| 1 | |
| 2 | |
| 3 | * linux/fs/namespace.c
|
| 4 | *
|
| 5 | * (C) Copyright Al Viro 2000, 2001
|
| 6 | *
|
| 7 | * Based on code from fs/super.c, copyright Linus Torvalds and others.
|
| 8 | * Heavily rewritten.
|
| 9 |
|
| 10 |
|
| 11 | #include <linux/syscalls.h>
|
| 12 | #include <linux/export.h>
|
| 13 | #include <linux/capability.h>
|
| 14 | #include <linux/mnt_namespace.h>
|
| 15 | #include <linux/user_namespace.h>
|
| 16 | #include <linux/namei.h>
|
| 17 | #include <linux/security.h>
|
| 18 | #include <linux/cred.h>
|
| 19 | #include <linux/idr.h>
|
| 20 | #include <linux/init.h>
|
| 21 | #include <linux/fs_struct.h>
|
| 22 | #include <linux/fsnotify.h>
|
| 23 | #include <linux/file.h>
|
| 24 | #include <linux/uaccess.h>
|
| 25 | #include <linux/proc_ns.h>
|
| 26 | #include <linux/magic.h>
|
| 27 | #include <linux/memblock.h>
|
| 28 | #include <linux/proc_fs.h>
|
| 29 | #include <linux/task_work.h>
|
| 30 | #include <linux/sched/task.h>
|
| 31 | #include <uapi/linux/mount.h>
|
| 32 | #include <linux/fs_context.h>
|
| 33 | #include <linux/shmem_fs.h>
|
| 34 | #include <linux/mnt_idmapping.h>
|
| 35 | #include <linux/pidfs.h>
|
| 36 | #include <linux/nstree.h>
|
| 37 |
|
| 38 | #include "pnode.h"
|
| 39 | #include "internal.h"
|
| 40 |
|
| 41 |
|
| 42 | static unsigned int sysctl_mount_max __read_mostly = 100000;
|
| 43 |
|
| 44 | static unsigned int m_hash_mask __ro_after_init;
|
| 45 | static unsigned int m_hash_shift __ro_after_init;
|
| 46 | static unsigned int mp_hash_mask __ro_after_init;
|
| 47 | static unsigned int mp_hash_shift __ro_after_init;
|
| 48 |
|
| 49 | static __initdata unsigned long mhash_entries;
|
| 50 | static int __init set_mhash_entries(char *str)
|
| 51 | {
|
| 52 | return kstrtoul(str, 0, &mhash_entries) == 0;
|
| 53 | }
|
| 54 | __setup("mhash_entries=", set_mhash_entries);
|
| 55 |
|
| 56 | static __initdata unsigned long mphash_entries;
|
| 57 | static int __init set_mphash_entries(char *str)
|
| 58 | {
|
| 59 | return kstrtoul(str, 0, &mphash_entries) == 0;
|
| 60 | }
|
| 61 | __setup("mphash_entries=", set_mphash_entries);
|
| 62 |
|
| 63 | static char * __initdata initramfs_options;
|
| 64 | static int __init initramfs_options_setup(char *str)
|
| 65 | {
|
| 66 | initramfs_options = str;
|
| 67 | return 1;
|
| 68 | }
|
| 69 |
|
| 70 | __setup("initramfs_options=", initramfs_options_setup);
|
| 71 |
|
| 72 | static u64 event;
|
| 73 | static DEFINE_XARRAY_FLAGS(mnt_id_xa, XA_FLAGS_ALLOC);
|
| 74 | static DEFINE_IDA(mnt_group_ida);
|
| 75 |
|
| 76 |
|
| 77 | #define MNT_UNIQUE_ID_OFFSET (1ULL << 31)
|
| 78 | static u64 mnt_id_ctr = MNT_UNIQUE_ID_OFFSET;
|
| 79 |
|
| 80 | static struct hlist_head *mount_hashtable __ro_after_init;
|
| 81 | static struct hlist_head *mountpoint_hashtable __ro_after_init;
|
| 82 | static struct kmem_cache *mnt_cache __ro_after_init;
|
| 83 | struct vfsmount *knullfs __ro_after_init;
|
| 84 | static struct vfsmount *knullfs_file __ro_after_init;
|
| 85 | static DECLARE_RWSEM(namespace_sem);
|
| 86 | static HLIST_HEAD(unmounted);
|
| 87 | static LIST_HEAD(ex_mountpoints);
|
| 88 | static struct mnt_namespace *emptied_ns;
|
| 89 |
|
| 90 | static inline void namespace_lock(void);
|
| 91 | static void namespace_unlock(void);
|
| 92 | DEFINE_LOCK_GUARD_0(namespace_excl, namespace_lock(), namespace_unlock())
|
| 93 | DEFINE_LOCK_GUARD_0(namespace_shared, down_read(&namespace_sem),
|
| 94 | up_read(&namespace_sem))
|
| 95 |
|
| 96 | DEFINE_FREE(mntput, struct vfsmount *, if (!IS_ERR(_T)) mntput(_T))
|
| 97 |
|
| 98 | #ifdef CONFIG_FSNOTIFY
|
| 99 | LIST_HEAD(notify_list);
|
| 100 | #endif
|
| 101 |
|
| 102 | enum mount_kattr_flags_t {
|
| 103 | MOUNT_KATTR_RECURSE = (1 << 0),
|
| 104 | MOUNT_KATTR_IDMAP_REPLACE = (1 << 1),
|
| 105 | };
|
| 106 |
|
| 107 | struct mount_kattr {
|
| 108 | unsigned int attr_set;
|
| 109 | unsigned int attr_clr;
|
| 110 | unsigned int propagation;
|
| 111 | unsigned int lookup_flags;
|
| 112 | enum mount_kattr_flags_t kflags;
|
| 113 | struct user_namespace *mnt_userns;
|
| 114 | const struct mnt_idmap *mnt_idmap;
|
| 115 | };
|
| 116 |
|
| 117 |
|
| 118 | struct kobject *fs_kobj __ro_after_init;
|
| 119 | EXPORT_SYMBOL_GPL(fs_kobj);
|
| 120 |
|
| 121 | |
| 122 | * vfsmount lock may be taken for read to prevent changes to the
|
| 123 | * vfsmount hash, ie. during mountpoint lookups or walking back
|
| 124 | * up the tree.
|
| 125 | *
|
| 126 | * It should be taken for write in all cases where the vfsmount
|
| 127 | * tree or hash is modified or when a vfsmount structure is modified.
|
| 128 |
|
| 129 | __cacheline_aligned_in_smp DEFINE_SEQLOCK(mount_lock);
|
| 130 |
|
| 131 | static void mnt_ns_release(struct mnt_namespace *ns)
|
| 132 | {
|
| 133 |
|
| 134 | if (ns && refcount_dec_and_test(&ns->passive)) {
|
| 135 | put_user_ns(ns->user_ns);
|
| 136 | kfree(ns);
|
| 137 | }
|
| 138 | }
|
| 139 | DEFINE_FREE(mnt_ns_release, struct mnt_namespace *,
|
| 140 | if (!IS_ERR(_T)) mnt_ns_release(_T))
|
| 141 |
|
| 142 | static void mnt_ns_release_rcu(struct rcu_head *rcu)
|
| 143 | {
|
| 144 | mnt_ns_release(container_of(rcu, struct mnt_namespace, ns.ns_rcu));
|
| 145 | }
|
| 146 |
|
| 147 | static void mnt_ns_tree_remove(struct mnt_namespace *ns)
|
| 148 | {
|
| 149 |
|
| 150 | if (ns_tree_active(ns))
|
| 151 | ns_tree_remove(ns);
|
| 152 |
|
| 153 | call_rcu(&ns->ns.ns_rcu, mnt_ns_release_rcu);
|
| 154 | }
|
| 155 |
|
| 156 | |
| 157 | * Lookup a mount namespace by id and take a passive reference count. Taking a
|
| 158 | * passive reference means the mount namespace can be emptied if e.g., the last
|
| 159 | * task holding an active reference exits. To access the mounts of the
|
| 160 | * namespace the @namespace_sem must first be acquired. If the namespace has
|
| 161 | * already shut down before acquiring @namespace_sem, {list,stat}mount() will
|
| 162 | * see that the mount rbtree of the namespace is empty.
|
| 163 | *
|
| 164 | * Note the lookup is lockless protected by a sequence counter. We only
|
| 165 | * need to guard against false negatives as false positives aren't
|
| 166 | * possible. So if we didn't find a mount namespace and the sequence
|
| 167 | * counter has changed we need to retry. If the sequence counter is
|
| 168 | * still the same we know the search actually failed.
|
| 169 |
|
| 170 | static struct mnt_namespace *lookup_mnt_ns(u64 mnt_ns_id)
|
| 171 | {
|
| 172 | struct mnt_namespace *mnt_ns;
|
| 173 | struct ns_common *ns;
|
| 174 |
|
| 175 | guard(rcu)();
|
| 176 | ns = ns_tree_lookup_rcu(mnt_ns_id, CLONE_NEWNS);
|
| 177 | if (!ns)
|
| 178 | return NULL;
|
| 179 |
|
| 180 | |
| 181 | * The last reference count is put with RCU delay so we can
|
| 182 | * unconditonally acquire a reference here.
|
| 183 |
|
| 184 | mnt_ns = container_of(ns, struct mnt_namespace, ns);
|
| 185 | refcount_inc(&mnt_ns->passive);
|
| 186 | return mnt_ns;
|
| 187 | }
|
| 188 |
|
| 189 | static inline void lock_mount_hash(void)
|
| 190 | {
|
| 191 | write_seqlock(&mount_lock);
|
| 192 | }
|
| 193 |
|
| 194 | static inline void unlock_mount_hash(void)
|
| 195 | {
|
| 196 | write_sequnlock(&mount_lock);
|
| 197 | }
|
| 198 |
|
| 199 | static inline struct hlist_head *m_hash(struct vfsmount *mnt, struct dentry *dentry)
|
| 200 | {
|
| 201 | unsigned long tmp = ((unsigned long)mnt / L1_CACHE_BYTES);
|
| 202 | tmp += ((unsigned long)dentry / L1_CACHE_BYTES);
|
| 203 | tmp = tmp + (tmp >> m_hash_shift);
|
| 204 | return &mount_hashtable[tmp & m_hash_mask];
|
| 205 | }
|
| 206 |
|
| 207 | static inline struct hlist_head *mp_hash(struct dentry *dentry)
|
| 208 | {
|
| 209 | unsigned long tmp = ((unsigned long)dentry / L1_CACHE_BYTES);
|
| 210 | tmp = tmp + (tmp >> mp_hash_shift);
|
| 211 | return &mountpoint_hashtable[tmp & mp_hash_mask];
|
| 212 | }
|
| 213 |
|
| 214 | |
| 215 | * What an unmounted mount leaves behind at its unmounted parent instead of
|
| 216 | * staying attached to it. A lookup on the parent at the mountpoint finds
|
| 217 | * a stand-in for as long as the cover is there. The parent frees it.
|
| 218 |
|
| 219 | struct mnt_cover {
|
| 220 | struct hlist_node node;
|
| 221 | struct hlist_node pin;
|
| 222 | struct dentry *dentry;
|
| 223 | struct mountpoint *mp;
|
| 224 | struct rcu_head rcu;
|
| 225 | };
|
| 226 |
|
| 227 | static int mnt_alloc_id(struct mount *mnt)
|
| 228 | {
|
| 229 | int res;
|
| 230 |
|
| 231 | xa_lock(&mnt_id_xa);
|
| 232 | res = __xa_alloc(&mnt_id_xa, &mnt->mnt_id, mnt, xa_limit_31b, GFP_KERNEL);
|
| 233 | if (!res)
|
| 234 | mnt->mnt_id_unique = ++mnt_id_ctr;
|
| 235 | xa_unlock(&mnt_id_xa);
|
| 236 | return res;
|
| 237 | }
|
| 238 |
|
| 239 | static void mnt_free_id(struct mount *mnt)
|
| 240 | {
|
| 241 | xa_erase(&mnt_id_xa, mnt->mnt_id);
|
| 242 | }
|
| 243 |
|
| 244 | |
| 245 | * Allocate a new peer group ID
|
| 246 |
|
| 247 | static int mnt_alloc_group_id(struct mount *mnt)
|
| 248 | {
|
| 249 | int res = ida_alloc_min(&mnt_group_ida, 1, GFP_KERNEL);
|
| 250 |
|
| 251 | if (res < 0)
|
| 252 | return res;
|
| 253 | mnt->mnt_group_id = res;
|
| 254 | return 0;
|
| 255 | }
|
| 256 |
|
| 257 | |
| 258 | * Release a peer group ID
|
| 259 |
|
| 260 | void mnt_release_group_id(struct mount *mnt)
|
| 261 | {
|
| 262 | ida_free(&mnt_group_ida, mnt->mnt_group_id);
|
| 263 | mnt->mnt_group_id = 0;
|
| 264 | }
|
| 265 |
|
| 266 | static inline void mnt_inc_count(struct mount *mnt)
|
| 267 | {
|
| 268 | #ifdef CONFIG_SMP
|
| 269 | this_cpu_inc(mnt->mnt_pcp->mnt_gets);
|
| 270 | #else
|
| 271 | preempt_disable();
|
| 272 | mnt->mnt_count++;
|
| 273 | preempt_enable();
|
| 274 | #endif
|
| 275 | }
|
| 276 |
|
| 277 | static inline void mnt_dec_count(struct mount *mnt)
|
| 278 | {
|
| 279 | #ifdef CONFIG_SMP
|
| 280 | this_cpu_inc(mnt->mnt_pcp->mnt_puts);
|
| 281 | #else
|
| 282 | preempt_disable();
|
| 283 | mnt->mnt_count--;
|
| 284 | preempt_enable();
|
| 285 | #endif
|
| 286 | }
|
| 287 |
|
| 288 | |
| 289 | * vfsmount lock must be held for write
|
| 290 |
|
| 291 | int mnt_get_count(struct mount *mnt)
|
| 292 | {
|
| 293 | #ifdef CONFIG_SMP
|
| 294 | unsigned int gets = 0, puts = 0;
|
| 295 | int cpu;
|
| 296 |
|
| 297 |
|
| 298 | for_each_possible_cpu(cpu)
|
| 299 | puts += per_cpu_ptr(mnt->mnt_pcp, cpu)->mnt_puts;
|
| 300 | |
| 301 | * Pairs with the smp_wmb() in mntput_no_expire() and with the
|
| 302 | * smp_mb() in __legitimize_mnt().
|
| 303 |
|
| 304 | smp_mb();
|
| 305 | for_each_possible_cpu(cpu)
|
| 306 | gets += per_cpu_ptr(mnt->mnt_pcp, cpu)->mnt_gets;
|
| 307 |
|
| 308 | return gets - puts;
|
| 309 | #else
|
| 310 | return mnt->mnt_count;
|
| 311 | #endif
|
| 312 | }
|
| 313 |
|
| 314 | static struct mount *alloc_vfsmnt(const char *name)
|
| 315 | {
|
| 316 | struct mount *mnt = kmem_cache_zalloc(mnt_cache, GFP_KERNEL);
|
| 317 | if (mnt) {
|
| 318 | int err;
|
| 319 |
|
| 320 | mnt->mnt_cover = kzalloc_obj(struct mnt_cover, GFP_KERNEL_ACCOUNT);
|
| 321 | if (!mnt->mnt_cover)
|
| 322 | goto out_free_cache;
|
| 323 |
|
| 324 | err = mnt_alloc_id(mnt);
|
| 325 | if (err)
|
| 326 | goto out_free_cache;
|
| 327 |
|
| 328 | if (name)
|
| 329 | mnt->mnt_devname = kstrdup_const(name,
|
| 330 | GFP_KERNEL_ACCOUNT);
|
| 331 | else
|
| 332 | mnt->mnt_devname = "none";
|
| 333 | if (!mnt->mnt_devname)
|
| 334 | goto out_free_id;
|
| 335 |
|
| 336 | #ifdef CONFIG_SMP
|
| 337 | mnt->mnt_pcp = alloc_percpu(struct mnt_pcp);
|
| 338 | if (!mnt->mnt_pcp)
|
| 339 | goto out_free_devname;
|
| 340 |
|
| 341 | this_cpu_inc(mnt->mnt_pcp->mnt_gets);
|
| 342 | #else
|
| 343 | mnt->mnt_count = 1;
|
| 344 | mnt->mnt_writers = 0;
|
| 345 | #endif
|
| 346 |
|
| 347 | INIT_HLIST_NODE(&mnt->mnt_hash);
|
| 348 | INIT_LIST_HEAD(&mnt->mnt_child);
|
| 349 | INIT_LIST_HEAD(&mnt->mnt_mounts);
|
| 350 | INIT_LIST_HEAD(&mnt->mnt_list);
|
| 351 | INIT_LIST_HEAD(&mnt->mnt_expire);
|
| 352 | INIT_LIST_HEAD(&mnt->mnt_share);
|
| 353 | INIT_HLIST_HEAD(&mnt->mnt_slave_list);
|
| 354 | INIT_HLIST_NODE(&mnt->mnt_slave);
|
| 355 | INIT_HLIST_NODE(&mnt->mnt_mp_list);
|
| 356 | INIT_HLIST_HEAD(&mnt->mnt_covers);
|
| 357 | INIT_HLIST_NODE(&mnt->mnt_ns_visible);
|
| 358 | #ifdef CONFIG_FSNOTIFY
|
| 359 | INIT_LIST_HEAD(&mnt->to_notify);
|
| 360 | #endif
|
| 361 | RB_CLEAR_NODE(&mnt->mnt_node);
|
| 362 | mnt->mnt.mnt_idmap = &nop_mnt_idmap;
|
| 363 | }
|
| 364 | return mnt;
|
| 365 |
|
| 366 | #ifdef CONFIG_SMP
|
| 367 | out_free_devname:
|
| 368 | kfree_const(mnt->mnt_devname);
|
| 369 | #endif
|
| 370 | out_free_id:
|
| 371 | mnt_free_id(mnt);
|
| 372 | out_free_cache:
|
| 373 | kfree(mnt->mnt_cover);
|
| 374 | kmem_cache_free(mnt_cache, mnt);
|
| 375 | return NULL;
|
| 376 | }
|
| 377 |
|
| 378 | |
| 379 | * Most r/o checks on a fs are for operations that take
|
| 380 | * discrete amounts of time, like a write() or unlink().
|
| 381 | * We must keep track of when those operations start
|
| 382 | * (for permission checks) and when they end, so that
|
| 383 | * we can determine when writes are able to occur to
|
| 384 | * a filesystem.
|
| 385 |
|
| 386 | |
| 387 | * __mnt_is_readonly: check whether a mount is read-only
|
| 388 | * @mnt: the mount to check for its write status
|
| 389 | *
|
| 390 | * This shouldn't be used directly ouside of the VFS.
|
| 391 | * It does not guarantee that the filesystem will stay
|
| 392 | * r/w, just that it is right *now*. This can not and
|
| 393 | * should not be used in place of IS_RDONLY(inode).
|
| 394 | * mnt_want/drop_write() will _keep_ the filesystem
|
| 395 | * r/w.
|
| 396 |
|
| 397 | bool __mnt_is_readonly(const struct vfsmount *mnt)
|
| 398 | {
|
| 399 | return (mnt->mnt_flags & MNT_READONLY) || sb_rdonly(mnt->mnt_sb);
|
| 400 | }
|
| 401 | EXPORT_SYMBOL_GPL(__mnt_is_readonly);
|
| 402 |
|
| 403 | static inline void mnt_inc_writers(struct mount *mnt)
|
| 404 | {
|
| 405 | #ifdef CONFIG_SMP
|
| 406 | this_cpu_inc(mnt->mnt_pcp->mnt_writers);
|
| 407 | #else
|
| 408 | mnt->mnt_writers++;
|
| 409 | #endif
|
| 410 | }
|
| 411 |
|
| 412 | static inline void mnt_dec_writers(struct mount *mnt)
|
| 413 | {
|
| 414 | #ifdef CONFIG_SMP
|
| 415 | this_cpu_dec(mnt->mnt_pcp->mnt_writers);
|
| 416 | #else
|
| 417 | mnt->mnt_writers--;
|
| 418 | #endif
|
| 419 | }
|
| 420 |
|
| 421 | static unsigned int mnt_get_writers(struct mount *mnt)
|
| 422 | {
|
| 423 | #ifdef CONFIG_SMP
|
| 424 | unsigned int count = 0;
|
| 425 | int cpu;
|
| 426 |
|
| 427 | for_each_possible_cpu(cpu) {
|
| 428 | count += per_cpu_ptr(mnt->mnt_pcp, cpu)->mnt_writers;
|
| 429 | }
|
| 430 |
|
| 431 | return count;
|
| 432 | #else
|
| 433 | return mnt->mnt_writers;
|
| 434 | #endif
|
| 435 | }
|
| 436 |
|
| 437 | static int mnt_is_readonly(const struct vfsmount *mnt)
|
| 438 | {
|
| 439 | if (READ_ONCE(mnt->mnt_sb->s_readonly_remount))
|
| 440 | return 1;
|
| 441 | |
| 442 | * The barrier pairs with the barrier in sb_start_ro_state_change()
|
| 443 | * making sure if we don't see s_readonly_remount set yet, we also will
|
| 444 | * not see any superblock / mount flag changes done by remount.
|
| 445 | * It also pairs with the barrier in sb_end_ro_state_change()
|
| 446 | * assuring that if we see s_readonly_remount already cleared, we will
|
| 447 | * see the values of superblock / mount flags updated by remount.
|
| 448 |
|
| 449 | smp_rmb();
|
| 450 | return __mnt_is_readonly(mnt);
|
| 451 | }
|
| 452 |
|
| 453 | |
| 454 | * Most r/o & frozen checks on a fs are for operations that take discrete
|
| 455 | * amounts of time, like a write() or unlink(). We must keep track of when
|
| 456 | * those operations start (for permission checks) and when they end, so that we
|
| 457 | * can determine when writes are able to occur to a filesystem.
|
| 458 |
|
| 459 | |
| 460 | * mnt_get_write_access - get write access to a mount without freeze protection
|
| 461 | * @m: the mount on which to take a write
|
| 462 | *
|
| 463 | * This tells the low-level filesystem that a write is about to be performed to
|
| 464 | * it, and makes sure that writes are allowed (mnt it read-write) before
|
| 465 | * returning success. This operation does not protect against filesystem being
|
| 466 | * frozen. When the write operation is finished, mnt_put_write_access() must be
|
| 467 | * called. This is effectively a refcount.
|
| 468 |
|
| 469 | int mnt_get_write_access(struct vfsmount *m)
|
| 470 | {
|
| 471 | struct mount *mnt = real_mount(m);
|
| 472 | int ret = 0;
|
| 473 |
|
| 474 | preempt_disable();
|
| 475 | mnt_inc_writers(mnt);
|
| 476 | |
| 477 | * The store to mnt_inc_writers must be visible before we pass
|
| 478 | * WRITE_HOLD loop below, so that the slowpath can see our
|
| 479 | * incremented count after it has set WRITE_HOLD.
|
| 480 |
|
| 481 | smp_mb();
|
| 482 | might_lock(&mount_lock.lock);
|
| 483 | while (__test_write_hold(READ_ONCE(mnt->mnt_pprev_for_sb))) {
|
| 484 | if (!IS_ENABLED(CONFIG_PREEMPT_RT)) {
|
| 485 | cpu_relax();
|
| 486 | } else {
|
| 487 | |
| 488 | * This prevents priority inversion, if the task
|
| 489 | * setting WRITE_HOLD got preempted on a remote
|
| 490 | * CPU, and it prevents life lock if the task setting
|
| 491 | * WRITE_HOLD has a lower priority and is bound to
|
| 492 | * the same CPU as the task that is spinning here.
|
| 493 |
|
| 494 | preempt_enable();
|
| 495 | read_seqlock_excl(&mount_lock);
|
| 496 | read_sequnlock_excl(&mount_lock);
|
| 497 | preempt_disable();
|
| 498 | }
|
| 499 | }
|
| 500 | |
| 501 | * The barrier pairs with the barrier sb_start_ro_state_change() making
|
| 502 | * sure that if we see WRITE_HOLD cleared, we will also see
|
| 503 | * s_readonly_remount set (or even SB_RDONLY / MNT_READONLY flags) in
|
| 504 | * mnt_is_readonly() and bail in case we are racing with remount
|
| 505 | * read-only.
|
| 506 |
|
| 507 | smp_rmb();
|
| 508 | if (mnt_is_readonly(m)) {
|
| 509 | mnt_dec_writers(mnt);
|
| 510 | ret = -EROFS;
|
| 511 | }
|
| 512 | preempt_enable();
|
| 513 |
|
| 514 | return ret;
|
| 515 | }
|
| 516 | EXPORT_SYMBOL_GPL(mnt_get_write_access);
|
| 517 |
|
| 518 | |
| 519 | * mnt_want_write - get write access to a mount
|
| 520 | * @m: the mount on which to take a write
|
| 521 | *
|
| 522 | * This tells the low-level filesystem that a write is about to be performed to
|
| 523 | * it, and makes sure that writes are allowed (mount is read-write, filesystem
|
| 524 | * is not frozen) before returning success. When the write operation is
|
| 525 | * finished, mnt_drop_write() must be called. This is effectively a refcount.
|
| 526 |
|
| 527 | int mnt_want_write(struct vfsmount *m)
|
| 528 | {
|
| 529 | int ret;
|
| 530 |
|
| 531 | sb_start_write(m->mnt_sb);
|
| 532 | ret = mnt_get_write_access(m);
|
| 533 | if (ret)
|
| 534 | sb_end_write(m->mnt_sb);
|
| 535 | return ret;
|
| 536 | }
|
| 537 | EXPORT_SYMBOL_GPL(mnt_want_write);
|
| 538 |
|
| 539 | |
| 540 | * mnt_get_write_access_file - get write access to a file's mount
|
| 541 | * @file: the file who's mount on which to take a write
|
| 542 | *
|
| 543 | * This is like mnt_get_write_access, but if @file is already open for write it
|
| 544 | * skips incrementing mnt_writers (since the open file already has a reference)
|
| 545 | * and instead only does the check for emergency r/o remounts. This must be
|
| 546 | * paired with mnt_put_write_access_file.
|
| 547 |
|
| 548 | int mnt_get_write_access_file(struct file *file)
|
| 549 | {
|
| 550 | if (file->f_mode & FMODE_WRITER) {
|
| 551 | |
| 552 | * Superblock may have become readonly while there are still
|
| 553 | * writable fd's, e.g. due to a fs error with errors=remount-ro
|
| 554 |
|
| 555 | if (__mnt_is_readonly(file->f_path.mnt))
|
| 556 | return -EROFS;
|
| 557 | return 0;
|
| 558 | }
|
| 559 | return mnt_get_write_access(file->f_path.mnt);
|
| 560 | }
|
| 561 |
|
| 562 | |
| 563 | * mnt_want_write_file - get write access to a file's mount
|
| 564 | * @file: the file who's mount on which to take a write
|
| 565 | *
|
| 566 | * This is like mnt_want_write, but if the file is already open for writing it
|
| 567 | * skips incrementing mnt_writers (since the open file already has a reference)
|
| 568 | * and instead only does the freeze protection and the check for emergency r/o
|
| 569 | * remounts. This must be paired with mnt_drop_write_file.
|
| 570 |
|
| 571 | int mnt_want_write_file(struct file *file)
|
| 572 | {
|
| 573 | int ret;
|
| 574 |
|
| 575 | sb_start_write(file_inode(file)->i_sb);
|
| 576 | ret = mnt_get_write_access_file(file);
|
| 577 | if (ret)
|
| 578 | sb_end_write(file_inode(file)->i_sb);
|
| 579 | return ret;
|
| 580 | }
|
| 581 | EXPORT_SYMBOL_GPL(mnt_want_write_file);
|
| 582 |
|
| 583 | |
| 584 | * mnt_put_write_access - give up write access to a mount
|
| 585 | * @mnt: the mount on which to give up write access
|
| 586 | *
|
| 587 | * Tells the low-level filesystem that we are done
|
| 588 | * performing writes to it. Must be matched with
|
| 589 | * mnt_get_write_access() call above.
|
| 590 |
|
| 591 | void mnt_put_write_access(struct vfsmount *mnt)
|
| 592 | {
|
| 593 | preempt_disable();
|
| 594 | mnt_dec_writers(real_mount(mnt));
|
| 595 | preempt_enable();
|
| 596 | }
|
| 597 | EXPORT_SYMBOL_GPL(mnt_put_write_access);
|
| 598 |
|
| 599 | |
| 600 | * mnt_drop_write - give up write access to a mount
|
| 601 | * @mnt: the mount on which to give up write access
|
| 602 | *
|
| 603 | * Tells the low-level filesystem that we are done performing writes to it and
|
| 604 | * also allows filesystem to be frozen again. Must be matched with
|
| 605 | * mnt_want_write() call above.
|
| 606 |
|
| 607 | void mnt_drop_write(struct vfsmount *mnt)
|
| 608 | {
|
| 609 | mnt_put_write_access(mnt);
|
| 610 | sb_end_write(mnt->mnt_sb);
|
| 611 | }
|
| 612 | EXPORT_SYMBOL_GPL(mnt_drop_write);
|
| 613 |
|
| 614 | void mnt_put_write_access_file(struct file *file)
|
| 615 | {
|
| 616 | if (!(file->f_mode & FMODE_WRITER))
|
| 617 | mnt_put_write_access(file->f_path.mnt);
|
| 618 | }
|
| 619 |
|
| 620 | void mnt_drop_write_file(struct file *file)
|
| 621 | {
|
| 622 | mnt_put_write_access_file(file);
|
| 623 | sb_end_write(file_inode(file)->i_sb);
|
| 624 | }
|
| 625 | EXPORT_SYMBOL(mnt_drop_write_file);
|
| 626 |
|
| 627 | |
| 628 | * mnt_hold_writers - prevent write access to the given mount
|
| 629 | * @mnt: mnt to prevent write access to
|
| 630 | *
|
| 631 | * Prevents write access to @mnt if there are no active writers for @mnt.
|
| 632 | * This function needs to be called and return successfully before changing
|
| 633 | * properties of @mnt that need to remain stable for callers with write access
|
| 634 | * to @mnt.
|
| 635 | *
|
| 636 | * After this functions has been called successfully callers must pair it with
|
| 637 | * a call to mnt_unhold_writers() in order to stop preventing write access to
|
| 638 | * @mnt.
|
| 639 | *
|
| 640 | * Context: This function expects to be in mount_locked_reader scope serializing
|
| 641 | * setting WRITE_HOLD.
|
| 642 | * Return: On success 0 is returned.
|
| 643 | * On error, -EBUSY is returned.
|
| 644 |
|
| 645 | static inline int mnt_hold_writers(struct mount *mnt)
|
| 646 | {
|
| 647 | set_write_hold(mnt);
|
| 648 | |
| 649 | * After storing WRITE_HOLD, we'll read the counters. This store
|
| 650 | * should be visible before we do.
|
| 651 |
|
| 652 | smp_mb();
|
| 653 |
|
| 654 | |
| 655 | * With writers on hold, if this value is zero, then there are
|
| 656 | * definitely no active writers (although held writers may subsequently
|
| 657 | * increment the count, they'll have to wait, and decrement it after
|
| 658 | * seeing MNT_READONLY).
|
| 659 | *
|
| 660 | * It is OK to have counter incremented on one CPU and decremented on
|
| 661 | * another: the sum will add up correctly. The danger would be when we
|
| 662 | * sum up each counter, if we read a counter before it is incremented,
|
| 663 | * but then read another CPU's count which it has been subsequently
|
| 664 | * decremented from -- we would see more decrements than we should.
|
| 665 | * WRITE_HOLD protects against this scenario, because
|
| 666 | * mnt_want_write first increments count, then smp_mb, then spins on
|
| 667 | * WRITE_HOLD, so it can't be decremented by another CPU while
|
| 668 | * we're counting up here.
|
| 669 |
|
| 670 | if (mnt_get_writers(mnt) > 0)
|
| 671 | return -EBUSY;
|
| 672 |
|
| 673 | return 0;
|
| 674 | }
|
| 675 |
|
| 676 | |
| 677 | * mnt_unhold_writers - stop preventing write access to the given mount
|
| 678 | * @mnt: mnt to stop preventing write access to
|
| 679 | *
|
| 680 | * Stop preventing write access to @mnt allowing callers to gain write access
|
| 681 | * to @mnt again.
|
| 682 | *
|
| 683 | * This function can only be called after a call to mnt_hold_writers().
|
| 684 | *
|
| 685 | * Context: This function expects to be in the same mount_locked_reader scope
|
| 686 | * as the matching mnt_hold_writers().
|
| 687 |
|
| 688 | static inline void mnt_unhold_writers(struct mount *mnt)
|
| 689 | {
|
| 690 | if (!test_write_hold(mnt))
|
| 691 | return;
|
| 692 | |
| 693 | * MNT_READONLY must become visible before ~WRITE_HOLD, so writers
|
| 694 | * that become unheld will see MNT_READONLY.
|
| 695 |
|
| 696 | smp_wmb();
|
| 697 | clear_write_hold(mnt);
|
| 698 | }
|
| 699 |
|
| 700 | static inline void mnt_del_instance(struct mount *m)
|
| 701 | {
|
| 702 | struct mount **p = m->mnt_pprev_for_sb;
|
| 703 | struct mount *next = m->mnt_next_for_sb;
|
| 704 |
|
| 705 | if (next)
|
| 706 | next->mnt_pprev_for_sb = p;
|
| 707 | *p = next;
|
| 708 | }
|
| 709 |
|
| 710 | static inline void mnt_add_instance(struct mount *m, struct super_block *s)
|
| 711 | {
|
| 712 | struct mount *first = s->s_mounts;
|
| 713 |
|
| 714 | if (first)
|
| 715 | first->mnt_pprev_for_sb = &m->mnt_next_for_sb;
|
| 716 | m->mnt_next_for_sb = first;
|
| 717 | m->mnt_pprev_for_sb = &s->s_mounts;
|
| 718 | s->s_mounts = m;
|
| 719 | }
|
| 720 |
|
| 721 | static int mnt_make_readonly(struct mount *mnt)
|
| 722 | {
|
| 723 | int ret;
|
| 724 |
|
| 725 | ret = mnt_hold_writers(mnt);
|
| 726 | if (!ret)
|
| 727 | mnt->mnt.mnt_flags |= MNT_READONLY;
|
| 728 | mnt_unhold_writers(mnt);
|
| 729 | return ret;
|
| 730 | }
|
| 731 |
|
| 732 | int sb_prepare_remount_readonly(struct super_block *sb)
|
| 733 | {
|
| 734 | int err = 0;
|
| 735 |
|
| 736 |
|
| 737 | if (atomic_long_read(&sb->s_remove_count))
|
| 738 | return -EBUSY;
|
| 739 |
|
| 740 | guard(mount_locked_reader)();
|
| 741 |
|
| 742 | for (struct mount *m = sb->s_mounts; m; m = m->mnt_next_for_sb) {
|
| 743 | if (!(m->mnt.mnt_flags & MNT_READONLY)) {
|
| 744 | err = mnt_hold_writers(m);
|
| 745 | if (err)
|
| 746 | break;
|
| 747 | }
|
| 748 | }
|
| 749 | if (!err && atomic_long_read(&sb->s_remove_count))
|
| 750 | err = -EBUSY;
|
| 751 |
|
| 752 | if (!err)
|
| 753 | sb_start_ro_state_change(sb);
|
| 754 | for (struct mount *m = sb->s_mounts; m; m = m->mnt_next_for_sb) {
|
| 755 | if (test_write_hold(m))
|
| 756 | clear_write_hold(m);
|
| 757 | }
|
| 758 |
|
| 759 | return err;
|
| 760 | }
|
| 761 |
|
| 762 | static void free_vfsmnt(struct mount *mnt)
|
| 763 | {
|
| 764 | mnt_idmap_put(mnt_idmap(&mnt->mnt));
|
| 765 |
|
| 766 | kfree(mnt->mnt_cover);
|
| 767 | kfree_const(mnt->mnt_devname);
|
| 768 | #ifdef CONFIG_SMP
|
| 769 | free_percpu(mnt->mnt_pcp);
|
| 770 | #endif
|
| 771 | kmem_cache_free(mnt_cache, mnt);
|
| 772 | }
|
| 773 |
|
| 774 | static void delayed_free_vfsmnt(struct rcu_head *head)
|
| 775 | {
|
| 776 | free_vfsmnt(container_of(head, struct mount, mnt_rcu));
|
| 777 | }
|
| 778 |
|
| 779 |
|
| 780 | int __legitimize_mnt(struct vfsmount *bastard, unsigned seq)
|
| 781 | {
|
| 782 | struct mount *mnt;
|
| 783 | if (read_seqretry(&mount_lock, seq))
|
| 784 | return 1;
|
| 785 | if (bastard == NULL)
|
| 786 | return 0;
|
| 787 | mnt = real_mount(bastard);
|
| 788 | mnt_inc_count(mnt);
|
| 789 | smp_mb();
|
| 790 | if (likely(!read_seqretry(&mount_lock, seq)))
|
| 791 | return 0;
|
| 792 | lock_mount_hash();
|
| 793 | if (unlikely(bastard->mnt_flags & (MNT_SYNC_UMOUNT | MNT_DOOMED))) {
|
| 794 | mnt_dec_count(mnt);
|
| 795 | unlock_mount_hash();
|
| 796 | return 1;
|
| 797 | }
|
| 798 | unlock_mount_hash();
|
| 799 |
|
| 800 | return -1;
|
| 801 | }
|
| 802 |
|
| 803 |
|
| 804 | static bool legitimize_mnt(struct vfsmount *bastard, unsigned seq)
|
| 805 | {
|
| 806 | int res = __legitimize_mnt(bastard, seq);
|
| 807 | if (likely(!res))
|
| 808 | return true;
|
| 809 | if (unlikely(res < 0)) {
|
| 810 | rcu_read_unlock();
|
| 811 | mntput(bastard);
|
| 812 | rcu_read_lock();
|
| 813 | }
|
| 814 | return false;
|
| 815 | }
|
| 816 |
|
| 817 | |
| 818 | * __lookup_mnt - mount hash lookup
|
| 819 | * @mnt: parent mount
|
| 820 | * @dentry: dentry of mountpoint
|
| 821 | *
|
| 822 | * If @mnt has a child mount @c mounted on @dentry find and return it.
|
| 823 | * If @mnt is unmounted and a child that was unmounted with it left its
|
| 824 | * cover behind at @dentry, return the stand-in for it instead: knullfs
|
| 825 | * for a directory, its regular file for anything else.
|
| 826 | * Caller must either hold the spinlock component of @mount_lock or
|
| 827 | * hold rcu_read_lock(), sample the seqcount component before the call
|
| 828 | * and recheck it afterwards.
|
| 829 | *
|
| 830 | * Return: The child of @mnt mounted on @dentry, a stand-in or %NULL.
|
| 831 |
|
| 832 | struct mount *__lookup_mnt(struct vfsmount *mnt, struct dentry *dentry)
|
| 833 | {
|
| 834 | struct hlist_head *head = m_hash(mnt, dentry);
|
| 835 | struct mnt_cover *cover;
|
| 836 | struct mount *p;
|
| 837 |
|
| 838 | hlist_for_each_entry_rcu(p, head, mnt_hash)
|
| 839 | if (&p->mnt_parent->mnt == mnt && p->mnt_mountpoint == dentry)
|
| 840 | return p;
|
| 841 |
|
| 842 |
|
| 843 | if (unlikely(data_race(mnt->mnt_flags) & MNT_UMOUNT)) {
|
| 844 | hlist_for_each_entry_rcu(cover, &real_mount(mnt)->mnt_covers, node)
|
| 845 | if (cover->dentry == dentry)
|
| 846 | return real_mount(d_is_dir(dentry) ? knullfs : knullfs_file);
|
| 847 | }
|
| 848 | return NULL;
|
| 849 | }
|
| 850 |
|
| 851 | |
| 852 | * lookup_mnt - Return the child mount mounted at given location
|
| 853 | * @path: location in the namespace
|
| 854 | *
|
| 855 | * Acquires and returns a new reference to mount at given location
|
| 856 | * or %NULL if nothing is mounted there.
|
| 857 |
|
| 858 | struct vfsmount *lookup_mnt(const struct path *path)
|
| 859 | {
|
| 860 | struct mount *child_mnt;
|
| 861 | struct vfsmount *m;
|
| 862 | unsigned seq;
|
| 863 |
|
| 864 | rcu_read_lock();
|
| 865 | do {
|
| 866 | seq = read_seqbegin(&mount_lock);
|
| 867 | child_mnt = __lookup_mnt(path->mnt, path->dentry);
|
| 868 | m = child_mnt ? &child_mnt->mnt : NULL;
|
| 869 | } while (!legitimize_mnt(m, seq));
|
| 870 | rcu_read_unlock();
|
| 871 | return m;
|
| 872 | }
|
| 873 |
|
| 874 | |
| 875 | * __is_local_mountpoint - Test to see if dentry is a mountpoint in the
|
| 876 | * current mount namespace.
|
| 877 | *
|
| 878 | * The common case is dentries are not mountpoints at all and that
|
| 879 | * test is handled inline. For the slow case when we are actually
|
| 880 | * dealing with a mountpoint of some kind, walk through all of the
|
| 881 | * mounts in the current mount namespace and test to see if the dentry
|
| 882 | * is a mountpoint.
|
| 883 | *
|
| 884 | * The mount_hashtable is not usable in the context because we
|
| 885 | * need to identify all mounts that may be in the current mount
|
| 886 | * namespace not just a mount that happens to have some specified
|
| 887 | * parent mount.
|
| 888 |
|
| 889 | bool __is_local_mountpoint(const struct dentry *dentry)
|
| 890 | {
|
| 891 | struct mnt_namespace *ns = current->nsproxy->mnt_ns;
|
| 892 | struct mount *mnt, *n;
|
| 893 |
|
| 894 | guard(namespace_shared)();
|
| 895 |
|
| 896 | rbtree_postorder_for_each_entry_safe(mnt, n, &ns->mounts, mnt_node)
|
| 897 | if (mnt->mnt_mountpoint == dentry)
|
| 898 | return true;
|
| 899 |
|
| 900 | return false;
|
| 901 | }
|
| 902 |
|
| 903 | struct pinned_mountpoint {
|
| 904 | struct hlist_node node;
|
| 905 | struct mountpoint *mp;
|
| 906 | struct mount *parent;
|
| 907 | };
|
| 908 |
|
| 909 | static bool lookup_mountpoint(struct dentry *dentry, struct pinned_mountpoint *m)
|
| 910 | {
|
| 911 | struct hlist_head *chain = mp_hash(dentry);
|
| 912 | struct mountpoint *mp;
|
| 913 |
|
| 914 | hlist_for_each_entry(mp, chain, m_hash) {
|
| 915 | if (mp->m_dentry == dentry) {
|
| 916 | hlist_add_head(&m->node, &mp->m_list);
|
| 917 | m->mp = mp;
|
| 918 | return true;
|
| 919 | }
|
| 920 | }
|
| 921 | return false;
|
| 922 | }
|
| 923 |
|
| 924 | static int get_mountpoint(struct dentry *dentry, struct pinned_mountpoint *m)
|
| 925 | {
|
| 926 | struct mountpoint *mp __free(kfree) = NULL;
|
| 927 | bool found;
|
| 928 | int ret;
|
| 929 |
|
| 930 | if (d_mountpoint(dentry)) {
|
| 931 |
|
| 932 | if (d_unlinked(dentry))
|
| 933 | return -ENOENT;
|
| 934 | mountpoint:
|
| 935 | read_seqlock_excl(&mount_lock);
|
| 936 | found = lookup_mountpoint(dentry, m);
|
| 937 | read_sequnlock_excl(&mount_lock);
|
| 938 | if (found)
|
| 939 | return 0;
|
| 940 | }
|
| 941 |
|
| 942 | if (!mp)
|
| 943 | mp = kmalloc_obj(struct mountpoint);
|
| 944 | if (!mp)
|
| 945 | return -ENOMEM;
|
| 946 |
|
| 947 |
|
| 948 | ret = d_set_mounted(dentry);
|
| 949 |
|
| 950 |
|
| 951 | if (ret == -EBUSY)
|
| 952 | goto mountpoint;
|
| 953 |
|
| 954 |
|
| 955 | if (ret)
|
| 956 | return ret;
|
| 957 |
|
| 958 |
|
| 959 | read_seqlock_excl(&mount_lock);
|
| 960 | mp->m_dentry = dget(dentry);
|
| 961 | hlist_add_head(&mp->m_hash, mp_hash(dentry));
|
| 962 | INIT_HLIST_HEAD(&mp->m_list);
|
| 963 | INIT_HLIST_HEAD(&mp->m_covers);
|
| 964 | hlist_add_head(&m->node, &mp->m_list);
|
| 965 | m->mp = no_free_ptr(mp);
|
| 966 | read_sequnlock_excl(&mount_lock);
|
| 967 | return 0;
|
| 968 | }
|
| 969 |
|
| 970 | |
| 971 | * vfsmount lock must be held. Additionally, the caller is responsible
|
| 972 | * for serializing calls for given disposal list.
|
| 973 |
|
| 974 | static void maybe_free_mountpoint(struct mountpoint *mp, struct list_head *list)
|
| 975 | {
|
| 976 | if (hlist_empty(&mp->m_list) && hlist_empty(&mp->m_covers)) {
|
| 977 | struct dentry *dentry = mp->m_dentry;
|
| 978 | spin_lock(&dentry->d_lock);
|
| 979 | dentry->d_flags &= ~DCACHE_MOUNTED;
|
| 980 | spin_unlock(&dentry->d_lock);
|
| 981 | dput_to_list(dentry, list);
|
| 982 | hlist_del(&mp->m_hash);
|
| 983 | kfree(mp);
|
| 984 | }
|
| 985 | }
|
| 986 |
|
| 987 | |
| 988 | * locks: mount_lock [read_seqlock_excl], namespace_sem [excl]
|
| 989 |
|
| 990 | static void unpin_mountpoint(struct pinned_mountpoint *m)
|
| 991 | {
|
| 992 | if (m->mp) {
|
| 993 | hlist_del(&m->node);
|
| 994 | maybe_free_mountpoint(m->mp, &ex_mountpoints);
|
| 995 | }
|
| 996 | }
|
| 997 |
|
| 998 | static inline int check_mnt(const struct mount *mnt)
|
| 999 | {
|
| 1000 | return mnt->mnt_ns == current->nsproxy->mnt_ns;
|
| 1001 | }
|
| 1002 |
|
| 1003 | static inline bool check_anonymous_mnt(struct mount *mnt)
|
| 1004 | {
|
| 1005 | u64 seq;
|
| 1006 |
|
| 1007 | if (!is_anon_ns(mnt->mnt_ns))
|
| 1008 | return false;
|
| 1009 |
|
| 1010 | seq = mnt->mnt_ns->seq_origin;
|
| 1011 | return !seq || (seq == current->nsproxy->mnt_ns->ns.ns_id);
|
| 1012 | }
|
| 1013 |
|
| 1014 | |
| 1015 | * vfsmount lock must be held for write
|
| 1016 |
|
| 1017 | static void touch_mnt_namespace(struct mnt_namespace *ns)
|
| 1018 | {
|
| 1019 | if (ns) {
|
| 1020 | ns->event = ++event;
|
| 1021 | wake_up_interruptible(&ns->poll);
|
| 1022 | }
|
| 1023 | }
|
| 1024 |
|
| 1025 | |
| 1026 | * vfsmount lock must be held for write
|
| 1027 |
|
| 1028 | static void __touch_mnt_namespace(struct mnt_namespace *ns)
|
| 1029 | {
|
| 1030 | if (ns && ns->event != event) {
|
| 1031 | ns->event = event;
|
| 1032 | wake_up_interruptible(&ns->poll);
|
| 1033 | }
|
| 1034 | }
|
| 1035 |
|
| 1036 | |
| 1037 | * locks: mount_lock[write_seqlock]
|
| 1038 |
|
| 1039 | static void __umount_mnt(struct mount *mnt, struct list_head *shrink_list)
|
| 1040 | {
|
| 1041 | struct mountpoint *mp;
|
| 1042 | struct mount *parent = mnt->mnt_parent;
|
| 1043 | if (unlikely(parent->overmount == mnt))
|
| 1044 | parent->overmount = NULL;
|
| 1045 | mnt->mnt_parent = mnt;
|
| 1046 | mnt->mnt_mountpoint = mnt->mnt.mnt_root;
|
| 1047 | list_del_init(&mnt->mnt_child);
|
| 1048 | hlist_del_init_rcu(&mnt->mnt_hash);
|
| 1049 | hlist_del_init(&mnt->mnt_mp_list);
|
| 1050 | mp = mnt->mnt_mp;
|
| 1051 | mnt->mnt_mp = NULL;
|
| 1052 | maybe_free_mountpoint(mp, shrink_list);
|
| 1053 | }
|
| 1054 |
|
| 1055 | |
| 1056 | * locks: mount_lock[write_seqlock], namespace_sem[excl] (for ex_mountpoints)
|
| 1057 |
|
| 1058 | static void umount_mnt(struct mount *mnt)
|
| 1059 | {
|
| 1060 | __umount_mnt(mnt, &ex_mountpoints);
|
| 1061 | }
|
| 1062 |
|
| 1063 | |
| 1064 | * @mnt is unmounted together with its parent and would have stayed attached
|
| 1065 | * to it. Leave its cover behind before it is detached so that a lookup on the
|
| 1066 | * parent at the mountpoint keeps finding a mount instead of what @mnt covered.
|
| 1067 | *
|
| 1068 | * locks: mount_lock[write_seqlock]
|
| 1069 |
|
| 1070 | static void leave_cover(struct mount *mnt)
|
| 1071 | {
|
| 1072 | struct mnt_cover *cover = mnt->mnt_cover;
|
| 1073 |
|
| 1074 | mnt->mnt_cover = NULL;
|
| 1075 | cover->dentry = mnt->mnt_mountpoint;
|
| 1076 | cover->mp = mnt->mnt_mp;
|
| 1077 |
|
| 1078 | hlist_add_head(&cover->pin, &cover->mp->m_covers);
|
| 1079 | hlist_add_head_rcu(&cover->node, &mnt->mnt_parent->mnt_covers);
|
| 1080 | }
|
| 1081 |
|
| 1082 | |
| 1083 | * locks: mount_lock[write_seqlock]
|
| 1084 |
|
| 1085 | static void drop_cover(struct mnt_cover *cover, struct list_head *shrink_list)
|
| 1086 | {
|
| 1087 | hlist_del_rcu(&cover->node);
|
| 1088 | hlist_del(&cover->pin);
|
| 1089 | maybe_free_mountpoint(cover->mp, shrink_list);
|
| 1090 | kfree_rcu(cover, rcu);
|
| 1091 | }
|
| 1092 |
|
| 1093 | |
| 1094 | * vfsmount lock must be held for write
|
| 1095 |
|
| 1096 | void mnt_set_mountpoint(struct mount *mnt,
|
| 1097 | struct mountpoint *mp,
|
| 1098 | struct mount *child_mnt)
|
| 1099 | {
|
| 1100 | child_mnt->mnt_mountpoint = mp->m_dentry;
|
| 1101 | child_mnt->mnt_parent = mnt;
|
| 1102 | child_mnt->mnt_mp = mp;
|
| 1103 | hlist_add_head(&child_mnt->mnt_mp_list, &mp->m_list);
|
| 1104 | }
|
| 1105 |
|
| 1106 | static void make_visible(struct mount *mnt)
|
| 1107 | {
|
| 1108 | struct mount *parent = mnt->mnt_parent;
|
| 1109 | if (unlikely(mnt->mnt_mountpoint == parent->mnt.mnt_root))
|
| 1110 | parent->overmount = mnt;
|
| 1111 | hlist_add_head_rcu(&mnt->mnt_hash,
|
| 1112 | m_hash(&parent->mnt, mnt->mnt_mountpoint));
|
| 1113 | list_add_tail(&mnt->mnt_child, &parent->mnt_mounts);
|
| 1114 | }
|
| 1115 |
|
| 1116 | |
| 1117 | * attach_mnt - mount a mount, attach to @mount_hashtable and parent's
|
| 1118 | * list of child mounts
|
| 1119 | * @parent: the parent
|
| 1120 | * @mnt: the new mount
|
| 1121 | * @mp: the new mountpoint
|
| 1122 | *
|
| 1123 | * Mount @mnt at @mp on @parent. Then attach @mnt
|
| 1124 | * to @parent's child mount list and to @mount_hashtable.
|
| 1125 | *
|
| 1126 | * Note, when make_visible() is called @mnt->mnt_parent already points
|
| 1127 | * to the correct parent.
|
| 1128 | *
|
| 1129 | * Context: This function expects namespace_lock() and lock_mount_hash()
|
| 1130 | * to have been acquired in that order.
|
| 1131 |
|
| 1132 | static void attach_mnt(struct mount *mnt, struct mount *parent,
|
| 1133 | struct mountpoint *mp)
|
| 1134 | {
|
| 1135 | mnt_set_mountpoint(parent, mp, mnt);
|
| 1136 | make_visible(mnt);
|
| 1137 | }
|
| 1138 |
|
| 1139 | void mnt_change_mountpoint(struct mount *parent, struct mountpoint *mp, struct mount *mnt)
|
| 1140 | {
|
| 1141 | struct mountpoint *old_mp = mnt->mnt_mp;
|
| 1142 | struct mount *old_parent = mnt->mnt_parent;
|
| 1143 |
|
| 1144 | if (old_parent->overmount == mnt)
|
| 1145 | old_parent->overmount = NULL;
|
| 1146 | list_del_init(&mnt->mnt_child);
|
| 1147 | hlist_del_init(&mnt->mnt_mp_list);
|
| 1148 | hlist_del_init_rcu(&mnt->mnt_hash);
|
| 1149 |
|
| 1150 | attach_mnt(mnt, parent, mp);
|
| 1151 |
|
| 1152 | maybe_free_mountpoint(old_mp, &ex_mountpoints);
|
| 1153 | }
|
| 1154 |
|
| 1155 | static inline struct mount *node_to_mount(struct rb_node *node)
|
| 1156 | {
|
| 1157 | return node ? rb_entry(node, struct mount, mnt_node) : NULL;
|
| 1158 | }
|
| 1159 |
|
| 1160 | static void mnt_add_to_ns(struct mnt_namespace *ns, struct mount *mnt)
|
| 1161 | {
|
| 1162 | struct rb_node **link = &ns->mounts.rb_node;
|
| 1163 | struct rb_node *parent = NULL;
|
| 1164 | bool mnt_first_node = true, mnt_last_node = true;
|
| 1165 |
|
| 1166 | WARN_ON(mnt_ns_attached(mnt));
|
| 1167 | WRITE_ONCE(mnt->mnt_ns, ns);
|
| 1168 | while (*link) {
|
| 1169 | parent = *link;
|
| 1170 | if (mnt->mnt_id_unique < node_to_mount(parent)->mnt_id_unique) {
|
| 1171 | link = &parent->rb_left;
|
| 1172 | mnt_last_node = false;
|
| 1173 | } else {
|
| 1174 | link = &parent->rb_right;
|
| 1175 | mnt_first_node = false;
|
| 1176 | }
|
| 1177 | }
|
| 1178 |
|
| 1179 | if (mnt_last_node)
|
| 1180 | ns->mnt_last_node = &mnt->mnt_node;
|
| 1181 | if (mnt_first_node)
|
| 1182 | ns->mnt_first_node = &mnt->mnt_node;
|
| 1183 | rb_link_node(&mnt->mnt_node, parent, link);
|
| 1184 | rb_insert_color(&mnt->mnt_node, &ns->mounts);
|
| 1185 |
|
| 1186 | if ((mnt->mnt.mnt_sb->s_type->fs_flags & FS_USERNS_MOUNT_RESTRICTED) &&
|
| 1187 | mnt->mnt.mnt_root == mnt->mnt.mnt_sb->s_root)
|
| 1188 | hlist_add_head(&mnt->mnt_ns_visible, &ns->mnt_visible_mounts);
|
| 1189 |
|
| 1190 | mnt_notify_add(mnt);
|
| 1191 | }
|
| 1192 |
|
| 1193 | static struct mount *next_mnt(struct mount *p, struct mount *root)
|
| 1194 | {
|
| 1195 | struct list_head *next = p->mnt_mounts.next;
|
| 1196 | if (next == &p->mnt_mounts) {
|
| 1197 | while (1) {
|
| 1198 | if (p == root)
|
| 1199 | return NULL;
|
| 1200 | next = p->mnt_child.next;
|
| 1201 | if (next != &p->mnt_parent->mnt_mounts)
|
| 1202 | break;
|
| 1203 | p = p->mnt_parent;
|
| 1204 | }
|
| 1205 | }
|
| 1206 | return list_entry(next, struct mount, mnt_child);
|
| 1207 | }
|
| 1208 |
|
| 1209 | static struct mount *skip_mnt_tree(struct mount *p)
|
| 1210 | {
|
| 1211 | struct list_head *prev = p->mnt_mounts.prev;
|
| 1212 | while (prev != &p->mnt_mounts) {
|
| 1213 | p = list_entry(prev, struct mount, mnt_child);
|
| 1214 | prev = p->mnt_mounts.prev;
|
| 1215 | }
|
| 1216 | return p;
|
| 1217 | }
|
| 1218 |
|
| 1219 | |
| 1220 | * vfsmount lock must be held for write
|
| 1221 |
|
| 1222 | static void commit_tree(struct mount *mnt)
|
| 1223 | {
|
| 1224 | struct mnt_namespace *n = mnt->mnt_parent->mnt_ns;
|
| 1225 |
|
| 1226 | if (!mnt_ns_attached(mnt)) {
|
| 1227 | for (struct mount *m = mnt; m; m = next_mnt(m, mnt))
|
| 1228 | mnt_add_to_ns(n, m);
|
| 1229 | n->nr_mounts += n->pending_mounts;
|
| 1230 | n->pending_mounts = 0;
|
| 1231 | }
|
| 1232 |
|
| 1233 | make_visible(mnt);
|
| 1234 | touch_mnt_namespace(n);
|
| 1235 | }
|
| 1236 |
|
| 1237 | static void setup_mnt(struct mount *m, struct dentry *root)
|
| 1238 | {
|
| 1239 | struct super_block *s = root->d_sb;
|
| 1240 |
|
| 1241 | atomic_inc(&s->s_active);
|
| 1242 | m->mnt.mnt_sb = s;
|
| 1243 | m->mnt.mnt_root = dget(root);
|
| 1244 | m->mnt_mountpoint = m->mnt.mnt_root;
|
| 1245 | m->mnt_parent = m;
|
| 1246 |
|
| 1247 | guard(mount_locked_reader)();
|
| 1248 | mnt_add_instance(m, s);
|
| 1249 | }
|
| 1250 |
|
| 1251 | |
| 1252 | * vfs_create_mount - Create a mount for a configured superblock
|
| 1253 | * @fc: The configuration context with the superblock attached
|
| 1254 | *
|
| 1255 | * Create a mount to an already configured superblock. If necessary, the
|
| 1256 | * caller should invoke vfs_get_tree() before calling this.
|
| 1257 | *
|
| 1258 | * Note that this does not attach the mount to anything.
|
| 1259 |
|
| 1260 | struct vfsmount *vfs_create_mount(struct fs_context *fc)
|
| 1261 | {
|
| 1262 | struct mount *mnt;
|
| 1263 |
|
| 1264 | if (!fc->root)
|
| 1265 | return ERR_PTR(-EINVAL);
|
| 1266 |
|
| 1267 | mnt = alloc_vfsmnt(fc->source);
|
| 1268 | if (!mnt)
|
| 1269 | return ERR_PTR(-ENOMEM);
|
| 1270 |
|
| 1271 | if (fc->sb_flags & SB_KERNMOUNT)
|
| 1272 | mnt->mnt.mnt_flags = MNT_INTERNAL;
|
| 1273 |
|
| 1274 | setup_mnt(mnt, fc->root);
|
| 1275 |
|
| 1276 | return &mnt->mnt;
|
| 1277 | }
|
| 1278 | EXPORT_SYMBOL(vfs_create_mount);
|
| 1279 |
|
| 1280 | struct vfsmount *fc_mount(struct fs_context *fc)
|
| 1281 | {
|
| 1282 | int err = vfs_get_tree(fc);
|
| 1283 | if (!err) {
|
| 1284 | up_write(&fc->root->d_sb->s_umount);
|
| 1285 | return vfs_create_mount(fc);
|
| 1286 | }
|
| 1287 | return ERR_PTR(err);
|
| 1288 | }
|
| 1289 | EXPORT_SYMBOL(fc_mount);
|
| 1290 |
|
| 1291 | struct vfsmount *fc_mount_longterm(struct fs_context *fc)
|
| 1292 | {
|
| 1293 | struct vfsmount *mnt = fc_mount(fc);
|
| 1294 | if (!IS_ERR(mnt))
|
| 1295 | real_mount(mnt)->mnt_ns = MNT_NS_INTERNAL;
|
| 1296 | return mnt;
|
| 1297 | }
|
| 1298 | EXPORT_SYMBOL(fc_mount_longterm);
|
| 1299 |
|
| 1300 | struct vfsmount *vfs_kern_mount(struct file_system_type *type,
|
| 1301 | int flags, const char *name,
|
| 1302 | void *data)
|
| 1303 | {
|
| 1304 | struct fs_context *fc;
|
| 1305 | struct vfsmount *mnt;
|
| 1306 | int ret = 0;
|
| 1307 |
|
| 1308 | if (!type)
|
| 1309 | return ERR_PTR(-EINVAL);
|
| 1310 |
|
| 1311 | fc = fs_context_for_mount(type, flags);
|
| 1312 | if (IS_ERR(fc))
|
| 1313 | return ERR_CAST(fc);
|
| 1314 |
|
| 1315 | if (name)
|
| 1316 | ret = vfs_parse_fs_string(fc, "source", name);
|
| 1317 | if (!ret)
|
| 1318 | ret = parse_monolithic_mount_data(fc, data);
|
| 1319 | if (!ret)
|
| 1320 | mnt = fc_mount(fc);
|
| 1321 | else
|
| 1322 | mnt = ERR_PTR(ret);
|
| 1323 |
|
| 1324 | put_fs_context(fc);
|
| 1325 | return mnt;
|
| 1326 | }
|
| 1327 | EXPORT_SYMBOL_GPL(vfs_kern_mount);
|
| 1328 |
|
| 1329 | static struct mount *clone_mnt(struct mount *old, struct dentry *root,
|
| 1330 | int flag)
|
| 1331 | {
|
| 1332 | struct mount *mnt;
|
| 1333 | int err;
|
| 1334 |
|
| 1335 | mnt = alloc_vfsmnt(old->mnt_devname);
|
| 1336 | if (!mnt)
|
| 1337 | return ERR_PTR(-ENOMEM);
|
| 1338 |
|
| 1339 | mnt->mnt.mnt_flags = READ_ONCE(old->mnt.mnt_flags) &
|
| 1340 | ~MNT_INTERNAL_FLAGS;
|
| 1341 | mnt->mnt_t_flags = old->mnt_t_flags & T_UNBINDABLE;
|
| 1342 |
|
| 1343 | if (flag & (CL_SLAVE | CL_PRIVATE))
|
| 1344 | mnt->mnt_group_id = 0;
|
| 1345 | else
|
| 1346 | mnt->mnt_group_id = old->mnt_group_id;
|
| 1347 |
|
| 1348 | if ((flag & CL_MAKE_SHARED) && !mnt->mnt_group_id) {
|
| 1349 | err = mnt_alloc_group_id(mnt);
|
| 1350 | if (err)
|
| 1351 | goto out_free;
|
| 1352 | }
|
| 1353 |
|
| 1354 | if (mnt->mnt_group_id)
|
| 1355 | set_mnt_shared(mnt);
|
| 1356 |
|
| 1357 | mnt->mnt.mnt_idmap = mnt_idmap_get(mnt_idmap(&old->mnt));
|
| 1358 |
|
| 1359 | setup_mnt(mnt, root);
|
| 1360 |
|
| 1361 | if (flag & CL_PRIVATE) |
| 1362 | return mnt;
|
| 1363 |
|
| 1364 | if (peers(mnt, old))
|
| 1365 | list_add(&mnt->mnt_share, &old->mnt_share);
|
| 1366 |
|
| 1367 | if ((flag & CL_SLAVE) && old->mnt_group_id) {
|
| 1368 | hlist_add_head(&mnt->mnt_slave, &old->mnt_slave_list);
|
| 1369 | mnt->mnt_master = old;
|
| 1370 | } else if (IS_MNT_SLAVE(old)) {
|
| 1371 | hlist_add_behind(&mnt->mnt_slave, &old->mnt_slave);
|
| 1372 | mnt->mnt_master = old->mnt_master;
|
| 1373 | }
|
| 1374 | return mnt;
|
| 1375 |
|
| 1376 | out_free:
|
| 1377 | mnt_free_id(mnt);
|
| 1378 | free_vfsmnt(mnt);
|
| 1379 | return ERR_PTR(err);
|
| 1380 | }
|
| 1381 |
|
| 1382 | static void cleanup_mnt(struct mount *mnt)
|
| 1383 | {
|
| 1384 | |
| 1385 | * The warning here probably indicates that somebody messed
|
| 1386 | * up a mnt_want/drop_write() pair. If this happens, the
|
| 1387 | * filesystem was probably unable to make r/w->r/o transitions.
|
| 1388 | * The locking used to deal with mnt_count decrement provides barriers,
|
| 1389 | * so mnt_get_writers() below is safe.
|
| 1390 |
|
| 1391 | WARN_ON(mnt_get_writers(mnt));
|
| 1392 | if (unlikely(mnt->mnt_pins.first))
|
| 1393 | mnt_pin_kill(mnt);
|
| 1394 | fsnotify_vfsmount_delete(&mnt->mnt);
|
| 1395 | dput(mnt->mnt.mnt_root);
|
| 1396 | deactivate_super(mnt->mnt.mnt_sb);
|
| 1397 | mnt_free_id(mnt);
|
| 1398 | call_rcu(&mnt->mnt_rcu, delayed_free_vfsmnt);
|
| 1399 | }
|
| 1400 |
|
| 1401 | static void __cleanup_mnt(struct rcu_head *head)
|
| 1402 | {
|
| 1403 | cleanup_mnt(container_of(head, struct mount, mnt_rcu));
|
| 1404 | }
|
| 1405 |
|
| 1406 | static LLIST_HEAD(delayed_mntput_list);
|
| 1407 | static void delayed_mntput(struct work_struct *unused)
|
| 1408 | {
|
| 1409 | struct llist_node *node = llist_del_all(&delayed_mntput_list);
|
| 1410 | struct mount *m, *t;
|
| 1411 |
|
| 1412 | llist_for_each_entry_safe(m, t, node, mnt_llist)
|
| 1413 | cleanup_mnt(m);
|
| 1414 | }
|
| 1415 | static DECLARE_DELAYED_WORK(delayed_mntput_work, delayed_mntput);
|
| 1416 |
|
| 1417 | static void noinline mntput_no_expire_slowpath(struct mount *mnt)
|
| 1418 | {
|
| 1419 | struct mnt_cover *cover;
|
| 1420 | struct hlist_node *n;
|
| 1421 | LIST_HEAD(list);
|
| 1422 | int count;
|
| 1423 |
|
| 1424 | VFS_BUG_ON(mnt->mnt_ns);
|
| 1425 | lock_mount_hash();
|
| 1426 | mnt_dec_count(mnt);
|
| 1427 | count = mnt_get_count(mnt);
|
| 1428 | if (count != 0) {
|
| 1429 | WARN_ON(count < 0);
|
| 1430 | rcu_read_unlock();
|
| 1431 | unlock_mount_hash();
|
| 1432 | return;
|
| 1433 | }
|
| 1434 | if (unlikely(mnt->mnt.mnt_flags & MNT_DOOMED)) {
|
| 1435 | rcu_read_unlock();
|
| 1436 | unlock_mount_hash();
|
| 1437 | return;
|
| 1438 | }
|
| 1439 | mnt->mnt.mnt_flags |= MNT_DOOMED;
|
| 1440 | rcu_read_unlock();
|
| 1441 |
|
| 1442 | mnt_del_instance(mnt);
|
| 1443 | if (unlikely(!list_empty(&mnt->mnt_expire)))
|
| 1444 | list_del(&mnt->mnt_expire);
|
| 1445 |
|
| 1446 |
|
| 1447 | VFS_WARN_ON_ONCE(!list_empty(&mnt->mnt_mounts));
|
| 1448 | hlist_for_each_entry_safe(cover, n, &mnt->mnt_covers, node)
|
| 1449 | drop_cover(cover, &list);
|
| 1450 | unlock_mount_hash();
|
| 1451 | shrink_dentry_list(&list);
|
| 1452 |
|
| 1453 | if (likely(!(mnt->mnt.mnt_flags & MNT_INTERNAL))) {
|
| 1454 | struct task_struct *task = current;
|
| 1455 | if (likely(!(task->flags & PF_KTHREAD))) {
|
| 1456 | init_task_work(&mnt->mnt_rcu, __cleanup_mnt);
|
| 1457 | if (!task_work_add(task, &mnt->mnt_rcu, TWA_RESUME))
|
| 1458 | return;
|
| 1459 | }
|
| 1460 | if (llist_add(&mnt->mnt_llist, &delayed_mntput_list))
|
| 1461 | schedule_delayed_work(&delayed_mntput_work, 1);
|
| 1462 | return;
|
| 1463 | }
|
| 1464 | cleanup_mnt(mnt);
|
| 1465 | }
|
| 1466 |
|
| 1467 | static void mntput_no_expire(struct mount *mnt)
|
| 1468 | {
|
| 1469 | rcu_read_lock();
|
| 1470 | if (likely(READ_ONCE(mnt->mnt_ns))) {
|
| 1471 | |
| 1472 | * Since we don't do lock_mount_hash() here,
|
| 1473 | * ->mnt_ns can change under us. However, if it's
|
| 1474 | * non-NULL, then there's a reference that won't
|
| 1475 | * be dropped until after an RCU delay done after
|
| 1476 | * turning ->mnt_ns NULL. So if we observe it
|
| 1477 | * non-NULL under rcu_read_lock(), the reference
|
| 1478 | * we are dropping is not the final one.
|
| 1479 |
|
| 1480 | smp_wmb();
|
| 1481 | mnt_dec_count(mnt);
|
| 1482 | rcu_read_unlock();
|
| 1483 | return;
|
| 1484 | }
|
| 1485 | mntput_no_expire_slowpath(mnt);
|
| 1486 | }
|
| 1487 |
|
| 1488 | void mntput(struct vfsmount *mnt)
|
| 1489 | {
|
| 1490 | if (mnt) {
|
| 1491 | struct mount *m = real_mount(mnt);
|
| 1492 |
|
| 1493 | if (unlikely(m->mnt_expiry_mark))
|
| 1494 | WRITE_ONCE(m->mnt_expiry_mark, 0);
|
| 1495 | mntput_no_expire(m);
|
| 1496 | }
|
| 1497 | }
|
| 1498 | EXPORT_SYMBOL(mntput);
|
| 1499 |
|
| 1500 | struct vfsmount *mntget(struct vfsmount *mnt)
|
| 1501 | {
|
| 1502 | if (mnt)
|
| 1503 | mnt_inc_count(real_mount(mnt));
|
| 1504 | return mnt;
|
| 1505 | }
|
| 1506 | EXPORT_SYMBOL(mntget);
|
| 1507 |
|
| 1508 | |
| 1509 | * Make a mount point inaccessible to new lookups.
|
| 1510 | * Because there may still be current users, the caller MUST WAIT
|
| 1511 | * for an RCU grace period before destroying the mount point.
|
| 1512 |
|
| 1513 | void mnt_make_shortterm(struct vfsmount *mnt)
|
| 1514 | {
|
| 1515 | if (mnt)
|
| 1516 | WRITE_ONCE(real_mount(mnt)->mnt_ns, NULL);
|
| 1517 | }
|
| 1518 |
|
| 1519 | |
| 1520 | * path_is_mountpoint() - Check if path is a mount in the current namespace.
|
| 1521 | * @path: path to check
|
| 1522 | *
|
| 1523 | * d_mountpoint() can only be used reliably to establish if a dentry is
|
| 1524 | * not mounted in any namespace and that common case is handled inline.
|
| 1525 | * d_mountpoint() isn't aware of the possibility there may be multiple
|
| 1526 | * mounts using a given dentry in a different namespace. This function
|
| 1527 | * checks if the passed in path is a mountpoint rather than the dentry
|
| 1528 | * alone.
|
| 1529 |
|
| 1530 | bool path_is_mountpoint(const struct path *path)
|
| 1531 | {
|
| 1532 | unsigned seq;
|
| 1533 | bool res;
|
| 1534 |
|
| 1535 | if (!d_mountpoint(path->dentry))
|
| 1536 | return false;
|
| 1537 |
|
| 1538 | rcu_read_lock();
|
| 1539 | do {
|
| 1540 | seq = read_seqbegin(&mount_lock);
|
| 1541 | res = __path_is_mountpoint(path);
|
| 1542 | } while (read_seqretry(&mount_lock, seq));
|
| 1543 | rcu_read_unlock();
|
| 1544 |
|
| 1545 | return res;
|
| 1546 | }
|
| 1547 | EXPORT_SYMBOL(path_is_mountpoint);
|
| 1548 |
|
| 1549 | struct vfsmount *mnt_clone_internal(const struct path *path)
|
| 1550 | {
|
| 1551 | struct mount *p;
|
| 1552 | p = clone_mnt(real_mount(path->mnt), path->dentry, CL_PRIVATE);
|
| 1553 | if (IS_ERR(p))
|
| 1554 | return ERR_CAST(p);
|
| 1555 | p->mnt.mnt_flags |= MNT_INTERNAL;
|
| 1556 | return &p->mnt;
|
| 1557 | }
|
| 1558 |
|
| 1559 | |
| 1560 | * Returns the mount which either has the specified mnt_id, or has the next
|
| 1561 | * smallest id afer the specified one.
|
| 1562 |
|
| 1563 | static struct mount *mnt_find_id_at(struct mnt_namespace *ns, u64 mnt_id)
|
| 1564 | {
|
| 1565 | struct rb_node *node = ns->mounts.rb_node;
|
| 1566 | struct mount *ret = NULL;
|
| 1567 |
|
| 1568 | while (node) {
|
| 1569 | struct mount *m = node_to_mount(node);
|
| 1570 |
|
| 1571 | if (mnt_id <= m->mnt_id_unique) {
|
| 1572 | ret = node_to_mount(node);
|
| 1573 | if (mnt_id == m->mnt_id_unique)
|
| 1574 | break;
|
| 1575 | node = node->rb_left;
|
| 1576 | } else {
|
| 1577 | node = node->rb_right;
|
| 1578 | }
|
| 1579 | }
|
| 1580 | return ret;
|
| 1581 | }
|
| 1582 |
|
| 1583 | |
| 1584 | * Returns the mount which either has the specified mnt_id, or has the next
|
| 1585 | * greater id before the specified one.
|
| 1586 |
|
| 1587 | static struct mount *mnt_find_id_at_reverse(struct mnt_namespace *ns, u64 mnt_id)
|
| 1588 | {
|
| 1589 | struct rb_node *node = ns->mounts.rb_node;
|
| 1590 | struct mount *ret = NULL;
|
| 1591 |
|
| 1592 | while (node) {
|
| 1593 | struct mount *m = node_to_mount(node);
|
| 1594 |
|
| 1595 | if (mnt_id >= m->mnt_id_unique) {
|
| 1596 | ret = node_to_mount(node);
|
| 1597 | if (mnt_id == m->mnt_id_unique)
|
| 1598 | break;
|
| 1599 | node = node->rb_right;
|
| 1600 | } else {
|
| 1601 | node = node->rb_left;
|
| 1602 | }
|
| 1603 | }
|
| 1604 | return ret;
|
| 1605 | }
|
| 1606 |
|
| 1607 | #ifdef CONFIG_PROC_FS
|
| 1608 |
|
| 1609 |
|
| 1610 | static void *m_start(struct seq_file *m, loff_t *pos)
|
| 1611 | {
|
| 1612 | struct proc_mounts *p = m->private;
|
| 1613 | struct mount *mnt;
|
| 1614 |
|
| 1615 | down_read(&namespace_sem);
|
| 1616 |
|
| 1617 | mnt = mnt_find_id_at(p->ns, *pos);
|
| 1618 | if (mnt)
|
| 1619 | *pos = mnt->mnt_id_unique;
|
| 1620 | return mnt;
|
| 1621 | }
|
| 1622 |
|
| 1623 | static void *m_next(struct seq_file *m, void *v, loff_t *pos)
|
| 1624 | {
|
| 1625 | struct mount *mnt = v;
|
| 1626 | struct rb_node *node = rb_next(&mnt->mnt_node);
|
| 1627 |
|
| 1628 | if (node) {
|
| 1629 | struct mount *next = node_to_mount(node);
|
| 1630 | *pos = next->mnt_id_unique;
|
| 1631 | return next;
|
| 1632 | }
|
| 1633 |
|
| 1634 | |
| 1635 | * No more mounts. Set pos past current mount's ID so that if
|
| 1636 | * iteration restarts, mnt_find_id_at() returns NULL.
|
| 1637 |
|
| 1638 | *pos = mnt->mnt_id_unique + 1;
|
| 1639 | return NULL;
|
| 1640 | }
|
| 1641 |
|
| 1642 | static void m_stop(struct seq_file *m, void *v)
|
| 1643 | {
|
| 1644 | up_read(&namespace_sem);
|
| 1645 | }
|
| 1646 |
|
| 1647 | static int m_show(struct seq_file *m, void *v)
|
| 1648 | {
|
| 1649 | struct proc_mounts *p = m->private;
|
| 1650 | struct mount *r = v;
|
| 1651 | return p->show(m, &r->mnt);
|
| 1652 | }
|
| 1653 |
|
| 1654 | const struct seq_operations mounts_op = {
|
| 1655 | .start = m_start,
|
| 1656 | .next = m_next,
|
| 1657 | .stop = m_stop,
|
| 1658 | .show = m_show,
|
| 1659 | };
|
| 1660 |
|
| 1661 | #endif
|
| 1662 |
|
| 1663 | |
| 1664 | * may_umount_tree - check if a mount tree is busy
|
| 1665 | * @m: root of mount tree
|
| 1666 | *
|
| 1667 | * This is called to check if a tree of mounts has any
|
| 1668 | * open files, pwds, chroots or sub mounts that are
|
| 1669 | * busy.
|
| 1670 |
|
| 1671 | int may_umount_tree(struct vfsmount *m)
|
| 1672 | {
|
| 1673 | struct mount *mnt = real_mount(m);
|
| 1674 | bool busy = false;
|
| 1675 |
|
| 1676 |
|
| 1677 | lock_mount_hash();
|
| 1678 | for (struct mount *p = mnt; p; p = next_mnt(p, mnt)) {
|
| 1679 | if (mnt_get_count(p) > (p == mnt ? 2 : 1)) {
|
| 1680 | busy = true;
|
| 1681 | break;
|
| 1682 | }
|
| 1683 | }
|
| 1684 | unlock_mount_hash();
|
| 1685 |
|
| 1686 | return !busy;
|
| 1687 | }
|
| 1688 |
|
| 1689 | EXPORT_SYMBOL(may_umount_tree);
|
| 1690 |
|
| 1691 | |
| 1692 | * may_umount - check if a mount point is busy
|
| 1693 | * @mnt: root of mount
|
| 1694 | *
|
| 1695 | * This is called to check if a mount point has any
|
| 1696 | * open files, pwds, chroots or sub mounts. If the
|
| 1697 | * mount has sub mounts this will return busy
|
| 1698 | * regardless of whether the sub mounts are busy.
|
| 1699 | *
|
| 1700 | * Doesn't take quota and stuff into account. IOW, in some cases it will
|
| 1701 | * give false negatives. The main reason why it's here is that we need
|
| 1702 | * a non-destructive way to look for easily umountable filesystems.
|
| 1703 |
|
| 1704 | int may_umount(struct vfsmount *mnt)
|
| 1705 | {
|
| 1706 | int ret = 1;
|
| 1707 | down_read(&namespace_sem);
|
| 1708 | lock_mount_hash();
|
| 1709 | if (propagate_mount_busy(real_mount(mnt), 2))
|
| 1710 | ret = 0;
|
| 1711 | unlock_mount_hash();
|
| 1712 | up_read(&namespace_sem);
|
| 1713 | return ret;
|
| 1714 | }
|
| 1715 |
|
| 1716 | EXPORT_SYMBOL(may_umount);
|
| 1717 |
|
| 1718 | #ifdef CONFIG_FSNOTIFY
|
| 1719 | static void mnt_notify(struct mount *p)
|
| 1720 | {
|
| 1721 | if (!p->prev_ns && p->mnt_ns) {
|
| 1722 | fsnotify_mnt_attach(p->mnt_ns, &p->mnt);
|
| 1723 | } else if (p->prev_ns && !p->mnt_ns) {
|
| 1724 | fsnotify_mnt_detach(p->prev_ns, &p->mnt);
|
| 1725 | } else if (p->prev_ns == p->mnt_ns) {
|
| 1726 | fsnotify_mnt_move(p->mnt_ns, &p->mnt);
|
| 1727 | } else {
|
| 1728 | fsnotify_mnt_detach(p->prev_ns, &p->mnt);
|
| 1729 | fsnotify_mnt_attach(p->mnt_ns, &p->mnt);
|
| 1730 | }
|
| 1731 | p->prev_ns = p->mnt_ns;
|
| 1732 | }
|
| 1733 |
|
| 1734 | static void notify_mnt_list(void)
|
| 1735 | {
|
| 1736 | struct mount *m, *tmp;
|
| 1737 | |
| 1738 | * Notify about mounts that were added/reparented/detached/remain
|
| 1739 | * connected after unmount.
|
| 1740 |
|
| 1741 | list_for_each_entry_safe(m, tmp, ¬ify_list, to_notify) {
|
| 1742 | mnt_notify(m);
|
| 1743 | list_del_init(&m->to_notify);
|
| 1744 | }
|
| 1745 | }
|
| 1746 |
|
| 1747 | static bool need_notify_mnt_list(void)
|
| 1748 | {
|
| 1749 | return !list_empty(¬ify_list);
|
| 1750 | }
|
| 1751 | #else
|
| 1752 | static void notify_mnt_list(void)
|
| 1753 | {
|
| 1754 | }
|
| 1755 |
|
| 1756 | static bool need_notify_mnt_list(void)
|
| 1757 | {
|
| 1758 | return false;
|
| 1759 | }
|
| 1760 | #endif
|
| 1761 |
|
| 1762 | static void free_mnt_ns(struct mnt_namespace *);
|
| 1763 | static void namespace_unlock(void)
|
| 1764 | {
|
| 1765 | struct hlist_head head;
|
| 1766 | struct hlist_node *p;
|
| 1767 | struct mount *m;
|
| 1768 | struct mnt_namespace *ns = emptied_ns;
|
| 1769 | LIST_HEAD(list);
|
| 1770 |
|
| 1771 | hlist_move_list(&unmounted, &head);
|
| 1772 | list_splice_init(&ex_mountpoints, &list);
|
| 1773 | emptied_ns = NULL;
|
| 1774 |
|
| 1775 | if (need_notify_mnt_list()) {
|
| 1776 | |
| 1777 | * No point blocking out concurrent readers while notifications
|
| 1778 | * are sent. This will also allow statmount()/listmount() to run
|
| 1779 | * concurrently.
|
| 1780 |
|
| 1781 | downgrade_write(&namespace_sem);
|
| 1782 | notify_mnt_list();
|
| 1783 | up_read(&namespace_sem);
|
| 1784 | } else {
|
| 1785 | up_write(&namespace_sem);
|
| 1786 | }
|
| 1787 | if (unlikely(ns)) {
|
| 1788 |
|
| 1789 | VFS_WARN_ON_ONCE(!mnt_ns_empty(ns));
|
| 1790 | free_mnt_ns(ns);
|
| 1791 | }
|
| 1792 |
|
| 1793 | shrink_dentry_list(&list);
|
| 1794 |
|
| 1795 | if (likely(hlist_empty(&head)))
|
| 1796 | return;
|
| 1797 |
|
| 1798 | synchronize_rcu_expedited();
|
| 1799 |
|
| 1800 | hlist_for_each_entry_safe(m, p, &head, mnt_umount) {
|
| 1801 | hlist_del(&m->mnt_umount);
|
| 1802 | mntput(&m->mnt);
|
| 1803 | }
|
| 1804 | }
|
| 1805 |
|
| 1806 | static inline void namespace_lock(void)
|
| 1807 | {
|
| 1808 | down_write(&namespace_sem);
|
| 1809 | }
|
| 1810 |
|
| 1811 | enum umount_tree_flags {
|
| 1812 | UMOUNT_SYNC = 1,
|
| 1813 | UMOUNT_PROPAGATE = 2,
|
| 1814 | UMOUNT_COVER = 4,
|
| 1815 | };
|
| 1816 |
|
| 1817 |
|
| 1818 | static bool needs_cover(struct mount *mnt, enum umount_tree_flags how)
|
| 1819 | {
|
| 1820 | if (how & UMOUNT_SYNC)
|
| 1821 | return false;
|
| 1822 | if (!(mnt->mnt_parent->mnt.mnt_flags & MNT_UMOUNT))
|
| 1823 | return false;
|
| 1824 | return (how & UMOUNT_COVER) || IS_MNT_LOCKED(mnt);
|
| 1825 | }
|
| 1826 |
|
| 1827 | |
| 1828 | * mount_lock must be held
|
| 1829 | * namespace_sem must be held for write
|
| 1830 |
|
| 1831 | static void umount_tree(struct mount *mnt, enum umount_tree_flags how)
|
| 1832 | {
|
| 1833 | LIST_HEAD(tmp_list);
|
| 1834 | struct mount *p;
|
| 1835 |
|
| 1836 | if (how & UMOUNT_PROPAGATE)
|
| 1837 | propagate_mount_unlock(mnt);
|
| 1838 |
|
| 1839 |
|
| 1840 | for (p = mnt; p; p = next_mnt(p, mnt)) {
|
| 1841 |
|
| 1842 | VFS_WARN_ON_ONCE(p->mnt.mnt_flags & MNT_UMOUNT);
|
| 1843 | p->mnt.mnt_flags |= MNT_UMOUNT;
|
| 1844 | if (mnt_ns_attached(p))
|
| 1845 | move_from_ns(p);
|
| 1846 | list_add_tail(&p->mnt_list, &tmp_list);
|
| 1847 | }
|
| 1848 |
|
| 1849 |
|
| 1850 | list_for_each_entry(p, &tmp_list, mnt_list) {
|
| 1851 | list_del_init(&p->mnt_child);
|
| 1852 | }
|
| 1853 |
|
| 1854 |
|
| 1855 | if (how & UMOUNT_PROPAGATE)
|
| 1856 | propagate_umount(&tmp_list);
|
| 1857 |
|
| 1858 | bulk_make_private(&tmp_list);
|
| 1859 |
|
| 1860 | while (!list_empty(&tmp_list)) {
|
| 1861 | struct mnt_namespace *ns;
|
| 1862 | p = list_first_entry(&tmp_list, struct mount, mnt_list);
|
| 1863 | list_del_init(&p->mnt_expire);
|
| 1864 | list_del_init(&p->mnt_list);
|
| 1865 | ns = p->mnt_ns;
|
| 1866 | if (ns) {
|
| 1867 | ns->nr_mounts--;
|
| 1868 | __touch_mnt_namespace(ns);
|
| 1869 | }
|
| 1870 | WRITE_ONCE(p->mnt_ns, NULL);
|
| 1871 | if (how & UMOUNT_SYNC)
|
| 1872 | p->mnt.mnt_flags |= MNT_SYNC_UMOUNT;
|
| 1873 |
|
| 1874 | if (mnt_has_parent(p)) {
|
| 1875 | if (needs_cover(p, how))
|
| 1876 | leave_cover(p);
|
| 1877 | umount_mnt(p);
|
| 1878 | }
|
| 1879 | hlist_add_head(&p->mnt_umount, &unmounted);
|
| 1880 |
|
| 1881 | |
| 1882 | * At this point p->mnt_ns is NULL, notification will be queued
|
| 1883 | * only if
|
| 1884 | *
|
| 1885 | * - p->prev_ns is non-NULL *and*
|
| 1886 | * - p->prev_ns->n_fsnotify_marks is non-NULL
|
| 1887 | *
|
| 1888 | * This will preclude queuing the mount if this is a cleanup
|
| 1889 | * after a failed copy_tree() or destruction of an anonymous
|
| 1890 | * namespace, etc.
|
| 1891 |
|
| 1892 | mnt_notify_add(p);
|
| 1893 | }
|
| 1894 | }
|
| 1895 |
|
| 1896 | static void shrink_submounts(struct mount *mnt);
|
| 1897 |
|
| 1898 | static int do_umount_root(struct super_block *sb)
|
| 1899 | {
|
| 1900 | int ret = 0;
|
| 1901 |
|
| 1902 | down_write(&sb->s_umount);
|
| 1903 | if (!sb_rdonly(sb)) {
|
| 1904 | struct fs_context *fc;
|
| 1905 |
|
| 1906 | fc = fs_context_for_reconfigure(sb->s_root, SB_RDONLY,
|
| 1907 | SB_RDONLY);
|
| 1908 | if (IS_ERR(fc)) {
|
| 1909 | ret = PTR_ERR(fc);
|
| 1910 | } else {
|
| 1911 | ret = parse_monolithic_mount_data(fc, NULL);
|
| 1912 | if (!ret)
|
| 1913 | ret = reconfigure_super(fc);
|
| 1914 | put_fs_context(fc);
|
| 1915 | }
|
| 1916 | }
|
| 1917 | up_write(&sb->s_umount);
|
| 1918 | return ret;
|
| 1919 | }
|
| 1920 |
|
| 1921 | static int do_umount(struct mount *mnt, int flags)
|
| 1922 | {
|
| 1923 | struct super_block *sb = mnt->mnt.mnt_sb;
|
| 1924 | int retval;
|
| 1925 |
|
| 1926 | retval = security_sb_umount(&mnt->mnt, flags);
|
| 1927 | if (retval)
|
| 1928 | return retval;
|
| 1929 |
|
| 1930 | |
| 1931 | * Allow userspace to request a mountpoint be expired rather than
|
| 1932 | * unmounting unconditionally. Unmount only happens if:
|
| 1933 | * (1) the mark is already set (the mark is cleared by mntput())
|
| 1934 | * (2) the usage count == 1 [parent vfsmount] + 1 [sys_umount]
|
| 1935 |
|
| 1936 | if (flags & MNT_EXPIRE) {
|
| 1937 | if (&mnt->mnt == current->fs->root.mnt ||
|
| 1938 | flags & (MNT_FORCE | MNT_DETACH))
|
| 1939 | return -EINVAL;
|
| 1940 |
|
| 1941 | |
| 1942 | * probably don't strictly need the lock here if we examined
|
| 1943 | * all race cases, but it's a slowpath.
|
| 1944 |
|
| 1945 | lock_mount_hash();
|
| 1946 | if (!list_empty(&mnt->mnt_mounts) || mnt_get_count(mnt) != 2) {
|
| 1947 | unlock_mount_hash();
|
| 1948 | return -EBUSY;
|
| 1949 | }
|
| 1950 | unlock_mount_hash();
|
| 1951 |
|
| 1952 | if (!xchg(&mnt->mnt_expiry_mark, 1))
|
| 1953 | return -EAGAIN;
|
| 1954 | }
|
| 1955 |
|
| 1956 | |
| 1957 | * If we may have to abort operations to get out of this
|
| 1958 | * mount, and they will themselves hold resources we must
|
| 1959 | * allow the fs to do things. In the Unix tradition of
|
| 1960 | * 'Gee thats tricky lets do it in userspace' the umount_begin
|
| 1961 | * might fail to complete on the first run through as other tasks
|
| 1962 | * must return, and the like. Thats for the mount program to worry
|
| 1963 | * about for the moment.
|
| 1964 |
|
| 1965 |
|
| 1966 | if (flags & MNT_FORCE && sb->s_op->umount_begin) {
|
| 1967 | sb->s_op->umount_begin(sb);
|
| 1968 | }
|
| 1969 |
|
| 1970 | |
| 1971 | * No sense to grab the lock for this test, but test itself looks
|
| 1972 | * somewhat bogus. Suggestions for better replacement?
|
| 1973 | * Ho-hum... In principle, we might treat that as umount + switch
|
| 1974 | * to rootfs. GC would eventually take care of the old vfsmount.
|
| 1975 | * Actually it makes sense, especially if rootfs would contain a
|
| 1976 | * /reboot - static binary that would close all descriptors and
|
| 1977 | * call reboot(9). Then init(8) could umount root and exec /reboot.
|
| 1978 |
|
| 1979 | if (&mnt->mnt == current->fs->root.mnt && !(flags & MNT_DETACH)) {
|
| 1980 | |
| 1981 | * Special case for "unmounting" root ...
|
| 1982 | * we just try to remount it readonly.
|
| 1983 |
|
| 1984 | if (!ns_capable(sb->s_user_ns, CAP_SYS_ADMIN))
|
| 1985 | return -EPERM;
|
| 1986 | return do_umount_root(sb);
|
| 1987 | }
|
| 1988 |
|
| 1989 | namespace_lock();
|
| 1990 | lock_mount_hash();
|
| 1991 |
|
| 1992 |
|
| 1993 | retval = -EINVAL;
|
| 1994 | if (!check_mnt(mnt))
|
| 1995 | goto out;
|
| 1996 |
|
| 1997 | if (mnt->mnt.mnt_flags & MNT_LOCKED)
|
| 1998 | goto out;
|
| 1999 |
|
| 2000 | if (!mnt_has_parent(mnt))
|
| 2001 | goto out;
|
| 2002 |
|
| 2003 | event++;
|
| 2004 | if (flags & MNT_DETACH) {
|
| 2005 | umount_tree(mnt, UMOUNT_PROPAGATE);
|
| 2006 | retval = 0;
|
| 2007 | } else {
|
| 2008 | shrink_submounts(mnt);
|
| 2009 | retval = -EBUSY;
|
| 2010 | if (!propagate_mount_busy(mnt, 2)) {
|
| 2011 | umount_tree(mnt, UMOUNT_PROPAGATE|UMOUNT_SYNC);
|
| 2012 | retval = 0;
|
| 2013 | }
|
| 2014 | }
|
| 2015 | out:
|
| 2016 | unlock_mount_hash();
|
| 2017 | namespace_unlock();
|
| 2018 | return retval;
|
| 2019 | }
|
| 2020 |
|
| 2021 | |
| 2022 | * __detach_mounts - lazily unmount all mounts on the specified dentry
|
| 2023 | *
|
| 2024 | * During unlink, rmdir, and d_drop it is possible to loose the path
|
| 2025 | * to an existing mountpoint, and wind up leaking the mount.
|
| 2026 | * detach_mounts allows lazily unmounting those mounts instead of
|
| 2027 | * leaking them.
|
| 2028 | *
|
| 2029 | * The dentry is unhashed before the mounts go so that no lookup finds
|
| 2030 | * what they covered. The caller removes it for good afterwards.
|
| 2031 | *
|
| 2032 | * The caller may hold dentry->d_inode->i_rwsem.
|
| 2033 |
|
| 2034 | void __detach_mounts(struct dentry *dentry)
|
| 2035 | {
|
| 2036 | struct pinned_mountpoint mp = {};
|
| 2037 | struct mnt_cover *cover;
|
| 2038 | struct hlist_node *n;
|
| 2039 | struct mount *mnt;
|
| 2040 |
|
| 2041 | guard(namespace_excl)();
|
| 2042 | guard(mount_writer)();
|
| 2043 |
|
| 2044 | if (!lookup_mountpoint(dentry, &mp))
|
| 2045 | return;
|
| 2046 |
|
| 2047 |
|
| 2048 | d_drop(dentry);
|
| 2049 | event++;
|
| 2050 | while (mp.node.next) {
|
| 2051 | mnt = hlist_entry(mp.node.next, struct mount, mnt_mp_list);
|
| 2052 | umount_tree(mnt, UMOUNT_COVER);
|
| 2053 | }
|
| 2054 |
|
| 2055 | hlist_for_each_entry_safe(cover, n, &mp.mp->m_covers, pin)
|
| 2056 | drop_cover(cover, &ex_mountpoints);
|
| 2057 | unpin_mountpoint(&mp);
|
| 2058 | }
|
| 2059 |
|
| 2060 | |
| 2061 | * Is the caller allowed to modify his namespace?
|
| 2062 |
|
| 2063 | bool may_mount(void)
|
| 2064 | {
|
| 2065 | return ns_capable(current->nsproxy->mnt_ns->user_ns, CAP_SYS_ADMIN);
|
| 2066 | }
|
| 2067 |
|
| 2068 | static void warn_mandlock(void)
|
| 2069 | {
|
| 2070 | pr_warn_once("=======================================================\n"
|
| 2071 | "WARNING: The mand mount option has been deprecated and\n"
|
| 2072 | " and is ignored by this kernel. Remove the mand\n"
|
| 2073 | " option from the mount to silence this warning.\n"
|
| 2074 | "=======================================================\n");
|
| 2075 | }
|
| 2076 |
|
| 2077 | static int can_umount(const struct path *path, int flags)
|
| 2078 | {
|
| 2079 | struct mount *mnt = real_mount(path->mnt);
|
| 2080 | struct super_block *sb = path->dentry->d_sb;
|
| 2081 |
|
| 2082 | if (!may_mount())
|
| 2083 | return -EPERM;
|
| 2084 | if (!path_mounted(path))
|
| 2085 | return -EINVAL;
|
| 2086 | if (!check_mnt(mnt))
|
| 2087 | return -EINVAL;
|
| 2088 | if (mnt->mnt.mnt_flags & MNT_LOCKED)
|
| 2089 | return -EINVAL;
|
| 2090 | if (flags & MNT_FORCE && !ns_capable(sb->s_user_ns, CAP_SYS_ADMIN))
|
| 2091 | return -EPERM;
|
| 2092 | return 0;
|
| 2093 | }
|
| 2094 |
|
| 2095 | |
| 2096 | int path_umount(const struct path *path, int flags)
|
| 2097 | {
|
| 2098 | struct mount *mnt = real_mount(path->mnt);
|
| 2099 | int ret;
|
| 2100 |
|
| 2101 | ret = can_umount(path, flags);
|
| 2102 | if (!ret)
|
| 2103 | ret = do_umount(mnt, flags);
|
| 2104 |
|
| 2105 |
|
| 2106 | dput(path->dentry);
|
| 2107 | mntput_no_expire(mnt);
|
| 2108 | return ret;
|
| 2109 | }
|
| 2110 |
|
| 2111 | static int ksys_umount(char __user *name, int flags)
|
| 2112 | {
|
| 2113 | int lookup_flags = LOOKUP_MOUNTPOINT;
|
| 2114 | struct path path;
|
| 2115 | int ret;
|
| 2116 |
|
| 2117 | |
| 2118 | if (flags & ~(MNT_FORCE | MNT_DETACH | MNT_EXPIRE | UMOUNT_NOFOLLOW))
|
| 2119 | return -EINVAL;
|
| 2120 |
|
| 2121 | if (!(flags & UMOUNT_NOFOLLOW))
|
| 2122 | lookup_flags |= LOOKUP_FOLLOW;
|
| 2123 | ret = user_path_at(AT_FDCWD, name, lookup_flags, &path);
|
| 2124 | if (ret)
|
| 2125 | return ret;
|
| 2126 | return path_umount(&path, flags);
|
| 2127 | }
|
| 2128 |
|
| 2129 | SYSCALL_DEFINE2(umount, char __user *, name, int, flags)
|
| 2130 | {
|
| 2131 | return ksys_umount(name, flags);
|
| 2132 | }
|
| 2133 |
|
| 2134 | #ifdef __ARCH_WANT_SYS_OLDUMOUNT
|
| 2135 |
|
| 2136 | |
| 2137 | * The 2.0 compatible umount. No flags.
|
| 2138 |
|
| 2139 | SYSCALL_DEFINE1(oldumount, char __user *, name)
|
| 2140 | {
|
| 2141 | return ksys_umount(name, 0);
|
| 2142 | }
|
| 2143 |
|
| 2144 | #endif
|
| 2145 |
|
| 2146 | static bool is_mnt_ns_file(struct dentry *dentry)
|
| 2147 | {
|
| 2148 | struct ns_common *ns;
|
| 2149 |
|
| 2150 |
|
| 2151 | if (dentry->d_op != &ns_dentry_operations)
|
| 2152 | return false;
|
| 2153 |
|
| 2154 | ns = d_inode(dentry)->i_private;
|
| 2155 |
|
| 2156 | return ns->ops == &mntns_operations;
|
| 2157 | }
|
| 2158 |
|
| 2159 | struct ns_common *from_mnt_ns(struct mnt_namespace *mnt)
|
| 2160 | {
|
| 2161 | return &mnt->ns;
|
| 2162 | }
|
| 2163 |
|
| 2164 | struct mnt_namespace *get_sequential_mnt_ns(struct mnt_namespace *mntns, bool previous)
|
| 2165 | {
|
| 2166 | struct ns_common *ns;
|
| 2167 |
|
| 2168 | guard(rcu)();
|
| 2169 |
|
| 2170 | for (;;) {
|
| 2171 | ns = ns_tree_adjoined_rcu(mntns, previous);
|
| 2172 | if (IS_ERR(ns))
|
| 2173 | return ERR_CAST(ns);
|
| 2174 |
|
| 2175 | mntns = to_mnt_ns(ns);
|
| 2176 |
|
| 2177 | |
| 2178 | * The last passive reference count is put with RCU
|
| 2179 | * delay so accessing the mount namespace is not just
|
| 2180 | * safe but all relevant members are still valid.
|
| 2181 |
|
| 2182 | if (!ns_capable_noaudit(mntns->user_ns, CAP_SYS_ADMIN))
|
| 2183 | continue;
|
| 2184 |
|
| 2185 | |
| 2186 | * We need an active reference count as we're persisting
|
| 2187 | * the mount namespace and it might already be on its
|
| 2188 | * deathbed.
|
| 2189 |
|
| 2190 | if (!ns_ref_get(mntns))
|
| 2191 | continue;
|
| 2192 |
|
| 2193 | return mntns;
|
| 2194 | }
|
| 2195 | }
|
| 2196 |
|
| 2197 | struct mnt_namespace *mnt_ns_from_dentry(struct dentry *dentry)
|
| 2198 | {
|
| 2199 | if (!is_mnt_ns_file(dentry))
|
| 2200 | return NULL;
|
| 2201 |
|
| 2202 | return to_mnt_ns(get_proc_ns(dentry->d_inode));
|
| 2203 | }
|
| 2204 |
|
| 2205 | static bool mnt_ns_loop(struct dentry *dentry)
|
| 2206 | {
|
| 2207 | |
| 2208 | * mount namespace loop?
|
| 2209 |
|
| 2210 | struct mnt_namespace *mnt_ns = mnt_ns_from_dentry(dentry);
|
| 2211 |
|
| 2212 | if (!mnt_ns)
|
| 2213 | return false;
|
| 2214 |
|
| 2215 | return current->nsproxy->mnt_ns->ns.ns_id >= mnt_ns->ns.ns_id;
|
| 2216 | }
|
| 2217 |
|
| 2218 | struct mount *copy_tree(struct mount *src_root, struct dentry *dentry,
|
| 2219 | int flag)
|
| 2220 | {
|
| 2221 | struct mount *res, *src_parent, *src_root_child, *src_mnt,
|
| 2222 | *dst_parent, *dst_mnt;
|
| 2223 |
|
| 2224 | if (!(flag & CL_COPY_UNBINDABLE) && IS_MNT_UNBINDABLE(src_root))
|
| 2225 | return ERR_PTR(-EINVAL);
|
| 2226 |
|
| 2227 | if (!(flag & CL_COPY_MNT_NS_FILE) && is_mnt_ns_file(dentry))
|
| 2228 | return ERR_PTR(-EINVAL);
|
| 2229 |
|
| 2230 | res = dst_mnt = clone_mnt(src_root, dentry, flag);
|
| 2231 | if (IS_ERR(dst_mnt))
|
| 2232 | return dst_mnt;
|
| 2233 |
|
| 2234 | src_parent = src_root;
|
| 2235 |
|
| 2236 | list_for_each_entry(src_root_child, &src_root->mnt_mounts, mnt_child) {
|
| 2237 | if (!is_subdir(src_root_child->mnt_mountpoint, dentry))
|
| 2238 | continue;
|
| 2239 |
|
| 2240 | for (src_mnt = src_root_child; src_mnt;
|
| 2241 | src_mnt = next_mnt(src_mnt, src_root_child)) {
|
| 2242 | if (!(flag & CL_COPY_UNBINDABLE) &&
|
| 2243 | IS_MNT_UNBINDABLE(src_mnt)) {
|
| 2244 | if (src_mnt->mnt.mnt_flags & MNT_LOCKED) {
|
| 2245 |
|
| 2246 | dst_mnt = ERR_PTR(-EPERM);
|
| 2247 | goto out;
|
| 2248 | } else {
|
| 2249 | src_mnt = skip_mnt_tree(src_mnt);
|
| 2250 | continue;
|
| 2251 | }
|
| 2252 | }
|
| 2253 | if (!(flag & CL_COPY_MNT_NS_FILE) &&
|
| 2254 | is_mnt_ns_file(src_mnt->mnt.mnt_root)) {
|
| 2255 | if (src_mnt->mnt.mnt_flags & MNT_LOCKED) {
|
| 2256 |
|
| 2257 | dst_mnt = ERR_PTR(-EPERM);
|
| 2258 | goto out;
|
| 2259 | }
|
| 2260 | src_mnt = skip_mnt_tree(src_mnt);
|
| 2261 | continue;
|
| 2262 | }
|
| 2263 | while (src_parent != src_mnt->mnt_parent) {
|
| 2264 | src_parent = src_parent->mnt_parent;
|
| 2265 | dst_mnt = dst_mnt->mnt_parent;
|
| 2266 | }
|
| 2267 |
|
| 2268 | src_parent = src_mnt;
|
| 2269 | dst_parent = dst_mnt;
|
| 2270 | dst_mnt = clone_mnt(src_mnt, src_mnt->mnt.mnt_root, flag);
|
| 2271 | if (IS_ERR(dst_mnt))
|
| 2272 | goto out;
|
| 2273 | lock_mount_hash();
|
| 2274 | if (src_mnt->mnt.mnt_flags & MNT_LOCKED)
|
| 2275 | dst_mnt->mnt.mnt_flags |= MNT_LOCKED;
|
| 2276 | if (unlikely(flag & CL_EXPIRE)) {
|
| 2277 | |
| 2278 | * list as the original if that was on one
|
| 2279 | if (!list_empty(&src_mnt->mnt_expire))
|
| 2280 | list_add(&dst_mnt->mnt_expire,
|
| 2281 | &src_mnt->mnt_expire);
|
| 2282 | }
|
| 2283 | attach_mnt(dst_mnt, dst_parent, src_parent->mnt_mp);
|
| 2284 | unlock_mount_hash();
|
| 2285 | }
|
| 2286 | }
|
| 2287 | return res;
|
| 2288 |
|
| 2289 | out:
|
| 2290 | if (res) {
|
| 2291 | lock_mount_hash();
|
| 2292 | umount_tree(res, UMOUNT_SYNC);
|
| 2293 | unlock_mount_hash();
|
| 2294 | }
|
| 2295 | return dst_mnt;
|
| 2296 | }
|
| 2297 |
|
| 2298 | static inline bool extend_array(struct path **res, struct path **to_free,
|
| 2299 | unsigned n, unsigned *count, unsigned new_count)
|
| 2300 | {
|
| 2301 | struct path *p;
|
| 2302 |
|
| 2303 | if (likely(n < *count))
|
| 2304 | return true;
|
| 2305 | p = kmalloc_objs(struct path, new_count);
|
| 2306 | if (p && *count)
|
| 2307 | memcpy(p, *res, *count * sizeof(struct path));
|
| 2308 | *count = new_count;
|
| 2309 | kfree(*to_free);
|
| 2310 | *to_free = *res = p;
|
| 2311 | return p;
|
| 2312 | }
|
| 2313 |
|
| 2314 | const struct path *collect_paths(const struct path *path,
|
| 2315 | struct path *prealloc, unsigned count)
|
| 2316 | {
|
| 2317 | struct mount *root = real_mount(path->mnt);
|
| 2318 | struct mount *child;
|
| 2319 | struct path *res = prealloc, *to_free = NULL;
|
| 2320 | unsigned n = 0;
|
| 2321 |
|
| 2322 | guard(namespace_shared)();
|
| 2323 |
|
| 2324 | if (!check_mnt(root))
|
| 2325 | return ERR_PTR(-EINVAL);
|
| 2326 | if (!extend_array(&res, &to_free, 0, &count, 32))
|
| 2327 | return ERR_PTR(-ENOMEM);
|
| 2328 | res[n++] = *path;
|
| 2329 | list_for_each_entry(child, &root->mnt_mounts, mnt_child) {
|
| 2330 | if (!is_subdir(child->mnt_mountpoint, path->dentry))
|
| 2331 | continue;
|
| 2332 | for (struct mount *m = child; m; m = next_mnt(m, child)) {
|
| 2333 | if (!extend_array(&res, &to_free, n, &count, 2 * count))
|
| 2334 | return ERR_PTR(-ENOMEM);
|
| 2335 | res[n].mnt = &m->mnt;
|
| 2336 | res[n].dentry = m->mnt.mnt_root;
|
| 2337 | n++;
|
| 2338 | }
|
| 2339 | }
|
| 2340 | if (!extend_array(&res, &to_free, n, &count, count + 1))
|
| 2341 | return ERR_PTR(-ENOMEM);
|
| 2342 | memset(res + n, 0, (count - n) * sizeof(struct path));
|
| 2343 | for (struct path *p = res; p->mnt; p++)
|
| 2344 | path_get(p);
|
| 2345 | return res;
|
| 2346 | }
|
| 2347 |
|
| 2348 | void drop_collected_paths(const struct path *paths, const struct path *prealloc)
|
| 2349 | {
|
| 2350 | for (const struct path *p = paths; p->mnt; p++)
|
| 2351 | path_put(p);
|
| 2352 | if (paths != prealloc)
|
| 2353 | kfree(paths);
|
| 2354 | }
|
| 2355 |
|
| 2356 | static struct mnt_namespace *alloc_mnt_ns(struct user_namespace *, bool);
|
| 2357 |
|
| 2358 |
|
| 2359 | void dissolve_on_fput(struct vfsmount *mnt)
|
| 2360 | {
|
| 2361 | struct vfsmount *p __free(mntput) = mnt;
|
| 2362 | struct mount *m = real_mount(p);
|
| 2363 |
|
| 2364 | |
| 2365 | * m used to be the root of anon namespace; if it still is one,
|
| 2366 | * we need to dissolve the mount tree and free that namespace.
|
| 2367 | * Let's try to avoid taking namespace_sem if we can determine
|
| 2368 | * that there's nothing to do without it - rcu_read_lock() is
|
| 2369 | * enough to make anon_ns_root() memory-safe and once m has
|
| 2370 | * left its namespace, it's no longer our concern, since it will
|
| 2371 | * never become a root of anon ns again.
|
| 2372 |
|
| 2373 |
|
| 2374 | scoped_guard(rcu) {
|
| 2375 | if (!anon_ns_root(m))
|
| 2376 | return;
|
| 2377 | }
|
| 2378 |
|
| 2379 | scoped_guard(namespace_excl) {
|
| 2380 | if (!anon_ns_root(m))
|
| 2381 | return;
|
| 2382 |
|
| 2383 | emptied_ns = m->mnt_ns;
|
| 2384 | lock_mount_hash();
|
| 2385 | umount_tree(m, UMOUNT_COVER);
|
| 2386 | unlock_mount_hash();
|
| 2387 | mntput(no_free_ptr(p));
|
| 2388 | }
|
| 2389 | }
|
| 2390 |
|
| 2391 |
|
| 2392 | bool has_locked_children(struct mount *mnt, struct dentry *dentry)
|
| 2393 | {
|
| 2394 | struct mount *child;
|
| 2395 |
|
| 2396 | list_for_each_entry(child, &mnt->mnt_mounts, mnt_child) {
|
| 2397 | if (!is_subdir(child->mnt_mountpoint, dentry))
|
| 2398 | continue;
|
| 2399 |
|
| 2400 | if (child->mnt.mnt_flags & MNT_LOCKED)
|
| 2401 | return true;
|
| 2402 | }
|
| 2403 | return false;
|
| 2404 | }
|
| 2405 |
|
| 2406 |
|
| 2407 | static bool __has_children(struct mount *mnt, struct dentry *dentry)
|
| 2408 | {
|
| 2409 | struct mount *child;
|
| 2410 |
|
| 2411 | list_for_each_entry(child, &mnt->mnt_mounts, mnt_child) {
|
| 2412 | if (is_subdir(child->mnt_mountpoint, dentry))
|
| 2413 | return true;
|
| 2414 | }
|
| 2415 | return false;
|
| 2416 | }
|
| 2417 |
|
| 2418 | |
| 2419 | * Check that there aren't references to earlier/same mount namespaces in the
|
| 2420 | * specified subtree. Such references can act as pins for mount namespaces
|
| 2421 | * that aren't checked by the mount-cycle checking code, thereby allowing
|
| 2422 | * cycles to be made.
|
| 2423 | *
|
| 2424 | * locks: mount_locked_reader || namespace_shared && pinned(subtree)
|
| 2425 |
|
| 2426 | static bool check_for_nsfs_mounts(struct mount *subtree)
|
| 2427 | {
|
| 2428 | for (struct mount *p = subtree; p; p = next_mnt(p, subtree))
|
| 2429 | if (mnt_ns_loop(p->mnt.mnt_root))
|
| 2430 | return false;
|
| 2431 | return true;
|
| 2432 | }
|
| 2433 |
|
| 2434 | |
| 2435 | * clone_private_mount - create a private clone of a path
|
| 2436 | * @path: path to clone
|
| 2437 | *
|
| 2438 | * This creates a new vfsmount, which will be the clone of @path. The new mount
|
| 2439 | * will not be attached anywhere in the namespace and will be private (i.e.
|
| 2440 | * changes to the originating mount won't be propagated into this).
|
| 2441 | *
|
| 2442 | * This assumes caller has called or done the equivalent of may_mount().
|
| 2443 | *
|
| 2444 | * Release with mntput().
|
| 2445 |
|
| 2446 | struct vfsmount *clone_private_mount(const struct path *path)
|
| 2447 | {
|
| 2448 | struct mount *old_mnt = real_mount(path->mnt);
|
| 2449 | struct mount *new_mnt;
|
| 2450 |
|
| 2451 | guard(namespace_shared)();
|
| 2452 |
|
| 2453 | if (IS_MNT_UNBINDABLE(old_mnt))
|
| 2454 | return ERR_PTR(-EINVAL);
|
| 2455 |
|
| 2456 | |
| 2457 | * Make sure the source mount is acceptable.
|
| 2458 | * Anything mounted in our mount namespace is allowed.
|
| 2459 | * Otherwise, it must be the root of an anonymous mount
|
| 2460 | * namespace, and we need to make sure no namespace
|
| 2461 | * loops get created.
|
| 2462 |
|
| 2463 | if (!check_mnt(old_mnt)) {
|
| 2464 | if (!anon_ns_root(old_mnt))
|
| 2465 | return ERR_PTR(-EINVAL);
|
| 2466 |
|
| 2467 | if (!check_for_nsfs_mounts(old_mnt))
|
| 2468 | return ERR_PTR(-EINVAL);
|
| 2469 | }
|
| 2470 |
|
| 2471 | if (!ns_capable(old_mnt->mnt_ns->user_ns, CAP_SYS_ADMIN))
|
| 2472 | return ERR_PTR(-EPERM);
|
| 2473 |
|
| 2474 | if (has_locked_children(old_mnt, path->dentry))
|
| 2475 | return ERR_PTR(-EINVAL);
|
| 2476 |
|
| 2477 | new_mnt = clone_mnt(old_mnt, path->dentry, CL_PRIVATE);
|
| 2478 | if (IS_ERR(new_mnt))
|
| 2479 | return ERR_PTR(-EINVAL);
|
| 2480 |
|
| 2481 |
|
| 2482 | new_mnt->mnt_ns = MNT_NS_INTERNAL;
|
| 2483 | return &new_mnt->mnt;
|
| 2484 | }
|
| 2485 | EXPORT_SYMBOL_GPL(clone_private_mount);
|
| 2486 |
|
| 2487 | static void lock_mnt_tree(struct mount *mnt)
|
| 2488 | {
|
| 2489 | struct mount *p;
|
| 2490 |
|
| 2491 | for (p = mnt; p; p = next_mnt(p, mnt)) {
|
| 2492 | int flags = p->mnt.mnt_flags;
|
| 2493 |
|
| 2494 | flags |= MNT_LOCK_ATIME;
|
| 2495 |
|
| 2496 | if (flags & MNT_READONLY)
|
| 2497 | flags |= MNT_LOCK_READONLY;
|
| 2498 |
|
| 2499 | if (flags & MNT_NODEV)
|
| 2500 | flags |= MNT_LOCK_NODEV;
|
| 2501 |
|
| 2502 | if (flags & MNT_NOSUID)
|
| 2503 | flags |= MNT_LOCK_NOSUID;
|
| 2504 |
|
| 2505 | if (flags & MNT_NOEXEC)
|
| 2506 | flags |= MNT_LOCK_NOEXEC;
|
| 2507 |
|
| 2508 | if (list_empty(&p->mnt_expire) && p != mnt)
|
| 2509 | flags |= MNT_LOCKED;
|
| 2510 | p->mnt.mnt_flags = flags;
|
| 2511 | }
|
| 2512 | }
|
| 2513 |
|
| 2514 | static void cleanup_group_ids(struct mount *mnt, struct mount *end)
|
| 2515 | {
|
| 2516 | struct mount *p;
|
| 2517 |
|
| 2518 | for (p = mnt; p != end; p = next_mnt(p, mnt)) {
|
| 2519 | if (p->mnt_group_id && !IS_MNT_SHARED(p))
|
| 2520 | mnt_release_group_id(p);
|
| 2521 | }
|
| 2522 | }
|
| 2523 |
|
| 2524 | static int invent_group_ids(struct mount *mnt, bool recurse)
|
| 2525 | {
|
| 2526 | struct mount *p;
|
| 2527 |
|
| 2528 | for (p = mnt; p; p = recurse ? next_mnt(p, mnt) : NULL) {
|
| 2529 | if (!p->mnt_group_id) {
|
| 2530 | int err = mnt_alloc_group_id(p);
|
| 2531 | if (err) {
|
| 2532 | cleanup_group_ids(mnt, p);
|
| 2533 | return err;
|
| 2534 | }
|
| 2535 | }
|
| 2536 | }
|
| 2537 |
|
| 2538 | return 0;
|
| 2539 | }
|
| 2540 |
|
| 2541 | int count_mounts(struct mnt_namespace *ns, struct mount *mnt)
|
| 2542 | {
|
| 2543 | unsigned int max = READ_ONCE(sysctl_mount_max);
|
| 2544 | unsigned int mounts = 0;
|
| 2545 | struct mount *p;
|
| 2546 |
|
| 2547 | if (ns->nr_mounts >= max)
|
| 2548 | return -ENOSPC;
|
| 2549 | max -= ns->nr_mounts;
|
| 2550 | if (ns->pending_mounts >= max)
|
| 2551 | return -ENOSPC;
|
| 2552 | max -= ns->pending_mounts;
|
| 2553 |
|
| 2554 | for (p = mnt; p; p = next_mnt(p, mnt))
|
| 2555 | mounts++;
|
| 2556 |
|
| 2557 | if (mounts > max)
|
| 2558 | return -ENOSPC;
|
| 2559 |
|
| 2560 | ns->pending_mounts += mounts;
|
| 2561 | return 0;
|
| 2562 | }
|
| 2563 |
|
| 2564 | enum mnt_tree_flags_t {
|
| 2565 | MNT_TREE_BENEATH = BIT(0),
|
| 2566 | MNT_TREE_PROPAGATION = BIT(1),
|
| 2567 | };
|
| 2568 |
|
| 2569 | |
| 2570 | * attach_recursive_mnt - attach a source mount tree
|
| 2571 | * @source_mnt: mount tree to be attached
|
| 2572 | * @dest: the context for mounting at the place where the tree should go
|
| 2573 | *
|
| 2574 | * NOTE: in the table below explains the semantics when a source mount
|
| 2575 | * of a given type is attached to a destination mount of a given type.
|
| 2576 | * ---------------------------------------------------------------------------
|
| 2577 | * | BIND MOUNT OPERATION |
|
| 2578 | * |**************************************************************************
|
| 2579 | * | source-->| shared | private | slave | unbindable |
|
| 2580 | * | dest | | | | |
|
| 2581 | * | | | | | | |
|
| 2582 | * | v | | | | |
|
| 2583 | * |**************************************************************************
|
| 2584 | * | shared | shared (++) | shared (+) | shared(+++)| invalid |
|
| 2585 | * | | | | | |
|
| 2586 | * |non-shared| shared (+) | private | slave (*) | invalid |
|
| 2587 | * ***************************************************************************
|
| 2588 | * A bind operation clones the source mount and mounts the clone on the
|
| 2589 | * destination mount.
|
| 2590 | *
|
| 2591 | * (++) the cloned mount is propagated to all the mounts in the propagation
|
| 2592 | * tree of the destination mount and the cloned mount is added to
|
| 2593 | * the peer group of the source mount.
|
| 2594 | * (+) the cloned mount is created under the destination mount and is marked
|
| 2595 | * as shared. The cloned mount is added to the peer group of the source
|
| 2596 | * mount.
|
| 2597 | * (+++) the mount is propagated to all the mounts in the propagation tree
|
| 2598 | * of the destination mount and the cloned mount is made slave
|
| 2599 | * of the same master as that of the source mount. The cloned mount
|
| 2600 | * is marked as 'shared and slave'.
|
| 2601 | * (*) the cloned mount is made a slave of the same master as that of the
|
| 2602 | * source mount.
|
| 2603 | *
|
| 2604 | * ---------------------------------------------------------------------------
|
| 2605 | * | MOVE MOUNT OPERATION |
|
| 2606 | * |**************************************************************************
|
| 2607 | * | source-->| shared | private | slave | unbindable |
|
| 2608 | * | dest | | | | |
|
| 2609 | * | | | | | | |
|
| 2610 | * | v | | | | |
|
| 2611 | * |**************************************************************************
|
| 2612 | * | shared | shared (+) | shared (+) | shared(+++) | invalid |
|
| 2613 | * | | | | | |
|
| 2614 | * |non-shared| shared (+*) | private | slave (*) | unbindable |
|
| 2615 | * ***************************************************************************
|
| 2616 | *
|
| 2617 | * (+) the mount is moved to the destination. And is then propagated to
|
| 2618 | * all the mounts in the propagation tree of the destination mount.
|
| 2619 | * (+*) the mount is moved to the destination.
|
| 2620 | * (+++) the mount is moved to the destination and is then propagated to
|
| 2621 | * all the mounts belonging to the destination mount's propagation tree.
|
| 2622 | * the mount is marked as 'shared and slave'.
|
| 2623 | * (*) the mount continues to be a slave at the new location.
|
| 2624 | *
|
| 2625 | * if the source mount is a tree, the operations explained above is
|
| 2626 | * applied to each mount in the tree.
|
| 2627 | * Must be called without spinlocks held, since this function can sleep
|
| 2628 | * in allocations.
|
| 2629 | *
|
| 2630 | * Context: The function expects namespace_lock() to be held.
|
| 2631 | * Return: If @source_mnt was successfully attached 0 is returned.
|
| 2632 | * Otherwise a negative error code is returned.
|
| 2633 |
|
| 2634 | static int attach_recursive_mnt(struct mount *source_mnt,
|
| 2635 | const struct pinned_mountpoint *dest)
|
| 2636 | {
|
| 2637 | struct mount *dest_mnt = dest->parent;
|
| 2638 | struct mountpoint *dest_mp = dest->mp;
|
| 2639 | HLIST_HEAD(tree_list);
|
| 2640 | struct mnt_namespace *ns = dest_mnt->mnt_ns;
|
| 2641 | struct user_namespace *user_ns = ns->user_ns;
|
| 2642 | struct pinned_mountpoint root = {};
|
| 2643 | struct mountpoint *shorter = NULL;
|
| 2644 | struct mount *child, *p;
|
| 2645 | struct mount *top;
|
| 2646 | struct hlist_node *n;
|
| 2647 | int err = 0;
|
| 2648 | bool moving = mnt_has_parent(source_mnt);
|
| 2649 |
|
| 2650 | |
| 2651 | * A caller in an unprivileged mount namespaces may trigger an
|
| 2652 | * automount and propagate locked mounts into privileged mount
|
| 2653 | * namespaces. Take ownership from the target mount namespace.
|
| 2654 | * It's equivalent for everything but the automount case.
|
| 2655 | *
|
| 2656 | * Detached trees in anonymous mount namespaces by be handed
|
| 2657 | * over via SCM_RIGHTS or inherited in other ways on purpose
|
| 2658 | * the attaching task's mount namespace is authoritative, not
|
| 2659 | * the creator of the detached tree.
|
| 2660 |
|
| 2661 | if (is_anon_ns(ns))
|
| 2662 | user_ns = current->nsproxy->mnt_ns->user_ns;
|
| 2663 | else
|
| 2664 | user_ns = ns->user_ns;
|
| 2665 |
|
| 2666 | |
| 2667 | * Preallocate a mountpoint in case the new mounts need to be
|
| 2668 | * mounted beneath mounts on the same mountpoint.
|
| 2669 |
|
| 2670 | for (top = source_mnt; ; top = top->overmount) {
|
| 2671 | if (!shorter && is_mnt_ns_file(top->mnt.mnt_root))
|
| 2672 | shorter = top->mnt_mp;
|
| 2673 | if (likely(!top->overmount))
|
| 2674 | break;
|
| 2675 | }
|
| 2676 | err = get_mountpoint(top->mnt.mnt_root, &root);
|
| 2677 | if (err)
|
| 2678 | return err;
|
| 2679 |
|
| 2680 |
|
| 2681 | if (!moving) {
|
| 2682 | err = count_mounts(ns, source_mnt);
|
| 2683 | if (err)
|
| 2684 | goto out;
|
| 2685 | }
|
| 2686 |
|
| 2687 | if (IS_MNT_SHARED(dest_mnt)) {
|
| 2688 | err = invent_group_ids(source_mnt, true);
|
| 2689 | if (err)
|
| 2690 | goto out;
|
| 2691 | err = propagate_mnt(dest_mnt, dest_mp, source_mnt, &tree_list);
|
| 2692 | }
|
| 2693 | lock_mount_hash();
|
| 2694 | if (err)
|
| 2695 | goto out_cleanup_ids;
|
| 2696 |
|
| 2697 | if (IS_MNT_SHARED(dest_mnt)) {
|
| 2698 | for (p = source_mnt; p; p = next_mnt(p, source_mnt))
|
| 2699 | set_mnt_shared(p);
|
| 2700 | }
|
| 2701 |
|
| 2702 | if (moving) {
|
| 2703 | umount_mnt(source_mnt);
|
| 2704 | mnt_notify_add(source_mnt);
|
| 2705 | |
| 2706 | * automatically
|
| 2707 | list_del_init(&source_mnt->mnt_expire);
|
| 2708 | } else {
|
| 2709 | if (source_mnt->mnt_ns) {
|
| 2710 |
|
| 2711 | emptied_ns = source_mnt->mnt_ns;
|
| 2712 | for (p = source_mnt; p; p = next_mnt(p, source_mnt))
|
| 2713 | move_from_ns(p);
|
| 2714 | }
|
| 2715 | }
|
| 2716 |
|
| 2717 | mnt_set_mountpoint(dest_mnt, dest_mp, source_mnt);
|
| 2718 | |
| 2719 | * Now the original copy is in the same state as the secondaries -
|
| 2720 | * its root attached to mountpoint, but not hashed and all mounts
|
| 2721 | * in it are either in our namespace or in no namespace at all.
|
| 2722 | * Add the original to the list of copies and deal with the
|
| 2723 | * rest of work for all of them uniformly.
|
| 2724 |
|
| 2725 | hlist_add_head(&source_mnt->mnt_hash, &tree_list);
|
| 2726 |
|
| 2727 | hlist_for_each_entry_safe(child, n, &tree_list, mnt_hash) {
|
| 2728 | struct mount *q;
|
| 2729 | hlist_del_init(&child->mnt_hash);
|
| 2730 |
|
| 2731 | if (child->mnt_parent->mnt_ns->user_ns != user_ns)
|
| 2732 | lock_mnt_tree(child);
|
| 2733 | q = __lookup_mnt(&child->mnt_parent->mnt,
|
| 2734 | child->mnt_mountpoint);
|
| 2735 | commit_tree(child);
|
| 2736 | if (q) {
|
| 2737 | struct mount *r = topmost_overmount(child);
|
| 2738 | struct mountpoint *mp = root.mp;
|
| 2739 |
|
| 2740 | if (unlikely(shorter) && child != source_mnt)
|
| 2741 | mp = shorter;
|
| 2742 | |
| 2743 | * If @q was locked it was meant to hide
|
| 2744 | * whatever was under it. Let @child take over
|
| 2745 | * that job and lock it. If @child is the mount
|
| 2746 | * the caller placed we can then unlock @q:
|
| 2747 | * nothing another namespace does removes it
|
| 2748 | * again. A propagated copy goes away when the
|
| 2749 | * mounter of the original unmounts it, so @q
|
| 2750 | * keeps its lock.
|
| 2751 |
|
| 2752 | if (IS_MNT_LOCKED(q)) {
|
| 2753 | child->mnt.mnt_flags |= MNT_LOCKED;
|
| 2754 | if (child == source_mnt)
|
| 2755 | q->mnt.mnt_flags &= ~MNT_LOCKED;
|
| 2756 | }
|
| 2757 | mnt_change_mountpoint(r, mp, q);
|
| 2758 | }
|
| 2759 | }
|
| 2760 | unpin_mountpoint(&root);
|
| 2761 | unlock_mount_hash();
|
| 2762 |
|
| 2763 | return 0;
|
| 2764 |
|
| 2765 | out_cleanup_ids:
|
| 2766 | while (!hlist_empty(&tree_list)) {
|
| 2767 | child = hlist_entry(tree_list.first, struct mount, mnt_hash);
|
| 2768 | child->mnt_parent->mnt_ns->pending_mounts = 0;
|
| 2769 | umount_tree(child, UMOUNT_SYNC);
|
| 2770 | }
|
| 2771 | unlock_mount_hash();
|
| 2772 | cleanup_group_ids(source_mnt, NULL);
|
| 2773 | out:
|
| 2774 | ns->pending_mounts = 0;
|
| 2775 |
|
| 2776 | read_seqlock_excl(&mount_lock);
|
| 2777 | unpin_mountpoint(&root);
|
| 2778 | read_sequnlock_excl(&mount_lock);
|
| 2779 |
|
| 2780 | return err;
|
| 2781 | }
|
| 2782 |
|
| 2783 | static inline struct mount *where_to_mount(const struct path *path,
|
| 2784 | struct dentry **dentry,
|
| 2785 | bool beneath)
|
| 2786 | {
|
| 2787 | struct mount *m;
|
| 2788 |
|
| 2789 | if (unlikely(beneath)) {
|
| 2790 | m = topmost_overmount(real_mount(path->mnt));
|
| 2791 | *dentry = m->mnt_mountpoint;
|
| 2792 | return m->mnt_parent;
|
| 2793 | }
|
| 2794 | m = __lookup_mnt(path->mnt, path->dentry);
|
| 2795 | if (unlikely(m)) {
|
| 2796 | m = topmost_overmount(m);
|
| 2797 | *dentry = m->mnt.mnt_root;
|
| 2798 | return m;
|
| 2799 | }
|
| 2800 | *dentry = path->dentry;
|
| 2801 | return real_mount(path->mnt);
|
| 2802 | }
|
| 2803 |
|
| 2804 | |
| 2805 | * do_lock_mount - acquire environment for mounting
|
| 2806 | * @path: target path
|
| 2807 | * @res: context to set up
|
| 2808 | * @beneath: whether the intention is to mount beneath @path
|
| 2809 | *
|
| 2810 | * To mount something at given location, we need
|
| 2811 | * namespace_sem locked exclusive
|
| 2812 | * inode of dentry we are mounting on locked exclusive
|
| 2813 | * struct mountpoint for that dentry
|
| 2814 | * struct mount we are mounting on
|
| 2815 | *
|
| 2816 | * Results are stored in caller-supplied context (pinned_mountpoint);
|
| 2817 | * on success we have res->parent and res->mp pointing to parent and
|
| 2818 | * mountpoint respectively and res->node inserted into the ->m_list
|
| 2819 | * of the mountpoint, making sure the mountpoint won't disappear.
|
| 2820 | * On failure we have res->parent set to ERR_PTR(-E...), res->mp
|
| 2821 | * left NULL, res->node - empty.
|
| 2822 | * In case of success do_lock_mount returns with locks acquired (in
|
| 2823 | * proper order - inode lock nests outside of namespace_sem).
|
| 2824 | *
|
| 2825 | * Request to mount on overmounted location is treated as "mount on
|
| 2826 | * top of whatever's overmounting it"; request to mount beneath
|
| 2827 | * a location - "mount immediately beneath the topmost mount at that
|
| 2828 | * place".
|
| 2829 | *
|
| 2830 | * In all cases the location must not have been unmounted and the
|
| 2831 | * chosen mountpoint must be allowed to be mounted on. For "beneath"
|
| 2832 | * case we also require the location to be at the root of a mount
|
| 2833 | * that has something mounted on top of it (i.e. has an overmount).
|
| 2834 |
|
| 2835 | static void do_lock_mount(const struct path *path,
|
| 2836 | struct pinned_mountpoint *res,
|
| 2837 | bool beneath)
|
| 2838 | {
|
| 2839 | int err;
|
| 2840 |
|
| 2841 | if (unlikely(beneath) && !path_mounted(path)) {
|
| 2842 | res->parent = ERR_PTR(-EINVAL);
|
| 2843 | return;
|
| 2844 | }
|
| 2845 |
|
| 2846 | do {
|
| 2847 | struct dentry *dentry, *d;
|
| 2848 | struct mount *m, *n;
|
| 2849 |
|
| 2850 | scoped_guard(mount_locked_reader) {
|
| 2851 | m = where_to_mount(path, &dentry, beneath);
|
| 2852 |
|
| 2853 | if (unlikely(cant_mount(dentry))) {
|
| 2854 | res->parent = ERR_PTR(-ENOENT);
|
| 2855 | return;
|
| 2856 | }
|
| 2857 | if (&m->mnt != path->mnt) {
|
| 2858 | mntget(&m->mnt);
|
| 2859 | dget(dentry);
|
| 2860 | }
|
| 2861 | }
|
| 2862 |
|
| 2863 | inode_lock(dentry->d_inode);
|
| 2864 | namespace_lock();
|
| 2865 |
|
| 2866 | |
| 2867 | scoped_guard(mount_locked_reader)
|
| 2868 | n = where_to_mount(path, &d, beneath);
|
| 2869 |
|
| 2870 | if (unlikely(n != m || dentry != d))
|
| 2871 | err = -EAGAIN; |
| 2872 | else if (unlikely(cant_mount(dentry) || !is_mounted(path->mnt)))
|
| 2873 | err = -ENOENT; |
| 2874 | else if (beneath && &m->mnt == path->mnt && !m->overmount)
|
| 2875 | err = -EINVAL;
|
| 2876 | else
|
| 2877 | err = get_mountpoint(dentry, res);
|
| 2878 |
|
| 2879 | if (unlikely(err)) {
|
| 2880 | res->parent = ERR_PTR(err);
|
| 2881 | namespace_unlock();
|
| 2882 | inode_unlock(dentry->d_inode);
|
| 2883 | } else {
|
| 2884 | res->parent = m;
|
| 2885 | }
|
| 2886 | |
| 2887 | * Drop the temporary references. This is subtle - on success
|
| 2888 | * we are doing that under namespace_sem, which would normally
|
| 2889 | * be forbidden. However, in that case we are guaranteed that
|
| 2890 | * refcounts won't reach zero, since we know that path->mnt
|
| 2891 | * is mounted and thus all mounts reachable from it are pinned
|
| 2892 | * and stable, along with their mountpoints and roots.
|
| 2893 |
|
| 2894 | if (&m->mnt != path->mnt) {
|
| 2895 | dput(dentry);
|
| 2896 | mntput(&m->mnt);
|
| 2897 | }
|
| 2898 | } while (err == -EAGAIN);
|
| 2899 | }
|
| 2900 |
|
| 2901 | static void __unlock_mount(struct pinned_mountpoint *m)
|
| 2902 | {
|
| 2903 | inode_unlock(m->mp->m_dentry->d_inode);
|
| 2904 | read_seqlock_excl(&mount_lock);
|
| 2905 | unpin_mountpoint(m);
|
| 2906 | read_sequnlock_excl(&mount_lock);
|
| 2907 | namespace_unlock();
|
| 2908 | }
|
| 2909 |
|
| 2910 | static inline void unlock_mount(struct pinned_mountpoint *m)
|
| 2911 | {
|
| 2912 | if (!IS_ERR(m->parent))
|
| 2913 | __unlock_mount(m);
|
| 2914 | }
|
| 2915 |
|
| 2916 | static void lock_mount_exact(const struct path *path,
|
| 2917 | struct pinned_mountpoint *mp, bool copy_mount,
|
| 2918 | unsigned int copy_flags);
|
| 2919 |
|
| 2920 | #define LOCK_MOUNT_MAYBE_BENEATH(mp, path, beneath) \
|
| 2921 | struct pinned_mountpoint mp __cleanup(unlock_mount) = {}; \
|
| 2922 | do_lock_mount((path), &mp, (beneath))
|
| 2923 | #define LOCK_MOUNT(mp, path) LOCK_MOUNT_MAYBE_BENEATH(mp, (path), false)
|
| 2924 | #define LOCK_MOUNT_EXACT(mp, path) \
|
| 2925 | struct pinned_mountpoint mp __cleanup(unlock_mount) = {}; \
|
| 2926 | lock_mount_exact((path), &mp, false, 0)
|
| 2927 | #define LOCK_MOUNT_EXACT_COPY(mp, path, copy_flags) \
|
| 2928 | struct pinned_mountpoint mp __cleanup(unlock_mount) = {}; \
|
| 2929 | lock_mount_exact((path), &mp, true, (copy_flags))
|
| 2930 |
|
| 2931 | static int graft_tree(struct mount *mnt, const struct pinned_mountpoint *mp)
|
| 2932 | {
|
| 2933 | if (mnt->mnt.mnt_sb->s_flags & SB_NOUSER)
|
| 2934 | return -EINVAL;
|
| 2935 |
|
| 2936 | if (d_is_dir(mp->mp->m_dentry) !=
|
| 2937 | d_is_dir(mnt->mnt.mnt_root))
|
| 2938 | return -ENOTDIR;
|
| 2939 |
|
| 2940 | return attach_recursive_mnt(mnt, mp);
|
| 2941 | }
|
| 2942 |
|
| 2943 | static int may_change_propagation(const struct mount *m)
|
| 2944 | {
|
| 2945 | struct mnt_namespace *ns = m->mnt_ns;
|
| 2946 |
|
| 2947 | |
| 2948 | if (IS_ERR_OR_NULL(ns)) |
| 2949 | return -EINVAL;
|
| 2950 | |
| 2951 | if (!ns_capable(ns->user_ns, CAP_SYS_ADMIN))
|
| 2952 | return -EPERM;
|
| 2953 | return 0;
|
| 2954 | }
|
| 2955 |
|
| 2956 | |
| 2957 | * Sanity check the flags to change_mnt_propagation.
|
| 2958 |
|
| 2959 |
|
| 2960 | static int flags_to_propagation_type(int ms_flags)
|
| 2961 | {
|
| 2962 | int type = ms_flags & ~(MS_REC | MS_SILENT);
|
| 2963 |
|
| 2964 |
|
| 2965 | if (type & ~(MS_SHARED | MS_PRIVATE | MS_SLAVE | MS_UNBINDABLE))
|
| 2966 | return 0;
|
| 2967 |
|
| 2968 | if (!is_power_of_2(type))
|
| 2969 | return 0;
|
| 2970 | return type;
|
| 2971 | }
|
| 2972 |
|
| 2973 | |
| 2974 | * recursively change the type of the mountpoint.
|
| 2975 |
|
| 2976 | static int do_change_type(const struct path *path, int ms_flags)
|
| 2977 | {
|
| 2978 | struct mount *m;
|
| 2979 | struct mount *mnt = real_mount(path->mnt);
|
| 2980 | int recurse = ms_flags & MS_REC;
|
| 2981 | int type;
|
| 2982 | int err;
|
| 2983 |
|
| 2984 | if (!path_mounted(path))
|
| 2985 | return -EINVAL;
|
| 2986 |
|
| 2987 | type = flags_to_propagation_type(ms_flags);
|
| 2988 | if (!type)
|
| 2989 | return -EINVAL;
|
| 2990 |
|
| 2991 | guard(namespace_excl)();
|
| 2992 |
|
| 2993 | err = may_change_propagation(mnt);
|
| 2994 | if (err)
|
| 2995 | return err;
|
| 2996 |
|
| 2997 | if (type == MS_SHARED) {
|
| 2998 | err = invent_group_ids(mnt, recurse);
|
| 2999 | if (err)
|
| 3000 | return err;
|
| 3001 | }
|
| 3002 |
|
| 3003 | for (m = mnt; m; m = (recurse ? next_mnt(m, mnt) : NULL))
|
| 3004 | change_mnt_propagation(m, type);
|
| 3005 |
|
| 3006 | guard(mount_locked_reader)();
|
| 3007 | touch_mnt_namespace(mnt->mnt_ns);
|
| 3008 |
|
| 3009 | return 0;
|
| 3010 | }
|
| 3011 |
|
| 3012 | |
| 3013 | * @path: path to the mount tree to be copied
|
| 3014 | *
|
| 3015 | * This helper checks if the caller may copy the mount tree starting
|
| 3016 | * from @path->mnt. The caller may copy the mount tree under the
|
| 3017 | * following circumstances:
|
| 3018 | *
|
| 3019 | * (1) The caller is located in the mount namespace of the mount tree.
|
| 3020 | * This also implies that the mount does not belong to an anonymous
|
| 3021 | * mount namespace.
|
| 3022 | * (2) The caller tries to copy an nfs mount referring to a mount
|
| 3023 | * namespace, i.e., the caller is trying to copy a mount namespace
|
| 3024 | * entry from nsfs.
|
| 3025 | * (3) The caller tries to copy a pidfs mount referring to a pidfd.
|
| 3026 | * (4) The caller is trying to copy a mount tree that belongs to an
|
| 3027 | * anonymous mount namespace.
|
| 3028 | *
|
| 3029 | * For that to be safe, this helper enforces that the origin mount
|
| 3030 | * namespace the anonymous mount namespace was created from is the
|
| 3031 | * same as the caller's mount namespace by comparing the sequence
|
| 3032 | * numbers.
|
| 3033 | *
|
| 3034 | * This is not strictly necessary. The current semantics of the new
|
| 3035 | * mount api enforce that the caller must be located in the same
|
| 3036 | * mount namespace as the mount tree it interacts with. Using the
|
| 3037 | * origin sequence number preserves these semantics even for
|
| 3038 | * anonymous mount namespaces. However, one could envision extending
|
| 3039 | * the api to directly operate across mount namespace if needed.
|
| 3040 | *
|
| 3041 | * The ownership of a non-anonymous mount namespace such as the
|
| 3042 | * caller's cannot change.
|
| 3043 | * => We know that the caller's mount namespace is stable.
|
| 3044 | *
|
| 3045 | * If the origin sequence number of the anonymous mount namespace is
|
| 3046 | * the same as the sequence number of the caller's mount namespace.
|
| 3047 | * => The owning namespaces are the same.
|
| 3048 | *
|
| 3049 | * ==> The earlier capability check on the owning namespace of the
|
| 3050 | * caller's mount namespace ensures that the caller has the
|
| 3051 | * ability to copy the mount tree.
|
| 3052 | *
|
| 3053 | * Returns true if the mount tree can be copied, false otherwise.
|
| 3054 |
|
| 3055 | static inline bool may_copy_tree(const struct path *path)
|
| 3056 | {
|
| 3057 | struct mount *mnt = real_mount(path->mnt);
|
| 3058 | const struct dentry_operations *d_op;
|
| 3059 |
|
| 3060 | if (check_mnt(mnt))
|
| 3061 | return true;
|
| 3062 |
|
| 3063 | d_op = path->dentry->d_op;
|
| 3064 | if (d_op == &ns_dentry_operations)
|
| 3065 | return true;
|
| 3066 |
|
| 3067 | if (d_op == &pidfs_dentry_operations)
|
| 3068 | return true;
|
| 3069 |
|
| 3070 | if (!is_mounted(path->mnt))
|
| 3071 | return false;
|
| 3072 |
|
| 3073 | return check_anonymous_mnt(mnt);
|
| 3074 | }
|
| 3075 |
|
| 3076 | static struct mount *__do_loopback(const struct path *old_path,
|
| 3077 | bool recurse, unsigned int copy_flags)
|
| 3078 | {
|
| 3079 | struct mount *old = real_mount(old_path->mnt);
|
| 3080 |
|
| 3081 | if (IS_MNT_UNBINDABLE(old))
|
| 3082 | return ERR_PTR(-EINVAL);
|
| 3083 |
|
| 3084 | if (!may_copy_tree(old_path))
|
| 3085 | return ERR_PTR(-EINVAL);
|
| 3086 |
|
| 3087 |
|
| 3088 | if (old_path->dentry->d_flags & DCACHE_NORCU)
|
| 3089 | return ERR_PTR(-EINVAL);
|
| 3090 |
|
| 3091 | if (recurse && !old->mnt_ns)
|
| 3092 | return ERR_PTR(-EINVAL);
|
| 3093 |
|
| 3094 | if (!recurse && has_locked_children(old, old_path->dentry))
|
| 3095 | return ERR_PTR(-EINVAL);
|
| 3096 |
|
| 3097 | if (recurse)
|
| 3098 | return copy_tree(old, old_path->dentry, copy_flags);
|
| 3099 |
|
| 3100 | return clone_mnt(old, old_path->dentry, copy_flags);
|
| 3101 | }
|
| 3102 |
|
| 3103 | |
| 3104 | * do loopback mount.
|
| 3105 |
|
| 3106 | static int do_loopback(const struct path *path, const char *old_name,
|
| 3107 | int recurse)
|
| 3108 | {
|
| 3109 | struct path old_path __free(path_put) = {};
|
| 3110 | struct mount *mnt = NULL;
|
| 3111 | int err;
|
| 3112 |
|
| 3113 | if (!old_name || !*old_name)
|
| 3114 | return -EINVAL;
|
| 3115 | err = kern_path(old_name, LOOKUP_FOLLOW|LOOKUP_AUTOMOUNT, &old_path);
|
| 3116 | if (err)
|
| 3117 | return err;
|
| 3118 |
|
| 3119 | if (mnt_ns_loop(old_path.dentry))
|
| 3120 | return -EINVAL;
|
| 3121 |
|
| 3122 | LOCK_MOUNT(mp, path);
|
| 3123 | if (IS_ERR(mp.parent))
|
| 3124 | return PTR_ERR(mp.parent);
|
| 3125 |
|
| 3126 | if (!check_mnt(mp.parent))
|
| 3127 | return -EINVAL;
|
| 3128 |
|
| 3129 | mnt = __do_loopback(&old_path, recurse, CL_COPY_MNT_NS_FILE);
|
| 3130 | if (IS_ERR(mnt))
|
| 3131 | return PTR_ERR(mnt);
|
| 3132 |
|
| 3133 |
|
| 3134 | if (recurse && !check_for_nsfs_mounts(mnt))
|
| 3135 | err = -EINVAL;
|
| 3136 | else
|
| 3137 | err = graft_tree(mnt, &mp);
|
| 3138 | if (err) {
|
| 3139 | lock_mount_hash();
|
| 3140 | umount_tree(mnt, UMOUNT_SYNC);
|
| 3141 | unlock_mount_hash();
|
| 3142 | }
|
| 3143 | return err;
|
| 3144 | }
|
| 3145 |
|
| 3146 | static struct mnt_namespace *get_detached_copy(const struct path *path, unsigned int flags)
|
| 3147 | {
|
| 3148 | struct mnt_namespace *ns, *mnt_ns = current->nsproxy->mnt_ns, *src_mnt_ns;
|
| 3149 | struct user_namespace *user_ns = mnt_ns->user_ns;
|
| 3150 | struct mount *mnt, *p;
|
| 3151 |
|
| 3152 | ns = alloc_mnt_ns(user_ns, true);
|
| 3153 | if (IS_ERR(ns))
|
| 3154 | return ns;
|
| 3155 |
|
| 3156 | guard(namespace_excl)();
|
| 3157 |
|
| 3158 | |
| 3159 | * Record the sequence number of the source mount namespace.
|
| 3160 | * This needs to hold namespace_sem to ensure that the mount
|
| 3161 | * doesn't get attached.
|
| 3162 |
|
| 3163 | if (is_mounted(path->mnt)) {
|
| 3164 | src_mnt_ns = real_mount(path->mnt)->mnt_ns;
|
| 3165 | if (is_anon_ns(src_mnt_ns))
|
| 3166 | ns->seq_origin = src_mnt_ns->seq_origin;
|
| 3167 | else
|
| 3168 | ns->seq_origin = src_mnt_ns->ns.ns_id;
|
| 3169 | }
|
| 3170 |
|
| 3171 | mnt = __do_loopback(path, (flags & AT_RECURSIVE),
|
| 3172 | (flags & OPEN_TREE_DROP_MNTNS_MOUNTS) ? 0 : CL_COPY_MNT_NS_FILE);
|
| 3173 | if (IS_ERR(mnt)) {
|
| 3174 | emptied_ns = ns;
|
| 3175 | return ERR_CAST(mnt);
|
| 3176 | }
|
| 3177 |
|
| 3178 | for (p = mnt; p; p = next_mnt(p, mnt)) {
|
| 3179 | mnt_add_to_ns(ns, p);
|
| 3180 | ns->nr_mounts++;
|
| 3181 | }
|
| 3182 | ns->root = mnt;
|
| 3183 | return ns;
|
| 3184 | }
|
| 3185 |
|
| 3186 | static struct file *open_detached_copy(struct path *path, unsigned int flags)
|
| 3187 | {
|
| 3188 | struct mnt_namespace *ns = get_detached_copy(path, flags);
|
| 3189 | struct file *file;
|
| 3190 |
|
| 3191 | if (IS_ERR(ns))
|
| 3192 | return ERR_CAST(ns);
|
| 3193 |
|
| 3194 | mntput(path->mnt);
|
| 3195 | path->mnt = mntget(&ns->root->mnt);
|
| 3196 | file = dentry_open(path, O_PATH, current_cred());
|
| 3197 | if (IS_ERR(file))
|
| 3198 | dissolve_on_fput(no_free_ptr(path->mnt));
|
| 3199 | else
|
| 3200 | file->f_mode |= FMODE_NEED_UNMOUNT;
|
| 3201 | return file;
|
| 3202 | }
|
| 3203 |
|
| 3204 | enum mount_copy_flags_t {
|
| 3205 | MOUNT_COPY_RECURSIVE = (1 << 0),
|
| 3206 | MOUNT_COPY_NEW = (1 << 1),
|
| 3207 | };
|
| 3208 |
|
| 3209 | static struct mnt_namespace *create_new_namespace(struct path *path,
|
| 3210 | enum mount_copy_flags_t flags)
|
| 3211 | {
|
| 3212 | struct mnt_namespace *ns = current->nsproxy->mnt_ns;
|
| 3213 | struct user_namespace *user_ns = current_user_ns();
|
| 3214 | struct mnt_namespace *new_ns;
|
| 3215 | struct mount *new_ns_root, *old_ns_root;
|
| 3216 | struct path to_path;
|
| 3217 | struct mount *mnt;
|
| 3218 | unsigned int copy_flags = 0;
|
| 3219 | bool locked = false, recurse = flags & MOUNT_COPY_RECURSIVE;
|
| 3220 | bool foreign = user_ns != ns->user_ns;
|
| 3221 |
|
| 3222 | if (unlikely(!d_can_lookup(path->dentry)))
|
| 3223 | return ERR_PTR(-ENOTDIR);
|
| 3224 |
|
| 3225 | |
| 3226 | * Without privileges over the mount namespace the copy is made from
|
| 3227 | * nothing mounted below @path may be left out. It would reveal what
|
| 3228 | * it covers. That's what unshare() gives such a caller as well.
|
| 3229 |
|
| 3230 | if (foreign)
|
| 3231 | copy_flags |= CL_SLAVE | CL_COPY_UNBINDABLE;
|
| 3232 |
|
| 3233 | new_ns = alloc_mnt_ns(user_ns, false);
|
| 3234 | if (IS_ERR(new_ns))
|
| 3235 | return ERR_CAST(new_ns);
|
| 3236 |
|
| 3237 | old_ns_root = ns->root;
|
| 3238 | to_path.mnt = &old_ns_root->mnt;
|
| 3239 | to_path.dentry = old_ns_root->mnt.mnt_root;
|
| 3240 |
|
| 3241 | VFS_WARN_ON_ONCE(old_ns_root->mnt.mnt_sb->s_type != &nullfs_fs_type);
|
| 3242 |
|
| 3243 | LOCK_MOUNT_EXACT_COPY(mp, &to_path, copy_flags);
|
| 3244 | if (IS_ERR(mp.parent)) {
|
| 3245 | free_mnt_ns(new_ns);
|
| 3246 | return ERR_CAST(mp.parent);
|
| 3247 | }
|
| 3248 | new_ns_root = mp.parent;
|
| 3249 |
|
| 3250 | |
| 3251 | * If the real rootfs had a locked mount on top of it somewhere
|
| 3252 | * in the stack, lock the new mount tree as well so it can't be
|
| 3253 | * exposed.
|
| 3254 |
|
| 3255 | mnt = old_ns_root;
|
| 3256 | while (mnt->overmount) {
|
| 3257 | mnt = mnt->overmount;
|
| 3258 | if (mnt->mnt.mnt_flags & MNT_LOCKED)
|
| 3259 | locked = true;
|
| 3260 | }
|
| 3261 |
|
| 3262 | |
| 3263 | * We don't emulate unshare()ing a mount namespace. We stick to
|
| 3264 | * the restrictions of creating detached bind-mounts. It has a
|
| 3265 | * lot saner and simpler semantics. A caller without privileges
|
| 3266 | * over the mount namespace can't leave out any child though.
|
| 3267 |
|
| 3268 | if (flags & MOUNT_COPY_NEW)
|
| 3269 | mnt = clone_mnt(real_mount(path->mnt), path->dentry, copy_flags);
|
| 3270 | else if (foreign && !recurse &&
|
| 3271 | __has_children(real_mount(path->mnt), path->dentry))
|
| 3272 | mnt = ERR_PTR(-EINVAL);
|
| 3273 | else
|
| 3274 | mnt = __do_loopback(path, recurse, copy_flags);
|
| 3275 | scoped_guard(mount_writer) {
|
| 3276 | if (IS_ERR(mnt)) {
|
| 3277 | emptied_ns = new_ns;
|
| 3278 | umount_tree(new_ns_root, 0);
|
| 3279 | return ERR_CAST(mnt);
|
| 3280 | }
|
| 3281 |
|
| 3282 | if (locked)
|
| 3283 | mnt->mnt.mnt_flags |= MNT_LOCKED;
|
| 3284 | |
| 3285 | * now mount the detached tree on top of the copy
|
| 3286 | * of the real rootfs we created.
|
| 3287 |
|
| 3288 | attach_mnt(mnt, new_ns_root, mp.mp);
|
| 3289 | if (foreign)
|
| 3290 | lock_mnt_tree(new_ns_root);
|
| 3291 | }
|
| 3292 |
|
| 3293 | for (mnt = new_ns_root; mnt; mnt = next_mnt(mnt, new_ns_root)) {
|
| 3294 | mnt_add_to_ns(new_ns, mnt);
|
| 3295 | new_ns->nr_mounts++;
|
| 3296 | }
|
| 3297 |
|
| 3298 | new_ns->root = new_ns_root;
|
| 3299 | ns_tree_add_raw(new_ns);
|
| 3300 | return new_ns;
|
| 3301 | }
|
| 3302 |
|
| 3303 | static struct file *open_new_namespace(struct path *path,
|
| 3304 | enum mount_copy_flags_t flags)
|
| 3305 | {
|
| 3306 | struct mnt_namespace *new_ns;
|
| 3307 |
|
| 3308 | new_ns = create_new_namespace(path, flags);
|
| 3309 | if (IS_ERR(new_ns))
|
| 3310 | return ERR_CAST(new_ns);
|
| 3311 | return open_namespace_file(to_ns_common(new_ns));
|
| 3312 | }
|
| 3313 |
|
| 3314 | static struct file *vfs_open_tree(int dfd, const char __user *filename, unsigned int flags)
|
| 3315 | {
|
| 3316 | int ret;
|
| 3317 | struct path path __free(path_put) = {};
|
| 3318 | int lookup_flags = LOOKUP_AUTOMOUNT | LOOKUP_FOLLOW;
|
| 3319 |
|
| 3320 | BUILD_BUG_ON(OPEN_TREE_CLOEXEC != O_CLOEXEC);
|
| 3321 |
|
| 3322 | if (flags & ~(AT_EMPTY_PATH | AT_NO_AUTOMOUNT | AT_RECURSIVE |
|
| 3323 | AT_SYMLINK_NOFOLLOW | OPEN_TREE_CLONE |
|
| 3324 | OPEN_TREE_CLOEXEC | OPEN_TREE_NAMESPACE |
|
| 3325 | OPEN_TREE_DROP_MNTNS_MOUNTS))
|
| 3326 | return ERR_PTR(-EINVAL);
|
| 3327 |
|
| 3328 | |
| 3329 | * Only meaningful when a tree is copied recursively: a non-recursive
|
| 3330 | * clone has no submounts to drop. OPEN_TREE_NAMESPACE never copies
|
| 3331 | * pinned mount namespaces, so there the flag is a no-op.
|
| 3332 |
|
| 3333 | if ((flags & OPEN_TREE_DROP_MNTNS_MOUNTS) &&
|
| 3334 | (!(flags & AT_RECURSIVE) ||
|
| 3335 | !(flags & (OPEN_TREE_CLONE | OPEN_TREE_NAMESPACE))))
|
| 3336 | return ERR_PTR(-EINVAL);
|
| 3337 |
|
| 3338 | if ((flags & (AT_RECURSIVE | OPEN_TREE_CLONE | OPEN_TREE_NAMESPACE)) ==
|
| 3339 | AT_RECURSIVE)
|
| 3340 | return ERR_PTR(-EINVAL);
|
| 3341 |
|
| 3342 | if (hweight32(flags & (OPEN_TREE_CLONE | OPEN_TREE_NAMESPACE)) > 1)
|
| 3343 | return ERR_PTR(-EINVAL);
|
| 3344 |
|
| 3345 | if (flags & AT_NO_AUTOMOUNT)
|
| 3346 | lookup_flags &= ~LOOKUP_AUTOMOUNT;
|
| 3347 | if (flags & AT_SYMLINK_NOFOLLOW)
|
| 3348 | lookup_flags &= ~LOOKUP_FOLLOW;
|
| 3349 |
|
| 3350 | |
| 3351 | * If we create a new mount namespace with the cloned mount tree we
|
| 3352 | * just care about being privileged over our current user namespace.
|
| 3353 | * The new mount namespace will be owned by it.
|
| 3354 |
|
| 3355 | if ((flags & OPEN_TREE_NAMESPACE) &&
|
| 3356 | !ns_capable(current_user_ns(), CAP_SYS_ADMIN))
|
| 3357 | return ERR_PTR(-EPERM);
|
| 3358 |
|
| 3359 | if ((flags & OPEN_TREE_CLONE) && !may_mount())
|
| 3360 | return ERR_PTR(-EPERM);
|
| 3361 |
|
| 3362 | CLASS(filename_uflags, name)(filename, flags);
|
| 3363 | ret = filename_lookup(dfd, name, lookup_flags, &path, NULL);
|
| 3364 | if (unlikely(ret))
|
| 3365 | return ERR_PTR(ret);
|
| 3366 |
|
| 3367 | if (flags & OPEN_TREE_NAMESPACE)
|
| 3368 | return open_new_namespace(&path, (flags & AT_RECURSIVE) ? MOUNT_COPY_RECURSIVE : 0);
|
| 3369 |
|
| 3370 | if (flags & OPEN_TREE_CLONE)
|
| 3371 | return open_detached_copy(&path, flags);
|
| 3372 |
|
| 3373 | return dentry_open(&path, O_PATH, current_cred());
|
| 3374 | }
|
| 3375 |
|
| 3376 | SYSCALL_DEFINE3(open_tree, int, dfd, const char __user *, filename, unsigned, flags)
|
| 3377 | {
|
| 3378 | return FD_ADD(flags, vfs_open_tree(dfd, filename, flags));
|
| 3379 | }
|
| 3380 |
|
| 3381 | |
| 3382 | * Don't allow locked mount flags to be cleared.
|
| 3383 | *
|
| 3384 | * No locks need to be held here while testing the various MNT_LOCK
|
| 3385 | * flags because those flags can never be cleared once they are set.
|
| 3386 |
|
| 3387 | static bool can_change_locked_flags(struct mount *mnt, unsigned int mnt_flags)
|
| 3388 | {
|
| 3389 | unsigned int fl = mnt->mnt.mnt_flags;
|
| 3390 |
|
| 3391 | if ((fl & MNT_LOCK_READONLY) &&
|
| 3392 | !(mnt_flags & MNT_READONLY))
|
| 3393 | return false;
|
| 3394 |
|
| 3395 | if ((fl & MNT_LOCK_NODEV) &&
|
| 3396 | !(mnt_flags & MNT_NODEV))
|
| 3397 | return false;
|
| 3398 |
|
| 3399 | if ((fl & MNT_LOCK_NOSUID) &&
|
| 3400 | !(mnt_flags & MNT_NOSUID))
|
| 3401 | return false;
|
| 3402 |
|
| 3403 | if ((fl & MNT_LOCK_NOEXEC) &&
|
| 3404 | !(mnt_flags & MNT_NOEXEC))
|
| 3405 | return false;
|
| 3406 |
|
| 3407 | if ((fl & MNT_LOCK_ATIME) &&
|
| 3408 | ((fl & MNT_ATIME_MASK) != (mnt_flags & MNT_ATIME_MASK)))
|
| 3409 | return false;
|
| 3410 |
|
| 3411 | return true;
|
| 3412 | }
|
| 3413 |
|
| 3414 | static int change_mount_ro_state(struct mount *mnt, unsigned int mnt_flags)
|
| 3415 | {
|
| 3416 | bool readonly_request = (mnt_flags & MNT_READONLY);
|
| 3417 |
|
| 3418 | if (readonly_request == __mnt_is_readonly(&mnt->mnt))
|
| 3419 | return 0;
|
| 3420 |
|
| 3421 | if (readonly_request)
|
| 3422 | return mnt_make_readonly(mnt);
|
| 3423 |
|
| 3424 | mnt->mnt.mnt_flags &= ~MNT_READONLY;
|
| 3425 | return 0;
|
| 3426 | }
|
| 3427 |
|
| 3428 | static void set_mount_attributes(struct mount *mnt, unsigned int mnt_flags)
|
| 3429 | {
|
| 3430 | mnt_flags |= mnt->mnt.mnt_flags & ~MNT_USER_SETTABLE_MASK;
|
| 3431 | mnt->mnt.mnt_flags = mnt_flags;
|
| 3432 | touch_mnt_namespace(mnt->mnt_ns);
|
| 3433 | }
|
| 3434 |
|
| 3435 | static void mnt_warn_timestamp_expiry(const struct path *mountpoint,
|
| 3436 | struct vfsmount *mnt)
|
| 3437 | {
|
| 3438 | struct super_block *sb = mnt->mnt_sb;
|
| 3439 |
|
| 3440 | if (!__mnt_is_readonly(mnt) &&
|
| 3441 | (!(sb->s_iflags & SB_I_TS_EXPIRY_WARNED)) &&
|
| 3442 | (ktime_get_real_seconds() + TIME_UPTIME_SEC_MAX > sb->s_time_max)) {
|
| 3443 | char *buf, *mntpath;
|
| 3444 |
|
| 3445 | buf = __getname();
|
| 3446 | if (buf)
|
| 3447 | mntpath = d_path(mountpoint, buf, PATH_MAX);
|
| 3448 | else
|
| 3449 | mntpath = ERR_PTR(-ENOMEM);
|
| 3450 | if (IS_ERR(mntpath))
|
| 3451 | mntpath = "(unknown)";
|
| 3452 |
|
| 3453 | pr_warn("%s filesystem being %s at %s supports timestamps until %ptTd (0x%llx)\n",
|
| 3454 | sb->s_type->name,
|
| 3455 | is_mounted(mnt) ? "remounted" : "mounted",
|
| 3456 | mntpath, &sb->s_time_max,
|
| 3457 | (unsigned long long)sb->s_time_max);
|
| 3458 |
|
| 3459 | sb->s_iflags |= SB_I_TS_EXPIRY_WARNED;
|
| 3460 | __putname(buf);
|
| 3461 | }
|
| 3462 | }
|
| 3463 |
|
| 3464 | |
| 3465 | * Handle reconfiguration of the mountpoint only without alteration of the
|
| 3466 | * superblock it refers to. This is triggered by specifying MS_REMOUNT|MS_BIND
|
| 3467 | * to mount(2).
|
| 3468 |
|
| 3469 | static int do_reconfigure_mnt(const struct path *path, unsigned int mnt_flags)
|
| 3470 | {
|
| 3471 | struct super_block *sb = path->mnt->mnt_sb;
|
| 3472 | struct mount *mnt = real_mount(path->mnt);
|
| 3473 | int ret;
|
| 3474 |
|
| 3475 | if (!check_mnt(mnt))
|
| 3476 | return -EINVAL;
|
| 3477 |
|
| 3478 | if (!path_mounted(path))
|
| 3479 | return -EINVAL;
|
| 3480 |
|
| 3481 | if (!can_change_locked_flags(mnt, mnt_flags))
|
| 3482 | return -EPERM;
|
| 3483 |
|
| 3484 | |
| 3485 | * We're only checking whether the superblock is read-only not
|
| 3486 | * changing it, so only take down_read(&sb->s_umount).
|
| 3487 |
|
| 3488 | down_read(&sb->s_umount);
|
| 3489 | lock_mount_hash();
|
| 3490 | ret = change_mount_ro_state(mnt, mnt_flags);
|
| 3491 | if (ret == 0)
|
| 3492 | set_mount_attributes(mnt, mnt_flags);
|
| 3493 | unlock_mount_hash();
|
| 3494 | up_read(&sb->s_umount);
|
| 3495 |
|
| 3496 | mnt_warn_timestamp_expiry(path, &mnt->mnt);
|
| 3497 |
|
| 3498 | return ret;
|
| 3499 | }
|
| 3500 |
|
| 3501 | |
| 3502 | * change filesystem flags. dir should be a physical root of filesystem.
|
| 3503 | * If you've mounted a non-root directory somewhere and want to do remount
|
| 3504 | * on it - tough luck.
|
| 3505 |
|
| 3506 | static int do_remount(const struct path *path, int sb_flags,
|
| 3507 | int mnt_flags, void *data)
|
| 3508 | {
|
| 3509 | int err;
|
| 3510 | struct super_block *sb = path->mnt->mnt_sb;
|
| 3511 | struct mount *mnt = real_mount(path->mnt);
|
| 3512 | struct fs_context *fc;
|
| 3513 |
|
| 3514 | if (!check_mnt(mnt))
|
| 3515 | return -EINVAL;
|
| 3516 |
|
| 3517 | if (!path_mounted(path))
|
| 3518 | return -EINVAL;
|
| 3519 |
|
| 3520 | if (!can_change_locked_flags(mnt, mnt_flags))
|
| 3521 | return -EPERM;
|
| 3522 |
|
| 3523 | fc = fs_context_for_reconfigure(path->dentry, sb_flags, MS_RMT_MASK);
|
| 3524 | if (IS_ERR(fc))
|
| 3525 | return PTR_ERR(fc);
|
| 3526 |
|
| 3527 | |
| 3528 | * Indicate to the filesystem that the remount request is coming
|
| 3529 | * from the legacy mount system call.
|
| 3530 |
|
| 3531 | fc->oldapi = true;
|
| 3532 |
|
| 3533 | err = parse_monolithic_mount_data(fc, data);
|
| 3534 | if (!err) {
|
| 3535 | down_write(&sb->s_umount);
|
| 3536 | err = -EPERM;
|
| 3537 | if (ns_capable(sb->s_user_ns, CAP_SYS_ADMIN)) {
|
| 3538 | err = reconfigure_super(fc);
|
| 3539 | if (!err) {
|
| 3540 | lock_mount_hash();
|
| 3541 | set_mount_attributes(mnt, mnt_flags);
|
| 3542 | unlock_mount_hash();
|
| 3543 | }
|
| 3544 | }
|
| 3545 | up_write(&sb->s_umount);
|
| 3546 | }
|
| 3547 |
|
| 3548 | mnt_warn_timestamp_expiry(path, &mnt->mnt);
|
| 3549 |
|
| 3550 | put_fs_context(fc);
|
| 3551 | return err;
|
| 3552 | }
|
| 3553 |
|
| 3554 | static inline int tree_contains_unbindable(struct mount *mnt)
|
| 3555 | {
|
| 3556 | struct mount *p;
|
| 3557 | for (p = mnt; p; p = next_mnt(p, mnt)) {
|
| 3558 | if (IS_MNT_UNBINDABLE(p))
|
| 3559 | return 1;
|
| 3560 | }
|
| 3561 | return 0;
|
| 3562 | }
|
| 3563 |
|
| 3564 | static int do_set_group(const struct path *from_path, const struct path *to_path)
|
| 3565 | {
|
| 3566 | struct mount *from = real_mount(from_path->mnt);
|
| 3567 | struct mount *to = real_mount(to_path->mnt);
|
| 3568 | int err;
|
| 3569 |
|
| 3570 | guard(namespace_excl)();
|
| 3571 |
|
| 3572 | err = may_change_propagation(from);
|
| 3573 | if (err)
|
| 3574 | return err;
|
| 3575 | err = may_change_propagation(to);
|
| 3576 | if (err)
|
| 3577 | return err;
|
| 3578 |
|
| 3579 |
|
| 3580 | if (!path_mounted(from_path))
|
| 3581 | return -EINVAL;
|
| 3582 | if (!path_mounted(to_path))
|
| 3583 | return -EINVAL;
|
| 3584 |
|
| 3585 |
|
| 3586 | if (from->mnt.mnt_sb != to->mnt.mnt_sb)
|
| 3587 | return -EINVAL;
|
| 3588 |
|
| 3589 |
|
| 3590 | if (!is_subdir(to->mnt.mnt_root, from->mnt.mnt_root))
|
| 3591 | return -EINVAL;
|
| 3592 |
|
| 3593 |
|
| 3594 | if (has_locked_children(from, to->mnt.mnt_root))
|
| 3595 | return -EINVAL;
|
| 3596 |
|
| 3597 |
|
| 3598 | if (IS_MNT_SHARED(to) || IS_MNT_SLAVE(to) || IS_MNT_UNBINDABLE(to))
|
| 3599 | return -EINVAL;
|
| 3600 |
|
| 3601 |
|
| 3602 | if (!IS_MNT_SHARED(from) && !IS_MNT_SLAVE(from))
|
| 3603 | return -EINVAL;
|
| 3604 |
|
| 3605 | if (IS_MNT_SLAVE(from)) {
|
| 3606 | hlist_add_behind(&to->mnt_slave, &from->mnt_slave);
|
| 3607 | to->mnt_master = from->mnt_master;
|
| 3608 | }
|
| 3609 |
|
| 3610 | if (IS_MNT_SHARED(from)) {
|
| 3611 | to->mnt_group_id = from->mnt_group_id;
|
| 3612 | list_add(&to->mnt_share, &from->mnt_share);
|
| 3613 | set_mnt_shared(to);
|
| 3614 | }
|
| 3615 |
|
| 3616 | guard(mount_locked_reader)();
|
| 3617 | touch_mnt_namespace(to->mnt_ns);
|
| 3618 |
|
| 3619 | return 0;
|
| 3620 | }
|
| 3621 |
|
| 3622 | |
| 3623 | * path_overmounted - check if path is overmounted
|
| 3624 | * @path: path to check
|
| 3625 | *
|
| 3626 | * Check if path is overmounted, i.e., if there's a mount on top of
|
| 3627 | * @path->mnt with @path->dentry as mountpoint.
|
| 3628 | *
|
| 3629 | * Context: namespace_sem must be held at least shared.
|
| 3630 | * MUST NOT be called under lock_mount_hash() (there one should just
|
| 3631 | * call __lookup_mnt() and check if it returns NULL).
|
| 3632 | * Return: If path is overmounted true is returned, false if not.
|
| 3633 |
|
| 3634 | static inline bool path_overmounted(const struct path *path)
|
| 3635 | {
|
| 3636 | unsigned seq = read_seqbegin(&mount_lock);
|
| 3637 | bool no_child;
|
| 3638 |
|
| 3639 | rcu_read_lock();
|
| 3640 | no_child = !__lookup_mnt(path->mnt, path->dentry);
|
| 3641 | rcu_read_unlock();
|
| 3642 | if (need_seqretry(&mount_lock, seq)) {
|
| 3643 | read_seqlock_excl(&mount_lock);
|
| 3644 | no_child = !__lookup_mnt(path->mnt, path->dentry);
|
| 3645 | read_sequnlock_excl(&mount_lock);
|
| 3646 | }
|
| 3647 | return unlikely(!no_child);
|
| 3648 | }
|
| 3649 |
|
| 3650 | |
| 3651 | * Check if there is a possibly empty chain of descent from p1 to p2.
|
| 3652 | * Locks: namespace_sem (shared) or mount_lock (read_seqlock_excl).
|
| 3653 |
|
| 3654 | static bool mount_is_ancestor(const struct mount *p1, const struct mount *p2)
|
| 3655 | {
|
| 3656 | while (p2 != p1 && mnt_has_parent(p2))
|
| 3657 | p2 = p2->mnt_parent;
|
| 3658 | return p2 == p1;
|
| 3659 | }
|
| 3660 |
|
| 3661 | |
| 3662 | * can_move_mount_beneath - check that we can mount beneath the top mount
|
| 3663 | * @mnt_from: mount we are trying to move
|
| 3664 | * @mnt_to: mount under which to mount
|
| 3665 | * @mp: mountpoint of @mnt_to
|
| 3666 | *
|
| 3667 | * - Make sure that @mnt_from can take over the lock of @mnt_to. A
|
| 3668 | * mount of a mount namespace file is left out of a copy of the tree
|
| 3669 | * and can't.
|
| 3670 | * - Ensure that nothing has been mounted on top of @mnt_from before we
|
| 3671 | * grabbed @namespace_sem to avoid creating pointless shadow mounts.
|
| 3672 | * - Prevent mounting beneath a mount if the propagation relationship
|
| 3673 | * between the source mount, parent mount, and top mount would lead to
|
| 3674 | * nonsensical mount trees.
|
| 3675 | *
|
| 3676 | * Context: This function expects namespace_lock() to be held.
|
| 3677 | * Return: On success 0, and on error a negative error code is returned.
|
| 3678 |
|
| 3679 | static int can_move_mount_beneath(const struct mount *mnt_from,
|
| 3680 | const struct mount *mnt_to,
|
| 3681 | struct pinned_mountpoint *mp)
|
| 3682 | {
|
| 3683 | struct mount *parent_mnt_to = mnt_to->mnt_parent;
|
| 3684 |
|
| 3685 | |
| 3686 | * @mnt_from takes over the lock of @mnt_to. copy_tree() leaves a
|
| 3687 | * mount of a mount namespace file out of every copy made without
|
| 3688 | * CL_COPY_MNT_NS_FILE, together with what is mounted on it, so it
|
| 3689 | * can't keep anything hidden.
|
| 3690 |
|
| 3691 | if (IS_MNT_LOCKED(mnt_to) && is_mnt_ns_file(mnt_from->mnt.mnt_root))
|
| 3692 | return -EINVAL;
|
| 3693 |
|
| 3694 |
|
| 3695 | if (mnt_from->overmount)
|
| 3696 | return -EINVAL;
|
| 3697 |
|
| 3698 | if (mount_is_ancestor(mnt_to, mnt_from))
|
| 3699 | return -EINVAL;
|
| 3700 |
|
| 3701 | |
| 3702 | * If the parent mount propagates to the child mount this would
|
| 3703 | * mean mounting @mnt_from on @mnt_to->mnt_parent and then
|
| 3704 | * propagating a copy @c of @mnt_from on top of @mnt_to. This
|
| 3705 | * defeats the whole purpose of mounting beneath another mount.
|
| 3706 |
|
| 3707 | if (propagation_would_overmount(parent_mnt_to, mnt_to, mp->mp))
|
| 3708 | return -EINVAL;
|
| 3709 |
|
| 3710 | |
| 3711 | * If @mnt_to->mnt_parent propagates to @mnt_from this would
|
| 3712 | * mean propagating a copy @c of @mnt_from on top of @mnt_from.
|
| 3713 | * Afterwards @mnt_from would be mounted on top of
|
| 3714 | * @mnt_to->mnt_parent and @mnt_to would be unmounted from
|
| 3715 | * @mnt->mnt_parent and remounted on @mnt_from. But since @c is
|
| 3716 | * already mounted on @mnt_from, @mnt_to would ultimately be
|
| 3717 | * remounted on top of @c. Afterwards, @mnt_from would be
|
| 3718 | * covered by a copy @c of @mnt_from and @c would be covered by
|
| 3719 | * @mnt_from itself. This defeats the whole purpose of mounting
|
| 3720 | * @mnt_from beneath @mnt_to.
|
| 3721 |
|
| 3722 | if (check_mnt(mnt_from) &&
|
| 3723 | propagation_would_overmount(parent_mnt_to, mnt_from, mp->mp))
|
| 3724 | return -EINVAL;
|
| 3725 |
|
| 3726 | return 0;
|
| 3727 | }
|
| 3728 |
|
| 3729 | |
| 3730 | * @mnt: vfsmount to be used
|
| 3731 | *
|
| 3732 | * This helper checks if the caller may use the mount tree starting
|
| 3733 | * from @path->mnt. The caller may use the mount tree under the
|
| 3734 | * following circumstances:
|
| 3735 | *
|
| 3736 | * (1) The caller is located in the mount namespace of the mount tree.
|
| 3737 | * This also implies that the mount does not belong to an anonymous
|
| 3738 | * mount namespace.
|
| 3739 | * (2) The caller is trying to use a mount tree that belongs to an
|
| 3740 | * anonymous mount namespace.
|
| 3741 | *
|
| 3742 | * For that to be safe, this helper enforces that the origin mount
|
| 3743 | * namespace the anonymous mount namespace was created from is the
|
| 3744 | * same as the caller's mount namespace by comparing the sequence
|
| 3745 | * numbers.
|
| 3746 | *
|
| 3747 | * The ownership of a non-anonymous mount namespace such as the
|
| 3748 | * caller's cannot change.
