From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-io0-f177.google.com ([209.85.223.177]) by bombadil.infradead.org with esmtps (Exim 4.80.1 #2 (Red Hat Linux)) id 1ZhNnK-0000eO-BY for linux-mtd@lists.infradead.org; Wed, 30 Sep 2015 20:16:06 +0000 Received: by ioiz6 with SMTP id z6so61468821ioi.2 for ; Wed, 30 Sep 2015 13:15:44 -0700 (PDT) From: Seth Forshee To: "Eric W. Biederman" , linux-bcache@vger.kernel.org, dm-devel@redhat.com, linux-raid@vger.kernel.org, linux-mtd@lists.infradead.org, linux-fsdevel@vger.kernel.org, linux-security-module@vger.kernel.org, selinux@tycho.nsa.gov Cc: Alexander Viro , Serge Hallyn , Andy Lutomirski , linux-kernel@vger.kernel.org, Seth Forshee Subject: [PATCH 0/5] User namespace mount updates Date: Wed, 30 Sep 2015 15:15:09 -0500 Message-Id: <1443644116-41366-1-git-send-email-seth.forshee@canonical.com> List-Id: Linux MTD discussion mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Hi Eric, Here's a batch of updates for the unprivileged user namespace mount patches based on your feedback. I think everything you mentioned should be addressed here. These are now based on your for-testing branch. Updates include: - Fix for incorrect use of flags argument in mount_mtd. - Eliminate lookup_bdev_perm and instead add an access mode argument to lookup_bdev. - Use __inode_permission instead of inode_permission when checking for rights towards a block device inode. - Add a patch replacing in_user_ns with current_in_user_ns. - Add a patch to handle Smack security labels consistently. Thanks, Seth Andy Lutomirski (1): fs: Treat foreign mounts as nosuid Seth Forshee (4): fs: Verify access of user towards block device file when mounting selinux: Add support for unprivileged mounts from user namespaces userns: Replace in_userns with current_in_userns Smack: Handle labels consistently in untrusted mounts drivers/md/bcache/super.c | 2 +- drivers/md/dm-table.c | 2 +- drivers/mtd/mtdsuper.c | 6 +++++- fs/block_dev.c | 18 +++++++++++++++--- fs/exec.c | 2 +- fs/namespace.c | 13 +++++++++++++ fs/quota/quota.c | 2 +- include/linux/fs.h | 2 +- include/linux/mount.h | 1 + include/linux/user_namespace.h | 6 ++---- kernel/user_namespace.c | 6 +++--- security/commoncap.c | 4 ++-- security/selinux/hooks.c | 25 ++++++++++++++++++++++++- security/smack/smack_lsm.c | 28 ++++++++++++++++++---------- 14 files changed, 88 insertions(+), 29 deletions(-)