Pull namespace updates from Eric Biederman: "This is a bunch of small changes built against 3.16-rc6. The most significant change for users is the first patch which makes setns drmatically faster by removing unneded rcu handling. The next chunk of changes are so that "mount -o remount,.." will not allow the user namespace root to drop flags on a mount set by the system wide root. Aks this forces read-only mounts to stay read-only, no-dev mounts to stay no-dev, no-suid mounts to stay no-suid, no-exec mounts to stay no exec and it prevents unprivileged users from messing with a mounts atime settings. I have included my test case as the last patch in this series so people performing backports can verify this change works correctly. The next change fixes a bug in NFS that was discovered while auditing nsproxy users for the first optimization. Today you can oops the kernel by reading /proc/fs/nfsfs/{servers,volumes} if you are clever with pid namespaces. I rebased and fixed the build of the !CONFIG_NFS_FS case yesterday when a build bot caught my typo. Given that no one to my knowledge bases anything on my tree fixing the typo in place seems more responsible that requiring a typo-fix to be backported as well. The last change is a small semantic cleanup introducing /proc/thread-self and pointing /proc/mounts and /proc/net at it. This prevents several kinds of problemantic corner cases. It is a user-visible change so it has a minute chance of causing regressions so the change to /proc/mounts and /proc/net are individual one line commits that can be trivially reverted. Unfortunately I lost and could not find the email of the original reporter so he is not credited. From at least one perspective this change to /proc/net is a refgression fix to allow pthread /proc/net uses that were broken by the introduction of the network namespace" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace: proc: Point /proc/mounts at /proc/thread-self/mounts instead of /proc/self/mounts proc: Point /proc/net at /proc/thread-self/net instead of /proc/self/net proc: Implement /proc/thread-self to point at the directory of the current thread proc: Have net show up under /proc/<tgid>/task/<tid> NFS: Fix /proc/fs/nfsfs/servers and /proc/fs/nfsfs/volumes mnt: Add tests for unprivileged remount cases that have found to be faulty mnt: Change the default remount atime from relatime to the existing value mnt: Correct permission checks in do_remount mnt: Move the test for MNT_LOCK_READONLY from change_mount_flags into do_remount mnt: Only change user settable mount flags in remount namespaces: Use task_lock and not rcu to protect nsproxy
Showing the changes to include/linux (3 of 23 files). Show all
Unified · Split
| @@ -42,13 +42,20 @@ struct mnt_namespace; · 41 unmodified lines | ||
| 42 | 42 | * flag, consider how it interacts with shared mounts. |
| 43 | 43 | */ |
| 44 | 44 | #define MNT_SHARED_MASK (MNT_UNBINDABLE) |
| 45 | −#define MNT_PROPAGATION_MASK (MNT_SHARED | MNT_UNBINDABLE) | |
| 45 | +#define MNT_USER_SETTABLE_MASK (MNT_NOSUID | MNT_NODEV | MNT_NOEXEC \ | |
| 46 | + | MNT_NOATIME | MNT_NODIRATIME | MNT_RELATIME \ | |
| 47 | + | MNT_READONLY) | |
| 48 | +#define MNT_ATIME_MASK (MNT_NOATIME | MNT_NODIRATIME | MNT_RELATIME ) | |
| 46 | 49 | |
| 47 | 50 | #define MNT_INTERNAL_FLAGS (MNT_SHARED | MNT_WRITE_HOLD | MNT_INTERNAL | \ |
| 48 | 51 | MNT_DOOMED | MNT_SYNC_UMOUNT | MNT_MARKED) |
| 49 | 52 | |
| 50 | 53 | #define MNT_INTERNAL 0x4000 |
| 51 | 54 | |
| 55 | +#define MNT_LOCK_ATIME 0x040000 | |
| 56 | +#define MNT_LOCK_NOEXEC 0x080000 | |
| 57 | +#define MNT_LOCK_NOSUID 0x100000 | |
| 58 | +#define MNT_LOCK_NODEV 0x200000 | |
| 52 | 59 | #define MNT_LOCK_READONLY 0x400000 |
| 53 | 60 | #define MNT_LOCKED 0x800000 |
| 54 | 61 | #define MNT_DOOMED 0x1000000 |
| @@ -40,32 +40,28 @@ extern struct nsproxy init_nsproxy; · 39 unmodified lines | ||
| 40 | 40 | * the namespaces access rules are: |
| 41 | 41 | * |
| 42 | 42 | * 1. only current task is allowed to change tsk->nsproxy pointer or |
| 43 | − * any pointer on the nsproxy itself | |
| 43 | + * any pointer on the nsproxy itself. Current must hold the task_lock | |
| 44 | + * when changing tsk->nsproxy. | |
| 44 | 45 | * |
| 45 | 46 | * 2. when accessing (i.e. reading) current task's namespaces - no |
| 46 | 47 | * precautions should be taken - just dereference the pointers |
| 47 | 48 | * |
| 48 | 49 | * 3. the access to other task namespaces is performed like this |
| 49 | − * rcu_read_lock(); | |
| 50 | − * nsproxy = task_nsproxy(tsk); | |
| 50 | + * task_lock(task); | |
| 51 | + * nsproxy = task->nsproxy; | |
| 51 | 52 | * if (nsproxy != NULL) { |
| 52 | 53 | * / * |
| 53 | 54 | * * work with the namespaces here |
| 54 | 55 | * * e.g. get the reference on one of them |
| 55 | 56 | * * / |
| 56 | 57 | * } / * |
| 57 | − * * NULL task_nsproxy() means that this task is | |
| 58 | + * * NULL task->nsproxy means that this task is | |
| 58 | 59 | * * almost dead (zombie) |
| 59 | 60 | * * / |
| 60 | − * rcu_read_unlock(); | |
| 61 | + * task_unlock(task); | |
| 61 | 62 | * |
| 62 | 63 | */ |
| 63 | 64 | |
| 64 | −static inline struct nsproxy *task_nsproxy(struct task_struct *tsk) | |
| 65 | −{ | |
| 66 | − return rcu_dereference(tsk->nsproxy); | |
| 67 | −} | |
| 68 | − | |
| 69 | 65 | int copy_namespaces(unsigned long flags, struct task_struct *tsk); |
| 70 | 66 | void exit_task_namespaces(struct task_struct *tsk); |
| 71 | 67 | void switch_task_namespaces(struct task_struct *tsk, struct nsproxy *new); |
| @@ -33,6 +33,7 @@ struct pid_namespace { · 32 unmodified lines | ||
| 33 | 33 | #ifdef CONFIG_PROC_FS |
| 34 | 34 | struct vfsmount *proc_mnt; |
| 35 | 35 | struct dentry *proc_self; |
| 36 | + struct dentry *proc_thread_self; | |
| 36 | 37 | #endif |
| 37 | 38 | #ifdef CONFIG_BSD_PROCESS_ACCT |
| 38 | 39 | struct bsd_acct_struct *bacct; |