linux.git/fs/namespace.c, branch v3.18.72

namespace: update event counter when umounting a deleted dentry

2016-07-12T12:47:18+00:00

[ Upstream commit e06b933e6ded42384164d28a2060b7f89243b895 ]

- m_start() in fs/namespace.c expects that ns->event is incremented each
  time a mount added or removed from ns->list.
- umount_tree() removes items from the list but does not increment event
  counter, expecting that it's done before the function is called.
- There are some codepaths that call umount_tree() without updating
  "event" counter. e.g. from __detach_mounts().
- When this happens m_start may reuse a cached mount structure that no
  longer belongs to ns->list (i.e. use after free which usually leads
  to infinite loop).

This change fixes the above problem by incrementing global event counter
before invoking umount_tree().

Change-Id: I622c8e84dcb9fb63542372c5dbf0178ee86bb589
Cc: stable@vger.kernel.org
Signed-off-by: Andrey Ulanov 
Signed-off-by: Al Viro 
Signed-off-by: Sasha Levin

mnt: fs_fully_visible test the proper mount for MNT_LOCKED

2016-06-20T03:47:44+00:00

[ Upstream commit d71ed6c930ac7d8f88f3cef6624a7e826392d61f ]

MNT_LOCKED implies on a child mount implies the child is locked to the
parent.  So while looping through the children the children should be
tested (not their parent).

Typically an unshare of a mount namespace locks all mounts together
making both the parent and the slave as locked but there are a few
corner cases where other things work.

Cc: stable@vger.kernel.org
Fixes: ceeb0e5d39fc ("vfs: Ignore unlocked mounts in fs_fully_visible")
Reported-by: Seth Forshee 
Signed-off-by: "Eric W. Biederman" 
Signed-off-by: Sasha Levin

mnt: If fs_fully_visible fails call put_filesystem.

2016-06-20T03:47:44+00:00

[ Upstream commit 97c1df3e54e811aed484a036a798b4b25d002ecf ]

Add this trivial missing error handling.

Cc: stable@vger.kernel.org
Fixes: 1b852bceb0d1 ("mnt: Refactor the logic for mounting sysfs and proc in a user namespace")
Signed-off-by: "Eric W. Biederman" 
Signed-off-by: Sasha Levin

vfs: Ignore unlocked mounts in fs_fully_visible

2015-07-21T01:12:43+00:00

[ Upstream commit c89d4319ae55186496c43b7a6e510aa1d09dd387 ]

commit ceeb0e5d39fcdf4dca2c997bf225c7fc49200b37 upstream.

Limit the mounts fs_fully_visible considers to locked mounts.
Unlocked can always be unmounted so considering them adds hassle
but no security benefit.

Signed-off-by: "Eric W. Biederman" 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin

mnt: Modify fs_fully_visible to deal with locked ro nodev and atime

2015-07-12T15:51:55+00:00

[ Upstream commit 8c6cf9cc829fcd0b179b59f7fe288941d0e31108 ]

Ignore an existing mount if the locked readonly, nodev or atime
attributes are less permissive than the desired attributes
of the new mount.

On success ensure the new mount locks all of the same readonly, nodev and
atime attributes as the old mount.

The nosuid and noexec attributes are not checked here as this change
is destined for stable and enforcing those attributes causes a
regression in lxc and libvirt-lxc where those applications will not
start and there are no known executables on sysfs or proc and no known
way to create exectuables without code modifications

Cc: stable@vger.kernel.org
Fixes: e51db73532955 ("userns: Better restrictions on when proc and sysfs can be mounted")
Signed-off-by: "Eric W. Biederman" 
Signed-off-by: Sasha Levin

mnt: Refactor the logic for mounting sysfs and proc in a user namespace

2015-07-12T13:49:24+00:00

[ Upstream commit 1b852bceb0d111e510d1a15826ecc4a19358d512 ]

Fresh mounts of proc and sysfs are a very special case that works very
much like a bind mount.  Unfortunately the current structure can not
preserve the MNT_LOCK... mount flags.  Therefore refactor the logic
into a form that can be modified to preserve those lock bits.

Add a new filesystem flag FS_USERNS_VISIBLE that requires some mount
of the filesystem be fully visible in the current mount namespace,
before the filesystem may be mounted.

Move the logic for calling fs_fully_visible from proc and sysfs into
fs/namespace.c where it has greater access to mount namespace state.

Cc: stable@vger.kernel.org
Signed-off-by: "Eric W. Biederman" 
Signed-off-by: Sasha Levin

mnt: Fix the error check in __detach_mounts

2015-06-28T17:39:24+00:00

[ Upstream commit f53e57975151f54ad8caa1b0ac8a78091cd5700a ]

lookup_mountpoint can return either NULL or an error value.
Update the test in __detach_mounts to test for an error value
to avoid pathological cases causing a NULL pointer dereferences.

The callers of __detach_mounts should prevent it from ever being
called on an unlinked dentry but don't take any chances.

Cc: stable@vger.kernel.org
Signed-off-by: "Eric W. Biederman" 
Signed-off-by: Sasha Levin

mnt: Fail collect_mounts when applied to unmounted mounts

2015-06-09T17:43:44+00:00

[ Upstream commit cd4a40174b71acd021877341684d8bb1dc8ea4ae ]

The only users of collect_mounts are in audit_tree.c

In audit_trim_trees and audit_add_tree_rule the path passed into
collect_mounts is generated from kern_path passed an audit_tree
pathname which is guaranteed to be an absolute path.   In those cases
collect_mounts is obviously intended to work on mounted paths and
if a race results in paths that are unmounted when collect_mounts
it is reasonable to fail early.

The paths passed into audit_tag_tree don't have the absolute path
check.  But are used to play with fsnotify and otherwise interact with
the audit_trees, so again operating only on mounted paths appears
reasonable.

Avoid having to worry about what happens when we try and audit
unmounted filesystems by restricting collect_mounts to mounts
that appear in the mount tree.

Signed-off-by: "Eric W. Biederman" 
Signed-off-by: Sasha Levin

mnt: Fix fs_fully_visible to verify the root directory is visible

2015-05-23T19:43:26+00:00

[ Upstream commit 7e96c1b0e0f495c5a7450dc4aa7c9a24ba4305bd ]

This fixes a dumb bug in fs_fully_visible that allows proc or sys to
be mounted if there is a bind mount of part of /proc/ or /sys/ visible.

Cc: stable@vger.kernel.org
Reported-by: Eric Windisch 
Signed-off-by: "Eric W. Biederman" 
Signed-off-by: Sasha Levin

mnt: Don't propagate umounts in __detach_mounts

2015-05-17T23:12:08+00:00

[ Upstream commit 8318e667f176f7ea34451a1a530634e293f216ac ]

Invoking mount propagation from __detach_mounts is inefficient and
wrong.

It is inefficient because __detach_mounts already walks the list of
mounts that where something needs to be done, and mount propagation
walks some subset of those mounts again.

It is actively wrong because if the dentry that is passed to
__detach_mounts is not part of the path to a mount that mount should
not be affected.

change_mnt_propagation(p,MS_PRIVATE) modifies the mount propagation
tree of a master mount so it's slaves are connected to another master
if possible.  Which means even removing a mount from the middle of a
mount tree with __detach_mounts will not deprive any mount propagated
mount events.

Cc: stable@vger.kernel.org
Signed-off-by: "Eric W. Biederman" 
Signed-off-by: Sasha Levin