From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Cedric Bosdonnat <cbosdonnat@suse.com>,
Richard Weinberger <richard@nod.at>,
"Eric W. Biederman" <ebiederm@xmission.com>
Subject: [PATCH 3.10 18/38] mnt: Implicitly add MNT_NODEV on remount when it was implicitly added by mount
Date: Tue, 6 Jan 2015 17:50:30 -0800 [thread overview]
Message-ID: <20150107014955.374410359@linuxfoundation.org> (raw)
In-Reply-To: <20150107014952.440109372@linuxfoundation.org>
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Eric W. Biederman" <ebiederm@xmission.com>
commit 3e1866410f11356a9fd869beb3e95983dc79c067 upstream.
Now that remount is properly enforcing the rule that you can't remove
nodev at least sandstorm.io is breaking when performing a remount.
It turns out that there is an easy intuitive solution implicitly
add nodev on remount when nodev was implicitly added on mount.
Tested-by: Cedric Bosdonnat <cbosdonnat@suse.com>
Tested-by: Richard Weinberger <richard@nod.at>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/namespace.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -1816,7 +1816,13 @@ static int do_remount(struct path *path,
}
if ((mnt->mnt.mnt_flags & MNT_LOCK_NODEV) &&
!(mnt_flags & MNT_NODEV)) {
- return -EPERM;
+ /* Was the nodev implicitly added in mount? */
+ if ((mnt->mnt_ns->user_ns != &init_user_ns) &&
+ !(sb->s_type->fs_flags & FS_USERNS_DEV_MOUNT)) {
+ mnt_flags |= MNT_NODEV;
+ } else {
+ return -EPERM;
+ }
}
if ((mnt->mnt.mnt_flags & MNT_LOCK_NOSUID) &&
!(mnt_flags & MNT_NOSUID)) {
next prev parent reply other threads:[~2015-01-07 1:50 UTC|newest]
Thread overview: 40+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-01-07 1:50 [PATCH 3.10 00/38] 3.10.64-stable review Greg Kroah-Hartman
2015-01-07 1:50 ` [PATCH 3.10 01/38] isofs: Fix infinite looping over CE entries Greg Kroah-Hartman
2015-01-07 1:50 ` [PATCH 3.10 02/38] x86/tls: Validate TLS entries to protect espfix Greg Kroah-Hartman
2015-01-07 1:50 ` [PATCH 3.10 03/38] x86/tls: Disallow unusual TLS segments Greg Kroah-Hartman
2015-01-07 1:50 ` [PATCH 3.10 04/38] x86_64, switch_to(): Load TLS descriptors before switching DS and ES Greg Kroah-Hartman
2015-01-07 1:50 ` [PATCH 3.10 05/38] x86, kvm: Clear paravirt_enabled on KVM guests for espfix32s benefit Greg Kroah-Hartman
2015-01-07 1:50 ` [PATCH 3.10 06/38] md/bitmap: always wait for writes on unplug Greg Kroah-Hartman
2015-01-07 1:50 ` [PATCH 3.10 07/38] mfd: tc6393xb: Fail ohci suspend if full state restore is required Greg Kroah-Hartman
2015-01-07 1:50 ` [PATCH 3.10 08/38] mmc: block: add newline to sysfs display of force_ro Greg Kroah-Hartman
2015-01-07 1:50 ` [PATCH 3.10 09/38] megaraid_sas: corrected return of wait_event from abort frame path Greg Kroah-Hartman
2015-01-07 1:50 ` [PATCH 3.10 10/38] nfs41: fix nfs4_proc_layoutget error handling Greg Kroah-Hartman
2015-01-07 1:50 ` [PATCH 3.10 11/38] dm bufio: fix memleak when using a dm_buffers inline bio Greg Kroah-Hartman
2015-01-07 1:50 ` [PATCH 3.10 12/38] dm space map metadata: fix sm_bootstrap_get_nr_blocks() Greg Kroah-Hartman
