From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org,
Trond Myklebust <trond.myklebust@primarydata.com>,
Seth Forshee <seth.forshee@canonical.com>,
"Eric W. Biederman" <ebiederm@xmission.com>
Subject: [PATCH 4.9 24/63] fs: Better permission checking for submounts
Date: Mon, 13 Mar 2017 16:39:11 +0800 [thread overview]
Message-ID: <20170313083416.236259709@linuxfoundation.org> (raw)
In-Reply-To: <20170313083414.786638815@linuxfoundation.org>
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric W. Biederman <ebiederm@xmission.com>
commit 93faccbbfa958a9668d3ab4e30f38dd205cee8d8 upstream.
To support unprivileged users mounting filesystems two permission
checks have to be performed: a test to see if the user allowed to
create a mount in the mount namespace, and a test to see if
the user is allowed to access the specified filesystem.
The automount case is special in that mounting the original filesystem
grants permission to mount the sub-filesystems, to any user who
happens to stumble across the their mountpoint and satisfies the
ordinary filesystem permission checks.
Attempting to handle the automount case by using override_creds
almost works. It preserves the idea that permission to mount
the original filesystem is permission to mount the sub-filesystem.
Unfortunately using override_creds messes up the filesystems
ordinary permission checks.
Solve this by being explicit that a mount is a submount by introducing
vfs_submount, and using it where appropriate.
vfs_submount uses a new mount internal mount flags MS_SUBMOUNT, to let
sget and friends know that a mount is a submount so they can take appropriate
action.
sget and sget_userns are modified to not perform any permission checks
on submounts.
follow_automount is modified to stop using override_creds as that
has proven problemantic.
do_mount is modified to always remove the new MS_SUBMOUNT flag so
that we know userspace will never by able to specify it.
autofs4 is modified to stop using current_real_cred that was put in
there to handle the previous version of submount permission checking.
cifs is modified to pass the mountpoint all of the way down to vfs_submount.
debugfs is modified to pass the mountpoint all of the way down to
trace_automount by adding a new parameter. To make this change easier
a new typedef debugfs_automount_t is introduced to capture the type of
the debugfs automount function.
Fixes: 069d5ac9ae0d ("autofs: Fix automounts by using current_real_cred()->uid")
Fixes: aeaa4a79ff6a ("fs: Call d_automount with the filesystems creds")
Reviewed-by: Trond Myklebust <trond.myklebust@primarydata.com>
Reviewed-by: Seth Forshee <seth.forshee@canonical.com>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/afs/mntpt.c | 2 +-
fs/autofs4/waitq.c | 4 ++--
fs/cifs/cifs_dfs_ref.c | 7 ++++---
fs/debugfs/inode.c | 8 ++++----
fs/namei.c | 3 ---
fs/namespace.c | 17 ++++++++++++++++-
fs/nfs/namespace.c | 2 +-
fs/nfs/nfs4namespace.c | 2 +-
fs/super.c | 13 ++++++++++---
include/linux/debugfs.h | 3 ++-
include/linux/mount.h | 3 +++
include/uapi/linux/fs.h | 1 +
kernel/trace/trace.c | 4 ++--
13 files changed, 47 insertions(+), 22 deletions(-)
--- a/fs/afs/mntpt.c
+++ b/fs/afs/mntpt.c
@@ -202,7 +202,7 @@ static struct vfsmount *afs_mntpt_do_aut
/* try and do the mount */
_debug("--- attempting mount %s -o %s ---", devname, options);
- mnt = vfs_kern_mount(&afs_fs_type, 0, devname, options);
