00
2016-10-26 15:45:38 +10:00
2016-11-30 14:36:01 +11:00
2016-12-06 17:32:16 +01:00
2016-12-03 23:21:37 -05:00
2016-12-24 11:46:01 -08:00
2016-10-16 11:02:31 +02:00
2016-10-27 18:43:43 -07:00
2016-12-14 16:04:08 -08:00
2016-11-15 09:51:05 +01:00
2016-12-14 20:12:43 -08:00
2016-12-16 09:26:42 -08:00
2016-12-12 18:55:06 -08:00
2016-12-25 17:21:23 +01:00
2016-12-13 15:47:02 -08:00
2016-11-22 12:07:05 +01:00
2016-10-19 14:34:36 -04:00
2016-12-06 16:08:10 -08:00
2016-11-29 12:12:51 -07:00
2016-10-31 13:01:57 -07:00
2016-11-30 14:32:25 +11:00
2016-11-18 13:54:21 -05:00
2016-11-29 18:02:58 +01:00
2016-11-17 08:24:48 -07:00
2016-12-06 11:05:46 +01:00
2016-12-12 18:55:07 -08:00
2016-11-02 15:17:09 -04:00
2016-12-17 20:17:04 -08:00
2016-12-18 11:12:53 -08:00
2016-12-25 11:54:48 -08:00
2016-12-16 00:13:41 +02:00
2016-12-14 16:33:38 +01:00
2016-11-26 11:18:02 -08:00
2017-02-02 04:36:12 +13:00
2016-11-16 10:39:43 +01:00
2016-12-08 13:18:35 -05:00
2016-12-06 21:48:21 +01:00
2016-12-06 21:42:16 +01:00
2016-11-16 18:32:02 -05:00
2016-12-15 20:42:48 -05:00
2016-12-19 17:29:44 -05:00
2016-12-09 23:47:10 -05:00
2016-12-14 16:04:08 -08:00
2016-12-24 11:23:24 -08:00
2016-12-06 10:17:56 +02:00
2016-12-06 10:17:56 +02:00
2016-12-13 10:19:16 -08:00
2016-12-12 18:55:07 -08:00
2016-11-29 15:57:43 +00:00
2016-11-29 23:17:02 -05:00
2016-11-14 15:21:14 -06:00
2016-11-10 17:03:35 +01:00
2016-12-29 11:03:15 -08:00
2016-12-25 11:54:48 -08:00
2016-12-06 10:17:03 +02:00
2016-11-17 18:47:58 -06:00
2016-12-15 12:46:48 -08:00
2016-12-06 13:45:48 -06:00
2016-12-06 13:45:50 -06:00
2016-12-15 12:46:48 -08:00
2016-10-28 11:06:25 +02:00
2016-10-18 11:56:31 -04:00
2016-12-08 14:21:47 -05:00
2016-10-31 16:18:30 -04:00
2016-10-21 22:20:56 +02:00
2016-12-06 02:27:59 +01:00
2016-12-13 11:42:18 -08:00
2016-11-29 18:02:58 +01:00
2016-12-13 11:42:18 -08:00
2016-12-24 11:46:01 -08:00
2016-12-06 10:32:40 +01:00
2016-12-12 18:55:09 -08:00
2016-12-13 16:07:55 -08:00
2016-11-15 16:34:26 -08:00
2016-11-15 16:34:27 -08:00
2016-12-12 19:56:15 -08:00
2016-11-22 12:57:38 -06:00
2016-12-19 08:23:53 -08:00
2016-12-05 19:03:06 -05:00
2016-12-14 16:04:10 -08:00
2016-12-20 09:48:47 -08:00
2016-10-31 13:01:57 -07:00
2016-10-29 12:14:39 -06:00
2016-11-14 21:52:18 -08:00
2016-11-15 08:30:02 +01:00
2016-11-11 18:24:16 +00:00
2016-12-02 00:52:34 +01:00
2016-12-12 18:55:08 -08:00
2016-12-12 11:26:47 -08:00
2016-10-31 15:45:18 -07:00
2017-01-24 12:03:07 +13:00
2017-01-24 12:03:08 +13:00
2016-11-09 20:40:06 -05:00
2016-11-09 20:40:06 -05:00
2016-11-09 20:40:06 -05:00
2016-11-09 20:40:06 -05:00
2016-10-25 14:40:39 +02:00
2016-11-16 10:59:38 +01:00
2016-12-16 00:13:41 +02:00
2016-12-14 16:04:07 -08:00
2016-12-25 17:21:22 +01:00
2016-10-18 14:14:20 -04:00
2016-11-22 17:48:04 -05:00
2016-12-08 13:07:10 -05:00
2016-11-21 22:48:10 +01:00
2016-12-13 10:19:16 -08:00
2016-11-07 15:06:33 -05:00
2016-10-25 14:40:39 +02:00
2016-11-10 10:10:37 +01:00
2016-10-17 09:50:56 -07:00
2016-12-05 13:32:24 -05:00
2016-11-23 10:06:12 +08:00
2016-11-11 18:25:08 +00:00
2016-12-25 17:21:22 +01:00
2016-11-16 09:26:34 +01:00
2016-12-25 11:04:12 +01:00
2016-12-25 11:04:12 +01:00
2016-12-25 11:04:12 +01:00
2016-11-22 17:40:00 -05:00
2016-12-09 09:13:30 -05:00
2016-12-09 09:13:30 -05:00
2016-12-25 11:04:12 +01:00
2016-12-09 22:12:21 -05:00
2016-12-16 10:24:44 -08:00
2016-12-11 18:01:51 -08:00
2016-10-24 14:36:25 +02:00
2017-01-24 12:03:07 +13:00
2016-12-14 16:04:09 -08:00
2016-12-01 10:40:05 -07:00
2016-11-19 10:37:03 -05:00
2016-12-12 18:55:08 -08:00
2016-12-06 11:03:22 +01:00
2016-10-27 16:37:44 +02:00
2016-12-25 17:21:22 +01:00
2016-12-13 12:59:57 -08:00
2016-12-25 11:54:48 -08:00
2016-12-06 10:42:03 +01:00
93faccbbfa