kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-16 22:39:48 +00:00
Code Issues Releases Packages Activity
linux/fs/autofs4
History
Eric W. Biederman d3381fab77 fs: Better permission checking for submounts 
commit 93faccbbfa upstream.

To support unprivileged users mounting filesystems two permission
checks have to be performed: a test to see if the user allowed to
create a mount in the mount namespace, and a test to see if
the user is allowed to access the specified filesystem.

The automount case is special in that mounting the original filesystem
grants permission to mount the sub-filesystems, to any user who
happens to stumble across the their mountpoint and satisfies the
ordinary filesystem permission checks.

Attempting to handle the automount case by using override_creds
almost works.  It preserves the idea that permission to mount
the original filesystem is permission to mount the sub-filesystem.
Unfortunately using override_creds messes up the filesystems
ordinary permission checks.

Solve this by being explicit that a mount is a submount by introducing
vfs_submount, and using it where appropriate.

vfs_submount uses a new mount internal mount flags MS_SUBMOUNT, to let
sget and friends know that a mount is a submount so they can take appropriate
action.

sget and sget_userns are modified to not perform any permission checks
on submounts.

follow_automount is modified to stop using override_creds as that
has proven problemantic.

do_mount is modified to always remove the new MS_SUBMOUNT flag so
that we know userspace will never by able to specify it.

autofs4 is modified to stop using current_real_cred that was put in
there to handle the previous version of submount permission checking.

cifs is modified to pass the mountpoint all of the way down to vfs_submount.

debugfs is modified to pass the mountpoint all of the way down to
trace_automount by adding a new parameter.  To make this change easier
a new typedef debugfs_automount_t is introduced to capture the type of
the debugfs automount function.

Fixes: 069d5ac9ae ("autofs:  Fix automounts by using current_real_cred()->uid")
Fixes: aeaa4a79ff ("fs: Call d_automount with the filesystems creds")
Reviewed-by: Trond Myklebust <trond.myklebust@primarydata.com>
Reviewed-by: Seth Forshee <seth.forshee@canonical.com>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2017-03-15 10:02:44 +08:00
..
autofs_i.h autofs: remove possibly misleading /* #define DEBUG */ 2016-10-11 15:06:31 -07:00
dev-ioctl.c autofs: refactor ioctl fn vector in iookup_dev_ioctl() 2016-10-11 15:06:31 -07:00
expire.c autofs: use dentry flags to block walks during expire 2016-09-19 15:36:17 -07:00
init.c autofs4: coding style fixes 2016-03-15 16:55:16 -07:00
inode.c autofs: use autofs4_free_ino() to kfree dentry data 2016-10-11 15:06:31 -07:00
Kconfig fs/Kconfig: move autofs, autofs4 out 2009-01-22 13:15:54 +03:00
Makefile autofs4: add miscellaneous device for ioctls 2008-10-16 11:21:39 -07:00
root.c autofs: fix pr_debug() message 2016-10-11 15:06:31 -07:00
symlink.c autofs4: coding style fixes 2016-03-15 16:55:16 -07:00
waitq.c fs: Better permission checking for submounts 2017-03-15 10:02:44 +08:00