user/sven/linux.git/include/linux/mount.h, branch v3.10.59

mnt: Correct permission checks in do_remount

2014-09-17T16:04:00Z

commit 9566d6742852c527bf5af38af5cbb878dad75705 upstream. While invesgiating the issue where in "mount --bind -oremount,ro ..." would result in later "mount --bind -oremount,rw" succeeding even if the mount started off locked I realized that there are several additional mount flags that should be locked and are not. In particular MNT_NOSUID, MNT_NODEV, MNT_NOEXEC, and the atime flags in addition to MNT_READONLY should all be locked. These flags are all per superblock, can all be changed with MS_BIND, and should not be changable if set by a more privileged user. The following additions to the current logic are added in this patch. - nosuid may not be clearable by a less privileged user. - nodev may not be clearable by a less privielged user. - noexec may not be clearable by a less privileged user. - atime flags may not be changeable by a less privileged user. The logic with atime is that always setting atime on access is a global policy and backup software and auditing software could break if atime bits are not updated (when they are configured to be updated), and serious performance degradation could result (DOS attack) if atime updates happen when they have been explicitly disabled. Therefore an unprivileged user should not be able to mess with the atime bits set by a more privileged user. The additional restrictions are implemented with the addition of MNT_LOCK_NOSUID, MNT_LOCK_NODEV, MNT_LOCK_NOEXEC, and MNT_LOCK_ATIME mnt flags. Taken together these changes and the fixes for MNT_LOCK_READONLY should make it safe for an unprivileged user to create a user namespace and to call "mount --bind -o remount,... ..." without the danger of mount flags being changed maliciously. Acked-by: Serge E. Hallyn Signed-off-by: "Eric W. Biederman" Signed-off-by: Greg Kroah-Hartman

mnt: Only change user settable mount flags in remount

2014-09-17T16:04:00Z

commit a6138db815df5ee542d848318e5dae681590fccd upstream. Kenton Varda discovered that by remounting a read-only bind mount read-only in a user namespace the MNT_LOCK_READONLY bit would be cleared, allowing an unprivileged user to the remount a read-only mount read-write. Correct this by replacing the mask of mount flags to preserve with a mask of mount flags that may be changed, and preserve all others. This ensures that any future bugs with this mask and remount will fail in an easy to detect way where new mount flags simply won't change. Acked-by: Serge E. Hallyn Signed-off-by: "Eric W. Biederman" Signed-off-by: Greg Kroah-Hartman

vfs: Add a mount flag to lock read only bind mounts

2013-03-27T14:50:04Z

When a read-only bind mount is copied from mount namespace in a higher privileged user namespace to a mount namespace in a lesser privileged user namespace, it should not be possible to remove the the read-only restriction. Add a MNT_LOCK_READONLY mount flag to indicate that a mount must remain read-only. CC: stable@vger.kernel.org Acked-by: Serge Hallyn Signed-off-by: "Eric W. Biederman"

vfs: move fsnotify junk to struct mount

2012-01-04T03:57:12Z

Signed-off-by: Al Viro

vfs: move mnt_devname

2012-01-04T03:57:11Z

Signed-off-by: Al Viro

vfs: move mnt_list to struct mount

2012-01-04T03:57:11Z

Signed-off-by: Al Viro

vfs: move the rest of int fields to struct mount

2012-01-04T03:57:10Z

Signed-off-by: Al Viro

vfs: mnt_id/mnt_group_id moved

2012-01-04T03:57:10Z

Signed-off-by: Al Viro

vfs: mnt_ns moved to struct mount

2012-01-04T03:57:09Z

Signed-off-by: Al Viro

vfs: take mnt_share/mnt_slave/mnt_slave_list and mnt_expire to struct mount

2012-01-04T03:57:08Z

Signed-off-by: Al Viro