diff options
| author | Eric W. Biederman <ebiederm@xmission.com> | 2014-07-28 17:10:56 -0700 |
|---|---|---|
| committer | Jiri Slaby <jslaby@suse.cz> | 2014-08-26 14:12:05 +0200 |
| commit | cab259f821fad20afa688d3fbeb47356447ac20b (patch) | |
| tree | 6b202c3d30b526c5a311059249365d3a6ef700a0 /fs/namespace.c | |
| parent | 25c1def33a2f74079f3062b7afdf98fcf9f34e6d (diff) | |
mnt: Move the test for MNT_LOCK_READONLY from change_mount_flags into do_remount
commit 07b645589dcda8b7a5249e096fece2a67556f0f4 upstream.
There are no races as locked mount flags are guaranteed to never change.
Moving the test into do_remount makes it more visible, and ensures all
filesystem remounts pass the MNT_LOCK_READONLY permission check. This
second case is not an issue today as filesystem remounts are guarded
by capable(CAP_DAC_ADMIN) and thus will always fail in less privileged
mount namespaces, but it could become an issue in the future.
Cc: stable@vger.kernel.org
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Diffstat (limited to 'fs/namespace.c')
| -rw-r--r-- | fs/namespace.c | 13 |
1 files changed, 10 insertions, 3 deletions
diff --git a/fs/namespace.c b/fs/namespace.c index 34fa7a52f373..8e90b037b706 100644 --- a/fs/namespace.c +++ b/fs/namespace.c @@ -1806,9 +1806,6 @@ static int change_mount_flags(struct vfsmount *mnt, int ms_flags) if (readonly_request == __mnt_is_readonly(mnt)) return 0; - if (mnt->mnt_flags & MNT_LOCK_READONLY) - return -EPERM; - if (readonly_request) error = mnt_make_readonly(real_mount(mnt)); else @@ -1834,6 +1831,16 @@ static int do_remount(struct path *path, int flags, int mnt_flags, if (path->dentry != path->mnt->mnt_root) return -EINVAL; + /* Don't allow changing of locked mnt flags. + * + * No locks need to be held here while testing the various + * MNT_LOCK flags because those flags can never be cleared + * once they are set. + */ + if ((mnt->mnt.mnt_flags & MNT_LOCK_READONLY) && + !(mnt_flags & MNT_READONLY)) { + return -EPERM; + } err = security_sb_remount(sb, data); if (err) return err; |