+ mnt = vfs_submount(mntpt, &afs_fs_type, devname, options);
_debug("--- mount result %p ---", mnt);
free_page((unsigned long) devname);
--- a/fs/autofs4/waitq.c
+++ b/fs/autofs4/waitq.c
@@ -431,8 +431,8 @@ int autofs4_wait(struct autofs_sb_info *
memcpy(&wq->name, &qstr, sizeof(struct qstr));
wq->dev = autofs4_get_dev(sbi);
wq->ino = autofs4_get_ino(sbi);
- wq->uid = current_real_cred()->uid;
- wq->gid = current_real_cred()->gid;
+ wq->uid = current_cred()->uid;
+ wq->gid = current_cred()->gid;
wq->pid = pid;
wq->tgid = tgid;
wq->status = -EINTR; /* Status return if interrupted */
--- a/fs/cifs/cifs_dfs_ref.c
+++ b/fs/cifs/cifs_dfs_ref.c
@@ -245,7 +245,8 @@ compose_mount_options_err:
* @fullpath: full path in UNC format
* @ref: server's referral
*/
-static struct vfsmount *cifs_dfs_do_refmount(struct cifs_sb_info *cifs_sb,
+static struct vfsmount *cifs_dfs_do_refmount(struct dentry *mntpt,
+ struct cifs_sb_info *cifs_sb,
const char *fullpath, const struct dfs_info3_param *ref)
{
struct vfsmount *mnt;
@@ -259,7 +260,7 @@ static struct vfsmount *cifs_dfs_do_refm
if (IS_ERR(mountdata))
return (struct vfsmount *)mountdata;
- mnt = vfs_kern_mount(&cifs_fs_type, 0, devname, mountdata);
+ mnt = vfs_submount(mntpt, &cifs_fs_type, devname, mountdata);
kfree(mountdata);
kfree(devname);
return mnt;
@@ -334,7 +335,7 @@ static struct vfsmount *cifs_dfs_do_auto
mnt = ERR_PTR(-EINVAL);
break;
}
- mnt = cifs_dfs_do_refmount(cifs_sb,
+ mnt = cifs_dfs_do_refmount(mntpt, cifs_sb,
full_path, referrals + i);
cifs_dbg(FYI, "%s: cifs_dfs_do_refmount:%s , mnt:%p\n",
__func__, referrals[i].node_name, mnt);
--- a/fs/debugfs/inode.c
+++ b/fs/debugfs/inode.c
@@ -187,9 +187,9 @@ static const struct super_operations deb
static struct vfsmount *debugfs_automount(struct path *path)
{
- struct vfsmount *(*f)(void *);
- f = (struct vfsmount *(*)(void *))path->dentry->d_fsdata;
- return f(d_inode(path->dentry)->i_private);
+ debugfs_automount_t f;
+ f = (debugfs_automount_t)path->dentry->d_fsdata;
+ return f(path->dentry, d_inode(path->dentry)->i_private);
}
static const struct dentry_operations debugfs_dops = {
@@ -504,7 +504,7 @@ EXPORT_SYMBOL_GPL(debugfs_create_dir);
*/
struct dentry *debugfs_create_automount(const char *name,
struct dentry *parent,
- struct vfsmount *(*f)(void *),
+ debugfs_automount_t f,
void *data)
{
struct dentry *dentry = start_creating(name, parent);
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -1100,7 +1100,6 @@ static int follow_automount(struct path
bool *need_mntput)
{
struct vfsmount *mnt;
- const struct cred *old_cred;
int err;
if (!path->dentry->d_op || !path->dentry->d_op->d_automount)
@@ -1129,9 +1128,7 @@ static int follow_automount(struct path
if (nd->total_link_count >= 40)
return -ELOOP;
- old_cred = override_creds(&init_cred);
mnt = path->dentry->d_op->d_automount(path);
- revert_creds(old_cred);
if (IS_ERR(mnt)) {
/*
* The filesystem is allowed to return -EISDIR here to indicate
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -995,6 +995,21 @@ vfs_kern_mount(struct file_system_type *
}
EXPORT_SYMBOL_GPL(vfs_kern_mount);
+struct vfsmount *
+vfs_submount(const struct dentry *mountpoint, struct file_system_type *type,
+ const char *name, void *data)
+{
+ /* Until it is worked out how to pass the user namespace
+ * through from the parent mount to the submount don't support
+ * unprivileged mounts with submounts.
