separate copying and locking mount tree on cross-userns copies

Rather than having propagate_mnt() check doing unprivileged copies,
lock them before commit_tree().

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

diff --git a/fs/namespace.c b/fs/namespace.c
index a677b59efd74e25f52fd3db3e610c6c5193fb171..9ed2f2930dfd3c49998f5103df3dd0d20d02e9f5 100644 (file)
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -1013,27 +1013,6 @@ static struct mount *clone_mnt(struct mount *old, struct dentry *root,
 
        mnt->mnt.mnt_flags = old->mnt.mnt_flags;
        mnt->mnt.mnt_flags &= ~(MNT_WRITE_HOLD|MNT_MARKED|MNT_INTERNAL);
-       /* Don't allow unprivileged users to change mount flags */
-       if (flag & CL_UNPRIVILEGED) {
-               mnt->mnt.mnt_flags |= MNT_LOCK_ATIME;
-
-               if (mnt->mnt.mnt_flags & MNT_READONLY)
-                       mnt->mnt.mnt_flags |= MNT_LOCK_READONLY;
-
-               if (mnt->mnt.mnt_flags & MNT_NODEV)
-                       mnt->mnt.mnt_flags |= MNT_LOCK_NODEV;
-
-               if (mnt->mnt.mnt_flags & MNT_NOSUID)
-                       mnt->mnt.mnt_flags |= MNT_LOCK_NOSUID;
-
-               if (mnt->mnt.mnt_flags & MNT_NOEXEC)
-                       mnt->mnt.mnt_flags |= MNT_LOCK_NOEXEC;
-       }
-
-       /* Don't allow unprivileged users to reveal what is under a mount */
-       if ((flag & CL_UNPRIVILEGED) &&
-           (!(flag & CL_EXPIRE) || list_empty(&old->mnt_expire)))
-               mnt->mnt.mnt_flags |= MNT_LOCKED;
 
        atomic_inc(&sb->s_active);
        mnt->mnt.mnt_sb = sb;
@@ -1837,6 +1816,33 @@ int iterate_mounts(int (*f)(struct vfsmount *, void *), void *arg,
        return 0;
 }
 
+static void lock_mnt_tree(struct mount *mnt)
+{
+       struct mount *p;
+
+       for (p = mnt; p; p = next_mnt(p, mnt)) {
+               int flags = p->mnt.mnt_flags;
+               /* Don't allow unprivileged users to change mount flags */
+               flags |= MNT_LOCK_ATIME;
+
+               if (flags & MNT_READONLY)
+                       flags |= MNT_LOCK_READONLY;
+
+               if (flags & MNT_NODEV)
+                       flags |= MNT_LOCK_NODEV;
+
+               if (flags & MNT_NOSUID)
+                       flags |= MNT_LOCK_NOSUID;
+
+               if (flags & MNT_NOEXEC)
+                       flags |= MNT_LOCK_NOEXEC;
+               /* Don't allow unprivileged users to reveal what is under a mount */
+               if (list_empty(&p->mnt_expire))
+                       flags |= MNT_LOCKED;
+               p->mnt.mnt_flags = flags;
+       }
+}
+
 static void cleanup_group_ids(struct mount *mnt, struct mount *end)
 {
        struct mount *p;
@@ -1954,6 +1960,7 @@ static int attach_recursive_mnt(struct mount *source_mnt,
                        struct mountpoint *dest_mp,
                        struct path *parent_path)
 {
+       struct user_namespace *user_ns = current->nsproxy->mnt_ns->user_ns;
        HLIST_HEAD(tree_list);
        struct mnt_namespace *ns = dest_mnt->mnt_ns;
        struct mountpoint *smp;
@@ -2004,6 +2011,9 @@ static int attach_recursive_mnt(struct mount *source_mnt,
                                 child->mnt_mountpoint);
                if (q)
                        mnt_change_mountpoint(child, smp, q);
+               /* Notice when we are propagating across user namespaces */
+               if (child->mnt_parent->mnt_ns->user_ns != user_ns)
+                       lock_mnt_tree(child);
                commit_tree(child);
        }
        put_mountpoint(smp);
@@ -2941,13 +2951,18 @@ struct mnt_namespace *copy_mnt_ns(unsigned long flags, struct mnt_namespace *ns,
        /* First pass: copy the tree topology */
        copy_flags = CL_COPY_UNBINDABLE | CL_EXPIRE;
        if (user_ns != ns->user_ns)
-               copy_flags |= CL_SHARED_TO_SLAVE | CL_UNPRIVILEGED;
+               copy_flags |= CL_SHARED_TO_SLAVE;
        new = copy_tree(old, old->mnt.mnt_root, copy_flags);
        if (IS_ERR(new)) {
                namespace_unlock();
                free_mnt_ns(new_ns);
                return ERR_CAST(new);
        }
+       if (user_ns != ns->user_ns) {
+               lock_mount_hash();
+               lock_mnt_tree(new);
+               unlock_mount_hash();
+       }
        new_ns->root = new;
        list_add_tail(&new_ns->list, &new->mnt_list);
 

diff --git a/fs/pnode.c b/fs/pnode.c
index 1100e810d855f724222fab4095687d02e1aa4d25..7ea6cfb6507784662bbe957c61fde3dd76df0528 100644 (file)
--- a/fs/pnode.c
+++ b/fs/pnode.c
@@ -214,7 +214,6 @@ static struct mount *next_group(struct mount *m, struct mount *origin)
 }
 
 /* all accesses are serialized by namespace_sem */
-static struct user_namespace *user_ns;
 static struct mount *last_dest, *first_source, *last_source, *dest_master;
 static struct mountpoint *mp;
 static struct hlist_head *list;
@@ -260,9 +259,6 @@ static int propagate_one(struct mount *m)
                        type |= CL_MAKE_SHARED;
        }
                
-       /* Notice when we are propagating across user namespaces */
-       if (m->mnt_ns->user_ns != user_ns)
-               type |= CL_UNPRIVILEGED;
        child = copy_tree(last_source, last_source->mnt.mnt_root, type);
        if (IS_ERR(child))
                return PTR_ERR(child);
@@ -303,7 +299,6 @@ int propagate_mnt(struct mount *dest_mnt, struct mountpoint *dest_mp,
         * propagate_one(); everything is serialized by namespace_sem,
         * so globals will do just fine.
         */
-       user_ns = current->nsproxy->mnt_ns->user_ns;
        last_dest = dest_mnt;
        first_source = source_mnt;
        last_source = source_mnt;

diff --git a/fs/pnode.h b/fs/pnode.h
index dc87e65becd21eb0235775fedf28d8a21702f548..3960a83666cf9a2473ae12e5bf38353783e7b913 100644 (file)
--- a/fs/pnode.h
+++ b/fs/pnode.h
@@ -27,8 +27,7 @@
 #define CL_MAKE_SHARED                 0x08
 #define CL_PRIVATE             0x10
 #define CL_SHARED_TO_SLAVE     0x20
-#define CL_UNPRIVILEGED                0x40
-#define CL_COPY_MNT_NS_FILE    0x80
+#define CL_COPY_MNT_NS_FILE    0x40
 
 #define CL_COPY_ALL            (CL_COPY_UNBINDABLE | CL_COPY_MNT_NS_FILE)