2015-01-07 1:50 ` [PATCH 3.10 13/38] x86/tls: Dont validate lm in set_thread_area() after all Greg Kroah-Hartman
2015-01-07 1:50 ` [PATCH 3.10 14/38] isofs: Fix unchecked printing of ER records Greg Kroah-Hartman
2015-01-07 1:50 ` [PATCH 3.10 15/38] KEYS: Fix stale key registration at error path Greg Kroah-Hartman
2015-01-07 1:50 ` [PATCH 3.10 17/38] mac80211: free management frame keys when removing station Greg Kroah-Hartman
2015-01-07 1:50 ` Greg Kroah-Hartman [this message]
2015-01-07 1:50 ` [PATCH 3.10 19/38] mnt: Update unprivileged remount test Greg Kroah-Hartman
2015-01-07 1:50 ` [PATCH 3.10 20/38] umount: Disallow unprivileged mount force Greg Kroah-Hartman
2015-01-07 1:50 ` [PATCH 3.10 21/38] groups: Consolidate the setgroups permission checks Greg Kroah-Hartman
2015-01-07 1:50 ` [PATCH 3.10 22/38] userns: Document what the invariant required for safe unprivileged mappings Greg Kroah-Hartman
2015-01-07 1:50 ` [PATCH 3.10 23/38] userns: Dont allow setgroups until a gid mapping has been setablished Greg Kroah-Hartman
2015-01-07 1:50 ` [PATCH 3.10 24/38] userns: Dont allow unprivileged creation of gid mappings Greg Kroah-Hartman
2015-01-07 1:50 ` [PATCH 3.10 25/38] userns: Check euid no fsuid when establishing an unprivileged uid mapping Greg Kroah-Hartman
2015-01-07 1:50 ` [PATCH 3.10 26/38] userns: Only allow the creator of the userns unprivileged mappings Greg Kroah-Hartman
2015-01-07 1:50 ` [PATCH 3.10 27/38] userns: Rename id_map_mutex to userns_state_mutex Greg Kroah-Hartman
2015-01-07 1:50 ` [PATCH 3.10 28/38] userns: Add a knob to disable setgroups on a per user namespace basis Greg Kroah-Hartman
2015-01-07 1:50 ` [PATCH 3.10 29/38] userns: Allow setting gid_maps without privilege when setgroups is disabled Greg Kroah-Hartman
2015-01-07 1:50 ` [PATCH 3.10 30/38] userns: Unbreak the unprivileged remount tests Greg Kroah-Hartman
2015-01-07 1:50 ` [PATCH 3.10 31/38] crypto: af_alg - fix backlog handling Greg Kroah-Hartman
2015-01-07 1:50 ` [PATCH 3.10 32/38] ncpfs: return proper error from NCP_IOC_SETROOT ioctl Greg Kroah-Hartman
2015-01-07 1:50 ` [PATCH 3.10 33/38] exit: pidns: alloc_pid() leaks pid_namespace if child_reaper is exiting Greg Kroah-Hartman
2015-01-07 1:50 ` [PATCH 3.10 34/38] udf: Verify symlink size before loading it Greg Kroah-Hartman
2015-01-07 1:50 ` [PATCH 3.10 35/38] eCryptfs: Force RO mount when encrypted view is enabled Greg Kroah-Hartman
2015-01-07 1:50 ` [PATCH 3.10 36/38] eCryptfs: Remove buggy and unnecessary write in file name decode routine Greg Kroah-Hartman
2015-01-07 1:50 ` [PATCH 3.10 37/38] Btrfs: do not move em to modified list when unpinning Greg Kroah-Hartman
2015-01-07 1:50 ` [PATCH 3.10 38/38] Btrfs: fix fs corruption on transaction abort if device supports discard Greg Kroah-Hartman
2015-01-07 13:38 ` [PATCH 3.10 00/38] 3.10.64-stable review Guenter Roeck
2015-01-07 23:33 ` Shuah Khan
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20150107014955.374410359@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=cbosdonnat@suse.com \
--cc=ebiederm@xmission.com \
--cc=linux-kernel@vger.kernel.org \
--cc=richard@nod.at \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).