sysfs: Restrict mounting sysfs

Browse source

Don't allow mounting sysfs unless the caller has CAP_SYS_ADMIN rights
over the net namespace.  The principle here is if you create or have
capabilities over it you can mount it, otherwise you get to live with
what other people have mounted.

Instead of testing this with a straight forward ns_capable call,
perform this check the long and torturous way with kobject helpers,
this keeps direct knowledge of namespaces out of sysfs, and preserves
the existing sysfs abstractions.

Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>

...

This commit is contained in:

Eric W. Biederman 2013-03-25 20:07:01 -07:00

parent e51db73532

commit 7dc5dbc879

4 changed files with 34 additions and 3 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

12

fs/sysfs/mount.c

View file

2

include/linux/kobject_ns.h

View file

15

lib/kobject.c

View file

8

net/core/net-sysfs.c

View file