+ */
+ if (mountpoint->d_sb->s_user_ns != &init_user_ns)
+ return ERR_PTR(-EPERM);
+
+ return vfs_kern_mount(type, MS_SUBMOUNT, name, data);
+}
+EXPORT_SYMBOL_GPL(vfs_submount);
+
static struct mount *clone_mnt(struct mount *old, struct dentry *root,
int flag)
{
@@ -2779,7 +2794,7 @@ long do_mount(const char *dev_name, cons
flags &= ~(MS_NOSUID | MS_NOEXEC | MS_NODEV | MS_ACTIVE | MS_BORN |
MS_NOATIME | MS_NODIRATIME | MS_RELATIME| MS_KERNMOUNT |
- MS_STRICTATIME | MS_NOREMOTELOCK);
+ MS_STRICTATIME | MS_NOREMOTELOCK | MS_SUBMOUNT);
if (flags & MS_REMOUNT)
retval = do_remount(&path, flags & ~MS_REMOUNT, mnt_flags,
--- a/fs/nfs/namespace.c
+++ b/fs/nfs/namespace.c
@@ -226,7 +226,7 @@ static struct vfsmount *nfs_do_clone_mou
const char *devname,
struct nfs_clone_mount *mountdata)
{
- return vfs_kern_mount(&nfs_xdev_fs_type, 0, devname, mountdata);
+ return vfs_submount(mountdata->dentry, &nfs_xdev_fs_type, devname, mountdata);
}
/**
--- a/fs/nfs/nfs4namespace.c
+++ b/fs/nfs/nfs4namespace.c
@@ -279,7 +279,7 @@ static struct vfsmount *try_location(str
mountdata->hostname,
mountdata->mnt_path);
- mnt = vfs_kern_mount(&nfs4_referral_fs_type, 0, page, mountdata);
+ mnt = vfs_submount(mountdata->dentry, &nfs4_referral_fs_type, page, mountdata);
if (!IS_ERR(mnt))
break;
}
--- a/fs/super.c
+++ b/fs/super.c
@@ -470,7 +470,7 @@ struct super_block *sget_userns(struct f
struct super_block *old;
int err;
- if (!(flags & MS_KERNMOUNT) &&
+ if (!(flags & (MS_KERNMOUNT|MS_SUBMOUNT)) &&
!(type->fs_flags & FS_USERNS_MOUNT) &&
!capable(CAP_SYS_ADMIN))
return ERR_PTR(-EPERM);
@@ -500,7 +500,7 @@ retry:
}
if (!s) {
spin_unlock(&sb_lock);
- s = alloc_super(type, flags, user_ns);
+ s = alloc_super(type, (flags & ~MS_SUBMOUNT), user_ns);
if (!s)
return ERR_PTR(-ENOMEM);
goto retry;
@@ -541,8 +541,15 @@ struct super_block *sget(struct file_sys
{
struct user_namespace *user_ns = current_user_ns();
+ /* We don't yet pass the user namespace of the parent
+ * mount through to here so always use &init_user_ns
+ * until that changes.
