lkml.org 
[lkml]   [2016]   [Jun]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.6 13/81] bpf, inode: disallow userns mounts
    Date
    4.6-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Daniel Borkmann <daniel@iogearbox.net>

    [ Upstream commit 612bacad78ba6d0a91166fc4487af114bac172a8 ]

    Follow-up to commit e27f4a942a0e ("bpf: Use mount_nodev not mount_ns
    to mount the bpf filesystem"), which removes the FS_USERNS_MOUNT flag.

    The original idea was to have a per mountns instance instead of a
    single global fs instance, but that didn't work out and we had to
    switch to mount_nodev() model. The intent of that middle ground was
    that we avoid users who don't play nice to create endless instances
    of bpf fs which are difficult to control and discover from an admin
    point of view, but at the same time it would have allowed us to be
    more flexible with regard to namespaces.

    Therefore, since we now did the switch to mount_nodev() as a fix
    where individual instances are created, we also need to remove userns
    mount flag along with it to avoid running into mentioned situation.
    I don't expect any breakage at this early point in time with removing
    the flag and we can revisit this later should the requirement for
    this come up with future users. This and commit e27f4a942a0e have
    been split to facilitate tracking should any of them run into the
    unlikely case of causing a regression.

    Fixes: b2197755b263 ("bpf: add support for persistent maps/progs")
    Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
    Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
    Acked-by: Alexei Starovoitov <ast@kernel.org>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    kernel/bpf/inode.c | 1 -
    1 file changed, 1 deletion(-)

    --- a/kernel/bpf/inode.c
    +++ b/kernel/bpf/inode.c
    @@ -386,7 +386,6 @@ static struct file_system_type bpf_fs_ty
    .name = "bpf",
    .mount = bpf_mount,
    .kill_sb = kill_litter_super,
    - .fs_flags = FS_USERNS_MOUNT,
    };

    MODULE_ALIAS_FS("bpf");

    \
     
     \ /
      Last update: 2016-06-23 01:41    [W:2.416 / U:0.056 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site