Files
linux/include/uapi/linux
Eric W. Biederman d3381fab77 fs: Better permission checking for submounts
commit 93faccbbfa upstream.

To support unprivileged users mounting filesystems two permission
checks have to be performed: a test to see if the user allowed to
create a mount in the mount namespace, and a test to see if
the user is allowed to access the specified filesystem.

The automount case is special in that mounting the original filesystem
grants permission to mount the sub-filesystems, to any user who
happens to stumble across the their mountpoint and satisfies the
ordinary filesystem permission checks.

Attempting to handle the automount case by using override_creds
almost works.  It preserves the idea that permission to mount
the original filesystem is permission to mount the sub-filesystem.
Unfortunately using override_creds messes up the filesystems
ordinary permission checks.

Solve this by being explicit that a mount is a submount by introducing
vfs_submount, and using it where appropriate.

vfs_submount uses a new mount internal mount flags MS_SUBMOUNT, to let
sget and friends know that a mount is a submount so they can take appropriate
action.

sget and sget_userns are modified to not perform any permission checks
on submounts.

follow_automount is modified to stop using override_creds as that
has proven problemantic.

do_mount is modified to always remove the new MS_SUBMOUNT flag so
that we know userspace will never by able to specify it.

autofs4 is modified to stop using current_real_cred that was put in
there to handle the previous version of submount permission checking.

cifs is modified to pass the mountpoint all of the way down to vfs_submount.

debugfs is modified to pass the mountpoint all of the way down to
trace_automount by adding a new parameter.  To make this change easier
a new typedef debugfs_automount_t is introduced to capture the type of
the debugfs automount function.

Fixes: 069d5ac9ae ("autofs:  Fix automounts by using current_real_cred()->uid")
Fixes: aeaa4a79ff ("fs: Call d_automount with the filesystems creds")
Reviewed-by: Trond Myklebust <trond.myklebust@primarydata.com>
Reviewed-by: Seth Forshee <seth.forshee@canonical.com>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-03-15 10:02:44 +08:00
..
2014-10-20 10:30:15 +08:00
2014-09-23 23:15:46 -07:00
2016-12-05 19:43:02 -05:00
2015-04-21 16:16:02 -04:00
2016-12-05 19:43:02 -05:00
2016-09-23 08:40:28 -04:00
2014-07-01 10:48:05 -06:00
2016-10-03 18:52:14 +02:00
2014-03-20 14:55:18 +01:00
2015-08-25 14:41:50 -05:00
2014-11-19 14:48:02 -06:00
2016-10-14 16:05:42 -04:00
2016-01-20 17:09:18 -08:00
2014-08-08 15:57:31 -07:00
2016-06-08 11:36:02 -07:00
2015-04-12 21:25:13 -04:00
2016-10-01 07:32:32 +02:00
2015-12-14 12:19:37 -06:00
2013-12-11 12:57:55 -08:00
2015-05-25 13:25:35 -04:00
2014-12-02 13:52:53 -07:00
2016-03-22 15:36:02 -07:00
2016-06-27 16:31:25 +01:00
2016-04-12 19:54:58 +01:00
2016-04-25 15:09:10 -04:00
2016-01-12 08:21:18 -07:00
2015-08-03 17:30:00 -07:00
2014-08-08 15:57:31 -07:00
2015-07-21 10:39:05 -07:00
2015-11-23 15:06:38 -05:00
2015-01-20 13:51:06 +01:00
2014-12-13 12:42:52 -08:00
2015-05-05 13:40:44 -06:00
2015-04-23 15:16:14 -04:00
2015-07-20 14:58:46 -04:00
2016-05-17 17:14:21 -06:00
2016-10-14 15:00:10 -04:00
2016-09-27 21:52:00 -04:00
2016-09-27 21:52:00 -04:00
2015-09-04 16:54:41 -07:00
2016-05-08 23:46:14 -04:00
2016-04-26 12:00:48 -04:00
2016-04-04 22:11:20 -04:00
2016-09-21 00:23:00 -04:00
2014-12-09 14:10:41 +08:00
2015-06-11 23:37:37 +02:00
2015-12-18 17:48:51 -08:00
2015-10-27 18:55:31 -07:00
2016-05-20 17:58:30 -07:00
2016-08-02 16:53:54 +03:00
2015-03-29 12:13:52 +10:30
2014-12-09 12:05:24 +02:00
2016-04-30 09:26:55 -07:00