+ */
+ if (flags & MS_SUBMOUNT)
+ user_ns = &init_user_ns;
+
/* Ensure the requestor has permissions over the target filesystem */
- if (!(flags & MS_KERNMOUNT) && !ns_capable(user_ns, CAP_SYS_ADMIN))
+ if (!(flags & (MS_KERNMOUNT|MS_SUBMOUNT)) && !ns_capable(user_ns, CAP_SYS_ADMIN))
return ERR_PTR(-EPERM);
return sget_userns(type, test, set, flags, user_ns, data);
--- a/include/linux/debugfs.h
+++ b/include/linux/debugfs.h
@@ -96,9 +96,10 @@ struct dentry *debugfs_create_dir(const
struct dentry *debugfs_create_symlink(const char *name, struct dentry *parent,
const char *dest);
+typedef struct vfsmount *(*debugfs_automount_t)(struct dentry *, void *);
struct dentry *debugfs_create_automount(const char *name,
struct dentry *parent,
- struct vfsmount *(*f)(void *),
+ debugfs_automount_t f,
void *data);
void debugfs_remove(struct dentry *dentry);
--- a/include/linux/mount.h
+++ b/include/linux/mount.h
@@ -90,6 +90,9 @@ struct file_system_type;
extern struct vfsmount *vfs_kern_mount(struct file_system_type *type,
int flags, const char *name,
void *data);
+extern struct vfsmount *vfs_submount(const struct dentry *mountpoint,
+ struct file_system_type *type,
+ const char *name, void *data);
extern void mnt_set_expiry(struct vfsmount *mnt, struct list_head *expiry_list);
extern void mark_mounts_for_expiry(struct list_head *mounts);
--- a/include/uapi/linux/fs.h
+++ b/include/uapi/linux/fs.h
@@ -132,6 +132,7 @@ struct inodes_stat_t {
#define MS_LAZYTIME (1<<25) /* Update the on-disk [acm]times lazily */
/* These sb flags are internal to the kernel */
+#define MS_SUBMOUNT (1<<26)
#define MS_NOREMOTELOCK (1<<27)
#define MS_NOSEC (1<<28)
#define MS_BORN (1<<29)
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -7241,7 +7241,7 @@ init_tracer_tracefs(struct trace_array *
ftrace_init_tracefs(tr, d_tracer);
}
-static struct vfsmount *trace_automount(void *ingore)
+static struct vfsmount *trace_automount(struct dentry *mntpt, void *ingore)
{
struct vfsmount *mnt;
struct file_system_type *type;
@@ -7254,7 +7254,7 @@ static struct vfsmount *trace_automount(
type = get_fs_type("tracefs");
if (!type)
return NULL;
- mnt = vfs_kern_mount(type, 0, "tracefs", NULL);
+ mnt = vfs_submount(mntpt, type, "tracefs", NULL);
put_filesystem(type);
if (IS_ERR(mnt))
return NULL;
next prev parent reply other threads:[~2017-03-13 9:08 UTC|newest]
Thread overview: 58+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-03-13 8:38 [PATCH 4.9 00/63] 4.9.15-stable review Greg Kroah-Hartman
2017-03-13 8:38 ` [PATCH 4.9 01/63] tty: n_hdlc: get rid of racy n_hdlc.tbuf Greg Kroah-Hartman
2017-03-13 8:38 ` [PATCH 4.9 02/63] serial: 8250_pci: Add MKS Tenta SCOM-0800 and SCOM-0801 cards Greg Kroah-Hartman
2017-03-13 8:38 ` [PATCH 4.9 03/63] KVM: s390: Disable dirty log retrieval for UCONTROL guests Greg Kroah-Hartman
2017-03-13 8:38 ` [PATCH 4.9 04/63] KVM: VMX: use correct vmcs_read/write for guest segment selector/base Greg Kroah-Hartman
