summaryrefslogtreecommitdiffstats
path: root/fs/namespace.c
diff options
context:
space:
mode:
authorChristian Brauner <brauner@kernel.org>2024-06-24 17:49:49 +0200
committerChristian Brauner <brauner@kernel.org>2024-06-28 09:53:31 +0200
commit71aacb4c8c3d19da053363a5fe7538a8af082d56 (patch)
tree2fe38d4370d8aeead6f7559abf8dd6703e7a423c /fs/namespace.c
parentfs: Allow listmount() in foreign mount namespace (diff)
downloadlinux-71aacb4c8c3d19da053363a5fe7538a8af082d56.tar.xz
linux-71aacb4c8c3d19da053363a5fe7538a8af082d56.zip
fs: Allow statmount() in foreign mount namespace
This patch makes use of the new mnt_ns_id field in struct mnt_id_req to allow users to stat mount entries not in their mount namespace. The rules are the same as listmount(), the user must have CAP_SYS_ADMIN in their user namespace and the target mount namespace must be a child of the current namespace. Co-developed-by: Josef Bacik <josef@toxicpanda.com> Signed-off-by: Josef Bacik <josef@toxicpanda.com> Link: https://lore.kernel.org/r/52a2e17e50ba7aa420bc8bae1d9e88ff593395c1.1719243756.git.josef@toxicpanda.com Signed-off-by: Christian Brauner <brauner@kernel.org>
Diffstat (limited to 'fs/namespace.c')
-rw-r--r--fs/namespace.c31
1 files changed, 25 insertions, 6 deletions
diff --git a/fs/namespace.c b/fs/namespace.c
index a54d68f822a8..e871f73c4c8c 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -4974,10 +4974,8 @@ static int statmount_fs_type(struct kstatmount *s, struct seq_file *seq)
return 0;
}
-static void statmount_mnt_ns_id(struct kstatmount *s)
+static void statmount_mnt_ns_id(struct kstatmount *s, struct mnt_namespace *ns)
{
- struct mnt_namespace *ns = current->nsproxy->mnt_ns;
-
s->sm.mask |= STATMOUNT_MNT_NS_ID;
s->sm.mnt_ns_id = ns->seq;
}
@@ -5079,7 +5077,7 @@ static int do_statmount(struct kstatmount *s)
err = statmount_string(s, STATMOUNT_MNT_POINT);
if (!err && s->mask & STATMOUNT_MNT_NS_ID)
- statmount_mnt_ns_id(s);
+ statmount_mnt_ns_id(s, ns);
if (err)
return err;
@@ -5196,6 +5194,7 @@ SYSCALL_DEFINE4(statmount, const struct mnt_id_req __user *, req,
struct statmount __user *, buf, size_t, bufsize,
unsigned int, flags)
{
+ struct mnt_namespace *ns __free(mnt_ns_release) = NULL;
struct vfsmount *mnt;
struct mnt_id_req kreq;
struct kstatmount ks;
@@ -5210,13 +5209,28 @@ SYSCALL_DEFINE4(statmount, const struct mnt_id_req __user *, req,
if (ret)
return ret;
+ ns = grab_requested_mnt_ns(kreq.mnt_ns_id);
+ if (!ns)
+ return -ENOENT;
+
+ if (kreq.mnt_ns_id && (ns != current->nsproxy->mnt_ns) &&
+ !ns_capable_noaudit(ns->user_ns, CAP_SYS_ADMIN))
+ return -ENOENT;
+
retry:
ret = prepare_kstatmount(&ks, &kreq, buf, bufsize, seq_size);
if (ret)
return ret;
down_read(&namespace_sem);
- mnt = lookup_mnt_in_ns(kreq.mnt_id, current->nsproxy->mnt_ns);
+ /* Has the namespace already been emptied? */
+ if (kreq.mnt_ns_id && RB_EMPTY_ROOT(&ns->mounts)) {
+ up_read(&namespace_sem);
+ kvfree(ks.seq.buf);
+ return -ENOENT;
+ }
+
+ mnt = lookup_mnt_in_ns(kreq.mnt_id, ns);
if (!mnt) {
up_read(&namespace_sem);
kvfree(ks.seq.buf);
@@ -5224,7 +5238,12 @@ retry:
}
ks.mnt = mnt;
- get_fs_root(current->fs, &ks.root);
+ ret = grab_requested_root(ns, &ks.root);
+ if (ret) {
+ up_read(&namespace_sem);
+ kvfree(ks.seq.buf);
+ return ret;
+ }
ret = do_statmount(&ks);
path_put(&ks.root);
up_read(&namespace_sem);