lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Thu, 30 Sep 2010 11:37:48 +0200 From: Miklos Szeredi <miklos@...redi.hu> To: Valerie Aurora <vaurora@...hat.com> CC: viro@...iv.linux.org.uk, miklos@...redi.hu, hch@...radead.org, agruen@...e.de, npiggin@...nel.dk, linux-kernel@...r.kernel.org, linux-fsdevel@...r.kernel.org, vaurora@...hat.com Subject: Re: [PATCH 23/34] union-mount: Prevent topmost file system from being mounted elsewhere On Thu, 16 Sep 2010, Valerie Aurora wrote: > The device underlying the topmost read-write layer of a file system > cannot be mounted anywhere else on the system. We keep a pointer to > the union stack in the dentry of the topmost directory, so that dentry > can't be part of a different mount, since dentries are shared between > different mounts of the same device. > > Signed-off-by: Valerie Aurora <vaurora@...hat.com> > --- > fs/namespace.c | 5 +++++ > 1 files changed, 5 insertions(+), 0 deletions(-) > > diff --git a/fs/namespace.c b/fs/namespace.c > index 61256e6..26efaf3 100644 > --- a/fs/namespace.c > +++ b/fs/namespace.c > @@ -1998,6 +1998,11 @@ int do_add_mount(struct vfsmount *newmnt, struct path *path, > if (S_ISLNK(newmnt->mnt_root->d_inode->i_mode)) > goto unlock; > > + /* Top layers of union mounts can't be mounted elsewhere */ > + err = -EBUSY; > + if (newmnt->mnt_sb->s_union_lower_mnts) > + goto unlock; > + This is insufficient: the super block may be mounted elsewhere later. And no, preventing bind mounts is not enough. BTW, what about CLONE_NEWNS? I think it's a rather big limitation if that doesn't work... Thanks, Miklos -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists