summaryrefslogtreecommitdiff
path: root/fs/proc
diff options
context:
space:
mode:
authorJann Horn <jannh@google.com>2016-06-01 11:55:05 +0200
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2016-06-24 10:18:20 -0700
commit9beb96b344c846779f67d1be1cdafc66562b94ec (patch)
tree34de9f551916b9439f3044e1f91f40aa2ee9db77 /fs/proc
parent035a94d8d1acdb829575a987222a6d5c45e8a5f2 (diff)
proc: prevent stacking filesystems on top
commit e54ad7f1ee263ffa5a2de9c609d58dfa27b21cd9 upstream. This prevents stacking filesystems (ecryptfs and overlayfs) from using procfs as lower filesystem. There is too much magic going on inside procfs, and there is no good reason to stack stuff on top of procfs. (For example, procfs does access checks in VFS open handlers, and ecryptfs by design calls open handlers from a kernel thread that doesn't drop privileges or so.) Signed-off-by: Jann Horn <jannh@google.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'fs/proc')
-rw-r--r--fs/proc/root.c7
1 files changed, 7 insertions, 0 deletions
diff --git a/fs/proc/root.c b/fs/proc/root.c
index 361ab4ee42fc..ec649c92d270 100644
--- a/fs/proc/root.c
+++ b/fs/proc/root.c
@@ -121,6 +121,13 @@ static struct dentry *proc_mount(struct file_system_type *fs_type,
if (IS_ERR(sb))
return ERR_CAST(sb);
+ /*
+ * procfs isn't actually a stacking filesystem; however, there is
+ * too much magic going on inside it to permit stacking things on
+ * top of it
+ */
+ sb->s_stack_depth = FILESYSTEM_MAX_STACK_DEPTH;
+
if (!proc_parse_options(options, ns)) {
deactivate_locked_super(sb);
return ERR_PTR(-EINVAL);