[PATCH v3 0/7] User namespace mount updates

Seth Forshee
2015-11-17T16:39:03Z

Hi Eric,

Here's another update to my patches for user namespace mounts, based on
your for-testing branch. These patches add safeguards necessary to allow
unprivileged mounts and update SELinux and Smack to safely handle
device-backed mounts from unprivileged users.

The v2 posting received very little in the way of feedback, so changes
are minimal. I've made a trivial style change to the Smack changes at
Casey's request, and I've added Stephen's ack for the SELinux changes.

Thanks,
Seth

Andy Lutomirski (1):
fs: Treat foreign mounts as nosuid

Seth Forshee (6):
block_dev: Support checking inode permissions in lookup_bdev()
block_dev: Check permissions towards block device inode when mounting
mtd: Check permissions towards mtd block device inode when mounting
selinux: Add support for unprivileged mounts from user namespaces
userns: Replace in_userns with current_in_userns
Smack: Handle labels consistently in untrusted mounts

drivers/md/bcache/super.c | 2 +-
drivers/md/dm-table.c | 2 +-
drivers/mtd/mtdsuper.c | 6 +++++-
fs/block_dev.c | 18 +++++++++++++++---
fs/exec.c | 2 +-
fs/namespace.c | 13 +++++++++++++
fs/quota/quota.c | 2 +-
include/linux/fs.h | 2 +-
include/linux/mount.h | 1 +
include/linux/user_namespace.h | 6 ++----
kernel/user_namespace.c | 6 +++---
security/commoncap.c | 4 ++--
security/selinux/hooks.c | 25 ++++++++++++++++++++++++-
security/smack/smack_lsm.c | 29 +++++++++++++++++++----------
14 files changed, 89 insertions(+), 29 deletions(-)