2017-03-13 8:38 ` [PATCH 4.9 05/63] Bluetooth: Add another AR3012 04ca:3018 device Greg Kroah-Hartman
2017-03-13 8:38 ` [PATCH 4.9 06/63] s390/qdio: clear DSCI prior to scanning multiple input queues Greg Kroah-Hartman
2017-03-13 8:38 ` [PATCH 4.9 07/63] s390/dcssblk: fix device size calculation in dcssblk_direct_access() Greg Kroah-Hartman
2017-03-13 8:38 ` [PATCH 4.9 08/63] s390/kdump: Use "LINUX" ELF note name instead of "CORE" Greg Kroah-Hartman
2017-03-13 8:38 ` [PATCH 4.9 09/63] s390/chsc: Add exception handler for CHSC instruction Greg Kroah-Hartman
2017-03-13 8:38 ` [PATCH 4.9 10/63] s390: TASK_SIZE for kernel threads Greg Kroah-Hartman
2017-03-13 8:38 ` [PATCH 4.9 11/63] s390: make setup_randomness work Greg Kroah-Hartman
2017-03-13 8:38 ` [PATCH 4.9 12/63] s390: use correct input data address for setup_randomness Greg Kroah-Hartman
2017-03-13 8:39 ` [PATCH 4.9 13/63] net: mvpp2: fix DMA address calculation in mvpp2_txq_inc_put() Greg Kroah-Hartman
2017-03-13 8:39 ` [PATCH 4.9 14/63] cxl: Prevent read/write to AFU config space while AFU not configured Greg Kroah-Hartman
2017-03-13 8:39 ` [PATCH 4.9 15/63] cxl: fix nested locking hang during EEH hotplug Greg Kroah-Hartman
2017-03-13 8:39 ` [PATCH 4.9 16/63] brcmfmac: fix incorrect event channel deduction Greg Kroah-Hartman
2017-03-13 8:39 ` [PATCH 4.9 17/63] mnt: Tuck mounts under others instead of creating shadow/side mounts Greg Kroah-Hartman
2017-03-13 8:39 ` [PATCH 4.9 18/63] IB/ipoib: Fix deadlock between rmmod and set_mode Greg Kroah-Hartman
2017-03-13 8:39 ` [PATCH 4.9 19/63] IB/IPoIB: Add destination address when re-queue packet Greg Kroah-Hartman
2017-03-13 8:39 ` [PATCH 4.9 20/63] IB/mlx5: Fix out-of-bound access Greg Kroah-Hartman
2017-03-13 8:39 ` [PATCH 4.9 21/63] IB/SRP: Avoid using IB_MR_TYPE_SG_GAPS Greg Kroah-Hartman
2017-03-13 8:39 ` [PATCH 4.9 22/63] IB/srp: Avoid that duplicate responses trigger a kernel bug Greg Kroah-Hartman
2017-03-13 8:39 ` [PATCH 4.9 23/63] IB/srp: Fix race conditions related to task management Greg Kroah-Hartman
2017-03-13 8:39 ` Greg Kroah-Hartman [this message]
2017-03-13 8:39 ` [PATCH 4.9 25/63] orangefs: Use RCU for destroy_inode Greg Kroah-Hartman
2017-03-13 8:39 ` [PATCH 4.9 26/63] memory/atmel-ebi: Fix ns <-> cycles conversions Greg Kroah-Hartman
2017-03-13 8:39 ` [PATCH 4.9 27/63] ktest: Fix child exit code processing Greg Kroah-Hartman
2017-03-13 8:39 ` [PATCH 4.9 28/63] ceph: remove req from unsafe list when unregistering it Greg Kroah-Hartman
2017-03-13 8:39 ` [PATCH 4.9 29/63] pci/hotplug/pnv-php: Remove WARN_ON() in pnv_php_put_slot() Greg Kroah-Hartman
2017-03-13 8:39 ` [PATCH 4.9 30/63] pci/hotplug/pnv-php: Disable surprise hotplug capability on conflicts Greg Kroah-Hartman
2017-03-13 8:39 ` [PATCH 4.9 31/63] target: Fix NULL dereference during LUN lookup + active I/O shutdown Greg Kroah-Hartman
2017-03-13 8:39 ` [PATCH 4.9 32/63] drivers/pci/hotplug: Handle presence detection change properly Greg Kroah-Hartman
2017-03-13 8:39 ` [PATCH 4.9 33/63] drivers/pci/hotplug: Fix initial state for empty slot Greg Kroah-Hartman
