lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Fri, 15 Feb 2019 16:08:46 +0000 From: David Howells <dhowells@...hat.com> To: keyrings@...r.kernel.org, trond.myklebust@...merspace.com, sfrench@...ba.org Cc: linux-security-module@...r.kernel.org, linux-nfs@...r.kernel.org, linux-cifs@...r.kernel.org, linux-fsdevel@...r.kernel.org, rgb@...hat.com, dhowells@...hat.com, linux-kernel@...r.kernel.org Subject: [RFC PATCH 09/27] vfs: Allow mounting to other namespaces Currently sys_move_mount() and sys_mount(MS_MOVE) prevent the caller from moving a mount into a namespace not their own. Relax this such that any mount can be mounted onto any given mountpoint provided that the source mount is either detached or the same namespace as the destination. This permits container namespaces to be built from the outside rather than from the inside. Signed-off-by: David Howells <dhowells@...hat.com> --- fs/namespace.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/fs/namespace.c b/fs/namespace.c index 22cf4a8f8065..804601b6297c 100644 --- a/fs/namespace.c +++ b/fs/namespace.c @@ -2627,12 +2627,10 @@ static int do_move_mount(struct path *old_path, struct path *new_path) ns = old->mnt_ns; err = -EINVAL; - /* The mountpoint must be in our namespace. */ - if (!check_mnt(p)) - goto out; - - /* The thing moved should be either ours or completely unattached. */ - if (attached && !check_mnt(old)) + /* The new mount must be either unattached or in the same namespace as + * the mountpoint. + */ + if (attached && old->mnt_ns != p->mnt_ns) goto out; if (!attached && !is_anon_ns(ns))
Powered by blists - more mailing lists