linux-kernel - [PATCH v4 0/5] fuse: Add support for mounts from pid/user namespaces

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <1413296756-25071-1-git-send-email-seth.forshee@canonical.com>
Date:	Tue, 14 Oct 2014 16:25:51 +0200
From:	Seth Forshee <seth.forshee@...onical.com>
To:	Miklos Szeredi <miklos@...redi.hu>
Cc:	fuse-devel@...ts.sourceforge.net, linux-kernel@...r.kernel.org,
	linux-fsdevel@...r.kernel.org,
	Seth Forshee <seth.forshee@...onical.com>
Subject: [PATCH v4 0/5] fuse: Add support for mounts from pid/user namespaces

Hi Miklos,

Here's version 4 of my patches to allow fuse mounts from within user
namespaces. I'm not sure whether or not Eric and I managed to satisfy
your doubts about using fixed namespaces for conversions, but since the
discussion has died down and I've accumulated a few changes I thought it
was time to send new patches.

I also never got any feedback from you about my proposal for restricting
xattrs, so I went ahead and included the patch (with some updates) here.

Changes since v3:
 - Broke out some changes into separate patches.
 - Added missing pid namespace conversion for file locks.
 - Fixed pid/user ns reference leaks when using cuse.
 - Fail operations and invalidate inodes if uids passed over the fuse
   connection don't map into the superblock's user namespace. Also
   dropped vfs patches which are no longer needed after this change.
 - Restrict getting and setting of xattrs to user.* unless the
   privileged_xattrs mount option is passed. This option is only
   permitted for system root.

Thanks,
Seth

Seth Forshee (5):
  fuse: Add support for pid namespaces
  fuse: Support fuse filesystems outside of init_user_ns
  fuse: Restrict allow_other to uids already controlled by the user
  fuse: Support privileged xattrs only with a mount option
  fuse: Allow user namespace mounts

 fs/fuse/dev.c    |  13 +++---
 fs/fuse/dir.c    | 106 ++++++++++++++++++++++++++++++++++---------------
 fs/fuse/file.c   |  38 ++++++++++++------
 fs/fuse/fuse_i.h |  21 ++++++++--
 fs/fuse/inode.c  | 118 +++++++++++++++++++++++++++++++++++++++++--------------
 5 files changed, 213 insertions(+), 83 deletions(-)

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/