2017-03-13 8:39 ` [PATCH 4.9 34/63] nlm: Ensure callback code also checks that the files match Greg Kroah-Hartman
2017-03-13 8:39 ` [PATCH 4.9 35/63] pwm: pca9685: Fix period change with same duty cycle Greg Kroah-Hartman
2017-03-13 8:39 ` [PATCH 4.9 36/63] xtensa: move parse_tag_fdt out of #ifdef CONFIG_BLK_DEV_INITRD Greg Kroah-Hartman
2017-03-13 8:39 ` [PATCH 4.9 37/63] nfit, libnvdimm: fix interleave set cookie calculation Greg Kroah-Hartman
2017-03-13 8:39 ` [PATCH 4.9 38/63] mac80211: flush delayed work when entering suspend Greg Kroah-Hartman
2017-03-13 8:39 ` [PATCH 4.9 39/63] mac80211: dont reorder frames with SN smaller than SSN Greg Kroah-Hartman
2017-03-13 8:39 ` [PATCH 4.9 40/63] mac80211: dont handle filtered frames within a BA session Greg Kroah-Hartman
2017-03-13 8:39 ` [PATCH 4.9 43/63] drm/ast: Fix test for VGA enabled Greg Kroah-Hartman
2017-03-13 8:39 ` [PATCH 4.9 44/63] drm/ast: Call open_key before enable_mmio in POST code Greg Kroah-Hartman
2017-03-13 8:39 ` [PATCH 4.9 45/63] drm/ast: Fix AST2400 POST failure without BMC FW or VBIOS Greg Kroah-Hartman
2017-03-13 8:39 ` [PATCH 4.9 48/63] drm/vmwgfx: Work around drm removal of control nodes Greg Kroah-Hartman
2017-03-13 8:39 ` [PATCH 4.9 49/63] dmaengine: imx-sdma - correct the dma transfer residue calculation Greg Kroah-Hartman
2017-03-13 8:39 ` [PATCH 4.9 50/63] drm/imx: imx-tve: Do not set the regulator voltage Greg Kroah-Hartman
2017-03-13 8:39 ` [PATCH 4.9 51/63] drm/atomic: fix an error code in mode_fixup() Greg Kroah-Hartman
2017-03-13 8:39 ` [PATCH 4.9 52/63] drm/i915/gvt: Disable access to stolen memory as a guest Greg Kroah-Hartman
2017-03-13 8:39 ` [PATCH 4.9 56/63] drm/i915: Fix not finding the VBT when it overlaps with OPREGION_ASLE_EXT Greg Kroah-Hartman
2017-03-13 8:39 ` [PATCH 4.9 57/63] libceph: use BUG() instead of BUG_ON(1) Greg Kroah-Hartman
2017-03-13 8:39 ` [PATCH 4.9 58/63] x86, mm: fix gup_pte_range() vs DAX mappings Greg Kroah-Hartman
2017-03-13 8:39 ` [PATCH 4.9 59/63] x86/tlb: Fix tlb flushing when lguest clears PGE Greg Kroah-Hartman
2017-03-13 8:39 ` [PATCH 4.9 60/63] thp: fix another corner case of munlock() vs. THPs Greg Kroah-Hartman
2017-03-13 8:39 ` [PATCH 4.9 61/63] mm: do not call mem_cgroup_free() from within mem_cgroup_alloc() Greg Kroah-Hartman
2017-03-13 8:39 ` [PATCH 4.9 62/63] fat: fix using uninitialized fields of fat_inode/fsinfo_inode Greg Kroah-Hartman
2017-03-13 8:39 ` [PATCH 4.9 63/63] drivers: hv: Turn off write permission on the hypercall page Greg Kroah-Hartman
2017-03-13 22:37 ` [PATCH 4.9 00/63] 4.9.15-stable review Guenter Roeck
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170313083416.236259709@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=ebiederm@xmission.com \
--cc=linux-kernel@vger.kernel.org \
--cc=seth.forshee@canonical.com \
--cc=stable@vger.kernel.org \
--cc=trond.myklebust@primarydata.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).