|
| 3749 | * => We know that the caller's mount namespace is stable.
|
| 3750 | *
|
| 3751 | * If the origin sequence number of the anonymous mount namespace is
|
| 3752 | * the same as the sequence number of the caller's mount namespace.
|
| 3753 | * => The owning namespaces are the same.
|
| 3754 | *
|
| 3755 | * ==> The earlier capability check on the owning namespace of the
|
| 3756 | * caller's mount namespace ensures that the caller has the
|
| 3757 | * ability to use the mount tree.
|
| 3758 | *
|
| 3759 | * Returns true if the mount tree can be used, false otherwise.
|
| 3760 |
|
| 3761 | static inline bool may_use_mount(struct mount *mnt)
|
| 3762 | {
|
| 3763 | if (check_mnt(mnt))
|
| 3764 | return true;
|
| 3765 |
|
| 3766 | |
| 3767 | * Make sure that noone unmounted the target path or somehow
|
| 3768 | * managed to get their hands on something purely kernel
|
| 3769 | * internal.
|
| 3770 |
|
| 3771 | if (!is_mounted(&mnt->mnt))
|
| 3772 | return false;
|
| 3773 |
|
| 3774 | return check_anonymous_mnt(mnt);
|
| 3775 | }
|
| 3776 |
|
| 3777 | static int do_move_mount(const struct path *old_path,
|
| 3778 | const struct path *new_path,
|
| 3779 | enum mnt_tree_flags_t flags)
|
| 3780 | {
|
| 3781 | struct mount *old = real_mount(old_path->mnt);
|
| 3782 | int err;
|
| 3783 | bool beneath = flags & MNT_TREE_BENEATH;
|
| 3784 |
|
| 3785 | if (!path_mounted(old_path))
|
| 3786 | return -EINVAL;
|
| 3787 |
|
| 3788 | if (d_is_dir(new_path->dentry) != d_is_dir(old_path->dentry))
|
| 3789 | return -EINVAL;
|
| 3790 |
|
| 3791 | LOCK_MOUNT_MAYBE_BENEATH(mp, new_path, beneath);
|
| 3792 | if (IS_ERR(mp.parent))
|
| 3793 | return PTR_ERR(mp.parent);
|
| 3794 |
|
| 3795 | if (check_mnt(old)) {
|
| 3796 |
|
| 3797 |
|
| 3798 | if (!mnt_has_parent(old) || IS_MNT_LOCKED(old))
|
| 3799 | return -EINVAL;
|
| 3800 |
|
| 3801 | if (IS_MNT_SHARED(old->mnt_parent))
|
| 3802 | return -EINVAL;
|
| 3803 |
|
| 3804 | if (!check_mnt(mp.parent))
|
| 3805 | return -EINVAL;
|
| 3806 | } else {
|
| 3807 | |
| 3808 | * otherwise the source must be the root of some anon namespace.
|
| 3809 |
|
| 3810 | if (!anon_ns_root(old))
|
| 3811 | return -EINVAL;
|
| 3812 | |
| 3813 | * Bail out early if the target is within the same namespace -
|
| 3814 | * subsequent checks would've rejected that, but they lose
|
| 3815 | * some corner cases if we check it early.
|
| 3816 |
|
| 3817 | if (old->mnt_ns == mp.parent->mnt_ns)
|
| 3818 | return -EINVAL;
|
| 3819 | |
| 3820 | * Target should be either in our namespace or in an acceptable
|
| 3821 | * anon namespace, sensu check_anonymous_mnt().
|
| 3822 |
|
| 3823 | if (!may_use_mount(mp.parent))
|
| 3824 | return -EINVAL;
|
| 3825 | }
|
| 3826 |
|
| 3827 | if (beneath) {
|
| 3828 | struct mount *over = real_mount(new_path->mnt);
|
| 3829 |
|
| 3830 | if (mp.parent != over->mnt_parent)
|
| 3831 | over = mp.parent->overmount;
|
| 3832 | err = can_move_mount_beneath(old, over, &mp);
|
| 3833 | if (err)
|
| 3834 | return err;
|
| 3835 | }
|
| 3836 |
|
| 3837 | |
| 3838 | * Don't move a mount tree containing unbindable mounts to a destination
|
| 3839 | * mount which is shared.
|
| 3840 |
|
| 3841 | if (IS_MNT_SHARED(mp.parent) && tree_contains_unbindable(old))
|
| 3842 | return -EINVAL;
|
| 3843 | if (!check_for_nsfs_mounts(old))
|
| 3844 | return -ELOOP;
|
| 3845 | if (mount_is_ancestor(old, mp.parent))
|
| 3846 | return -ELOOP;
|
| 3847 |
|
| 3848 | return attach_recursive_mnt(old, &mp);
|
| 3849 | }
|
| 3850 |
|
| 3851 | static int do_move_mount_old(const struct path *path, const char *old_name)
|
| 3852 | {
|
| 3853 | struct path old_path __free(path_put) = {};
|
| 3854 | int err;
|
| 3855 |
|
| 3856 | if (!old_name || !*old_name)
|
| 3857 | return -EINVAL;
|
| 3858 |
|
| 3859 | err = kern_path(old_name, LOOKUP_FOLLOW, &old_path);
|
| 3860 | if (err)
|
| 3861 | return err;
|
| 3862 |
|
| 3863 | return do_move_mount(&old_path, path, 0);
|
| 3864 | }
|
| 3865 |
|
| 3866 | |
| 3867 | * add a mount into a namespace's mount tree
|
| 3868 |
|
| 3869 | static int do_add_mount(struct mount *newmnt, const struct pinned_mountpoint *mp,
|
| 3870 | int mnt_flags)
|
| 3871 | {
|
| 3872 | struct mount *parent = mp->parent;
|
| 3873 |
|
| 3874 | if (IS_ERR(parent))
|
| 3875 | return PTR_ERR(parent);
|
| 3876 |
|
| 3877 | mnt_flags &= ~MNT_INTERNAL_FLAGS;
|
| 3878 |
|
| 3879 | if (unlikely(!check_mnt(parent))) {
|
| 3880 |
|
| 3881 | if (!(mnt_flags & MNT_SHRINKABLE))
|
| 3882 | return -EINVAL;
|
| 3883 |
|
| 3884 | if (!is_mounted(&parent->mnt))
|
| 3885 | return -EINVAL;
|
| 3886 | }
|
| 3887 |
|
| 3888 |
|
| 3889 | if (parent->mnt.mnt_sb == newmnt->mnt.mnt_sb &&
|
| 3890 | parent->mnt.mnt_root == mp->mp->m_dentry)
|
| 3891 | return -EBUSY;
|
| 3892 |
|
| 3893 | if (d_is_symlink(newmnt->mnt.mnt_root))
|
| 3894 | return -EINVAL;
|
| 3895 |
|
| 3896 | newmnt->mnt.mnt_flags = mnt_flags;
|
| 3897 | return graft_tree(newmnt, mp);
|
| 3898 | }
|
| 3899 |
|
| 3900 | static bool mount_too_revealing(const struct super_block *sb, int *new_mnt_flags);
|
| 3901 |
|
| 3902 | |
| 3903 | * Create a new mount using a superblock configuration and request it
|
| 3904 | * be added to the namespace tree.
|
| 3905 |
|
| 3906 | static int do_new_mount_fc(struct fs_context *fc, const struct path *mountpoint,
|
| 3907 | unsigned int mnt_flags)
|
| 3908 | {
|
| 3909 | struct super_block *sb;
|
| 3910 | struct vfsmount *mnt __free(mntput) = fc_mount(fc);
|
| 3911 | int error;
|
| 3912 |
|
| 3913 | if (IS_ERR(mnt))
|
| 3914 | return PTR_ERR(mnt);
|
| 3915 |
|
| 3916 | sb = fc->root->d_sb;
|
| 3917 | error = security_sb_kern_mount(sb);
|
| 3918 | if (unlikely(error))
|
| 3919 | return error;
|
| 3920 |
|
| 3921 | if (unlikely(mount_too_revealing(sb, &mnt_flags))) {
|
| 3922 | errorfcp(fc, "VFS", "Mount too revealing");
|
| 3923 | return -EPERM;
|
| 3924 | }
|
| 3925 |
|
| 3926 | mnt_warn_timestamp_expiry(mountpoint, mnt);
|
| 3927 |
|
| 3928 | LOCK_MOUNT(mp, mountpoint);
|
| 3929 | error = do_add_mount(real_mount(mnt), &mp, mnt_flags);
|
| 3930 | if (!error)
|
| 3931 | retain_and_null_ptr(mnt); |
| 3932 | return error;
|
| 3933 | }
|
| 3934 |
|
| 3935 | |
| 3936 | * create a new mount for userspace and request it to be added into the
|
| 3937 | * namespace's tree
|
| 3938 |
|
| 3939 | static int do_new_mount(const struct path *path, const char *fstype,
|
| 3940 | int sb_flags, int mnt_flags,
|
| 3941 | const char *name, void *data)
|
| 3942 | {
|
| 3943 | struct file_system_type *type;
|
| 3944 | struct fs_context *fc;
|
| 3945 | const char *subtype = NULL;
|
| 3946 | int err = 0;
|
| 3947 |
|
| 3948 | if (!fstype)
|
| 3949 | return -EINVAL;
|
| 3950 |
|
| 3951 | type = get_fs_type(fstype);
|
| 3952 | if (!type)
|
| 3953 | return -ENODEV;
|
| 3954 |
|
| 3955 | if (type->fs_flags & FS_HAS_SUBTYPE) {
|
| 3956 | subtype = strchr(fstype, '.');
|
| 3957 | if (subtype) {
|
| 3958 | subtype++;
|
| 3959 | if (!*subtype) {
|
| 3960 | put_filesystem(type);
|
| 3961 | return -EINVAL;
|
| 3962 | }
|
| 3963 | }
|
| 3964 | }
|
| 3965 |
|
| 3966 | fc = fs_context_for_mount(type, sb_flags);
|
| 3967 | put_filesystem(type);
|
| 3968 | if (IS_ERR(fc))
|
| 3969 | return PTR_ERR(fc);
|
| 3970 |
|
| 3971 | |
| 3972 | * Indicate to the filesystem that the mount request is coming
|
| 3973 | * from the legacy mount system call.
|
| 3974 |
|
| 3975 | fc->oldapi = true;
|
| 3976 |
|
| 3977 | if (subtype)
|
| 3978 | err = vfs_parse_fs_string(fc, "subtype", subtype);
|
| 3979 | if (!err && name)
|
| 3980 | err = vfs_parse_fs_string(fc, "source", name);
|
| 3981 | if (!err)
|
| 3982 | err = parse_monolithic_mount_data(fc, data);
|
| 3983 | if (!err && !mount_capable(fc))
|
| 3984 | err = -EPERM;
|
| 3985 | if (!err)
|
| 3986 | err = do_new_mount_fc(fc, path, mnt_flags);
|
| 3987 |
|
| 3988 | put_fs_context(fc);
|
| 3989 | return err;
|
| 3990 | }
|
| 3991 |
|
| 3992 | static void lock_mount_exact(const struct path *path,
|
| 3993 | struct pinned_mountpoint *mp, bool copy_mount,
|
| 3994 | unsigned int copy_flags)
|
| 3995 | {
|
| 3996 | struct dentry *dentry = path->dentry;
|
| 3997 | int err;
|
| 3998 |
|
| 3999 |
|
| 4000 | VFS_WARN_ON_ONCE(copy_mount && !path_mounted(path));
|
| 4001 |
|
| 4002 | inode_lock(dentry->d_inode);
|
| 4003 | namespace_lock();
|
| 4004 | if (unlikely(cant_mount(dentry)))
|
| 4005 | err = -ENOENT;
|
| 4006 | else if (!copy_mount && path_overmounted(path))
|
| 4007 | err = -EBUSY;
|
| 4008 | else
|
| 4009 | err = get_mountpoint(dentry, mp);
|
| 4010 | if (unlikely(err)) {
|
| 4011 | namespace_unlock();
|
| 4012 | inode_unlock(dentry->d_inode);
|
| 4013 | mp->parent = ERR_PTR(err);
|
| 4014 | return;
|
| 4015 | }
|
| 4016 |
|
| 4017 | if (copy_mount)
|
| 4018 | mp->parent = clone_mnt(real_mount(path->mnt), dentry, copy_flags);
|
| 4019 | else
|
| 4020 | mp->parent = real_mount(path->mnt);
|
| 4021 | if (unlikely(IS_ERR(mp->parent)))
|
| 4022 | __unlock_mount(mp);
|
| 4023 | }
|
| 4024 |
|
| 4025 | int finish_automount(struct vfsmount *__m, const struct path *path)
|
| 4026 | {
|
| 4027 | struct vfsmount *m __free(mntput) = __m;
|
| 4028 | struct mount *mnt;
|
| 4029 | int err;
|
| 4030 |
|
| 4031 | if (!m)
|
| 4032 | return 0;
|
| 4033 | if (IS_ERR(m))
|
| 4034 | return PTR_ERR(m);
|
| 4035 |
|
| 4036 | mnt = real_mount(m);
|
| 4037 |
|
| 4038 | if (m->mnt_root == path->dentry)
|
| 4039 | return -ELOOP;
|
| 4040 |
|
| 4041 | |
| 4042 | * we don't want to use LOCK_MOUNT() - in this case finding something
|
| 4043 | * that overmounts our mountpoint to be means "quitely drop what we've
|
| 4044 | * got", not "try to mount it on top".
|
| 4045 |
|
| 4046 | LOCK_MOUNT_EXACT(mp, path);
|
| 4047 | if (mp.parent == ERR_PTR(-EBUSY))
|
| 4048 | return 0;
|
| 4049 |
|
| 4050 | err = do_add_mount(mnt, &mp, path->mnt->mnt_flags | MNT_SHRINKABLE);
|
| 4051 | if (likely(!err))
|
| 4052 | retain_and_null_ptr(m);
|
| 4053 | return err;
|
| 4054 | }
|
| 4055 |
|
| 4056 | |
| 4057 | * mnt_set_expiry - Put a mount on an expiration list
|
| 4058 | * @mnt: The mount to list.
|
| 4059 | * @expiry_list: The list to add the mount to.
|
| 4060 |
|
| 4061 | void mnt_set_expiry(struct vfsmount *mnt, struct list_head *expiry_list)
|
| 4062 | {
|
| 4063 | guard(mount_locked_reader)();
|
| 4064 | list_add_tail(&real_mount(mnt)->mnt_expire, expiry_list);
|
| 4065 | }
|
| 4066 | EXPORT_SYMBOL(mnt_set_expiry);
|
| 4067 |
|
| 4068 | |
| 4069 | * process a list of expirable mountpoints with the intent of discarding any
|
| 4070 | * mountpoints that aren't in use and haven't been touched since last we came
|
| 4071 | * here
|
| 4072 |
|
| 4073 | void mark_mounts_for_expiry(struct list_head *mounts)
|
| 4074 | {
|
| 4075 | struct mount *mnt, *next;
|
| 4076 | LIST_HEAD(graveyard);
|
| 4077 |
|
| 4078 | if (list_empty(mounts))
|
| 4079 | return;
|
| 4080 |
|
| 4081 | guard(namespace_excl)();
|
| 4082 | guard(mount_writer)();
|
| 4083 |
|
| 4084 | |
| 4085 | * following criteria:
|
| 4086 | * - already mounted
|
| 4087 | * - only referenced by its parent vfsmount
|
| 4088 | * - still marked for expiry (marked on the last call here; marks are
|
| 4089 | * cleared by mntput())
|
| 4090 |
|
| 4091 | list_for_each_entry_safe(mnt, next, mounts, mnt_expire) {
|
| 4092 | if (!is_mounted(&mnt->mnt))
|
| 4093 | continue;
|
| 4094 |
|
| 4095 | VFS_WARN_ON_ONCE(IS_MNT_LOCKED(mnt));
|
| 4096 | if (!xchg(&mnt->mnt_expiry_mark, 1) ||
|
| 4097 | propagate_mount_busy(mnt, 1))
|
| 4098 | continue;
|
| 4099 | list_move(&mnt->mnt_expire, &graveyard);
|
| 4100 | }
|
| 4101 | while (!list_empty(&graveyard)) {
|
| 4102 | mnt = list_first_entry(&graveyard, struct mount, mnt_expire);
|
| 4103 |
|
| 4104 | if (propagate_mount_busy(mnt, 1)) {
|
| 4105 | list_move(&mnt->mnt_expire, mounts);
|
| 4106 | continue;
|
| 4107 | }
|
| 4108 | touch_mnt_namespace(mnt->mnt_ns);
|
| 4109 | umount_tree(mnt, UMOUNT_PROPAGATE|UMOUNT_SYNC);
|
| 4110 | }
|
| 4111 | }
|
| 4112 |
|
| 4113 | EXPORT_SYMBOL_GPL(mark_mounts_for_expiry);
|
| 4114 |
|
| 4115 | |
| 4116 | * Unmount @mnt if it's a shrinkable mount without children that nobody uses.
|
| 4117 | *
|
| 4118 | * mount_lock must be held for write
|
| 4119 |
|
| 4120 | static bool shrink_submount(struct mount *mnt)
|
| 4121 | {
|
| 4122 |
|
| 4123 | if (IS_MNT_LOCKED(mnt) || propagate_mount_busy(mnt, 1))
|
| 4124 | return false;
|
| 4125 | touch_mnt_namespace(mnt->mnt_ns);
|
| 4126 | umount_tree(mnt, UMOUNT_PROPAGATE|UMOUNT_SYNC);
|
| 4127 | return true;
|
| 4128 | }
|
| 4129 |
|
| 4130 | |
| 4131 | * Ripoff of 'select_parent()'
|
| 4132 | *
|
| 4133 | * unmount the shrinkable submounts of @parent that aren't busy, children
|
| 4134 | * before their parent, and say whether anything went
|
| 4135 | *
|
| 4136 | * The cursor into the children of @this_parent survives the umount of a
|
| 4137 | * child mount without child mounts. The mounts that get umounted together with
|
| 4138 | * it are located under receiving mounts of @this_parent and never under
|
| 4139 | * @this_parent itself. The one exception is @this_parent getting unmounted
|
| 4140 | * then the walk starts over.
|
| 4141 |
|
| 4142 | static bool __shrink_submounts(struct mount *parent)
|
| 4143 | {
|
| 4144 | struct mount *this_parent = parent;
|
| 4145 | struct list_head *next;
|
| 4146 | bool shrunk = false;
|
| 4147 |
|
| 4148 | repeat:
|
| 4149 | next = this_parent->mnt_mounts.next;
|
| 4150 | resume:
|
| 4151 | while (next != &this_parent->mnt_mounts) {
|
| 4152 | struct list_head *tmp = next;
|
| 4153 | struct mount *mnt = list_entry(tmp, struct mount, mnt_child);
|
| 4154 |
|
| 4155 | next = tmp->next;
|
| 4156 | if (!(mnt->mnt.mnt_flags & MNT_SHRINKABLE))
|
| 4157 | continue;
|
| 4158 | |
| 4159 | * Descend a level if the d_mounts list is non-empty.
|
| 4160 |
|
| 4161 | if (!list_empty(&mnt->mnt_mounts)) {
|
| 4162 | this_parent = mnt;
|
| 4163 | goto repeat;
|
| 4164 | }
|
| 4165 | if (!shrink_submount(mnt))
|
| 4166 | continue;
|
| 4167 | shrunk = true;
|
| 4168 | if (unlikely(this_parent->mnt.mnt_flags & MNT_UMOUNT))
|
| 4169 | return true;
|
| 4170 | }
|
| 4171 | |
| 4172 | * All done at this level ... ascend and resume the search
|
| 4173 |
|
| 4174 | if (this_parent != parent) {
|
| 4175 | struct mount *mnt = this_parent;
|
| 4176 |
|
| 4177 | next = mnt->mnt_child.next;
|
| 4178 | this_parent = mnt->mnt_parent;
|
| 4179 |
|
| 4180 | if (shrink_submount(mnt)) {
|
| 4181 | shrunk = true;
|
| 4182 | if (unlikely(this_parent->mnt.mnt_flags & MNT_UMOUNT))
|
| 4183 | return true;
|
| 4184 | }
|
| 4185 | goto resume;
|
| 4186 | }
|
| 4187 | return shrunk;
|
| 4188 | }
|
| 4189 |
|
| 4190 | |
| 4191 | * unmount the shrinkable submounts of @mnt that aren't busy
|
| 4192 | *
|
| 4193 | * The busy check and the umount of a mount are adjacent. An umount can
|
| 4194 | * still empty or move a mount in a part of the tree that was walked
|
| 4195 | * already, so walk again until nothing goes.
|
| 4196 | *
|
| 4197 | * mount_lock must be held for write
|
| 4198 |
|
| 4199 | static void shrink_submounts(struct mount *mnt)
|
| 4200 | {
|
| 4201 | for (;;) {
|
| 4202 | if (!__shrink_submounts(mnt))
|
| 4203 | break;
|
| 4204 | }
|
| 4205 | }
|
| 4206 |
|
| 4207 | static void *copy_mount_options(const void __user * data)
|
| 4208 | {
|
| 4209 | char *copy;
|
| 4210 | unsigned left, offset;
|
| 4211 |
|
| 4212 | if (!data)
|
| 4213 | return NULL;
|
| 4214 |
|
| 4215 | copy = kmalloc(PAGE_SIZE, GFP_KERNEL);
|
| 4216 | if (!copy)
|
| 4217 | return ERR_PTR(-ENOMEM);
|
| 4218 |
|
| 4219 | left = copy_from_user(copy, data, PAGE_SIZE);
|
| 4220 |
|
| 4221 | |
| 4222 | * Not all architectures have an exact copy_from_user(). Resort to
|
| 4223 | * byte at a time.
|
| 4224 |
|
| 4225 | offset = PAGE_SIZE - left;
|
| 4226 | while (left) {
|
| 4227 | char c;
|
| 4228 | if (get_user(c, (const char __user *)data + offset))
|
| 4229 | break;
|
| 4230 | copy[offset] = c;
|
| 4231 | left--;
|
| 4232 | offset++;
|
| 4233 | }
|
| 4234 |
|
| 4235 | if (left == PAGE_SIZE) {
|
| 4236 | kfree(copy);
|
| 4237 | return ERR_PTR(-EFAULT);
|
| 4238 | }
|
| 4239 |
|
| 4240 | return copy;
|
| 4241 | }
|
| 4242 |
|
| 4243 | static char *copy_mount_string(const void __user *data)
|
| 4244 | {
|
| 4245 | return data ? strndup_user(data, PATH_MAX) : NULL;
|
| 4246 | }
|
| 4247 |
|
| 4248 | |
| 4249 | * Flags is a 32-bit value that allows up to 31 non-fs dependent flags to
|
| 4250 | * be given to the mount() call (ie: read-only, no-dev, no-suid etc).
|
| 4251 | *
|
| 4252 | * data is a (void *) that can point to any structure up to
|
| 4253 | * PAGE_SIZE-1 bytes, which can contain arbitrary fs-dependent
|
| 4254 | * information (or be NULL).
|
| 4255 | *
|
| 4256 | * Pre-0.97 versions of mount() didn't have a flags word.
|
| 4257 | * When the flags word was introduced its top half was required
|
| 4258 | * to have the magic value 0xC0ED, and this remained so until 2.4.0-test9.
|
| 4259 | * Therefore, if this magic number is present, it carries no information
|
| 4260 | * and must be discarded.
|
| 4261 |
|
| 4262 | int path_mount(const char *dev_name, const struct path *path,
|
| 4263 | const char *type_page, unsigned long flags, void *data_page)
|
| 4264 | {
|
| 4265 | unsigned int mnt_flags = 0, sb_flags;
|
| 4266 | int ret;
|
| 4267 |
|
| 4268 |
|
| 4269 | if ((flags & MS_MGC_MSK) == MS_MGC_VAL)
|
| 4270 | flags &= ~MS_MGC_MSK;
|
| 4271 |
|
| 4272 |
|
| 4273 | if (data_page)
|
| 4274 | ((char *)data_page)[PAGE_SIZE - 1] = 0;
|
| 4275 |
|
| 4276 | if (flags & MS_NOUSER)
|
| 4277 | return -EINVAL;
|
| 4278 |
|
| 4279 | ret = security_sb_mount(dev_name, path, type_page, flags, data_page);
|
| 4280 | if (ret)
|
| 4281 | return ret;
|
| 4282 | if (!may_mount())
|
| 4283 | return -EPERM;
|
| 4284 | if (flags & SB_MANDLOCK)
|
| 4285 | warn_mandlock();
|
| 4286 |
|
| 4287 |
|
| 4288 | if (!(flags & MS_NOATIME))
|
| 4289 | mnt_flags |= MNT_RELATIME;
|
| 4290 |
|
| 4291 |
|
| 4292 | if (flags & MS_NOSUID)
|
| 4293 | mnt_flags |= MNT_NOSUID;
|
| 4294 | if (flags & MS_NODEV)
|
| 4295 | mnt_flags |= MNT_NODEV;
|
| 4296 | if (flags & MS_NOEXEC)
|
| 4297 | mnt_flags |= MNT_NOEXEC;
|
| 4298 | if (flags & MS_NOATIME)
|
| 4299 | mnt_flags |= MNT_NOATIME;
|
| 4300 | if (flags & MS_NODIRATIME)
|
| 4301 | mnt_flags |= MNT_NODIRATIME;
|
| 4302 | if (flags & MS_STRICTATIME)
|
| 4303 | mnt_flags &= ~(MNT_RELATIME | MNT_NOATIME);
|
| 4304 | if (flags & MS_RDONLY)
|
| 4305 | mnt_flags |= MNT_READONLY;
|
| 4306 | if (flags & MS_NOSYMFOLLOW)
|
| 4307 | mnt_flags |= MNT_NOSYMFOLLOW;
|
| 4308 |
|
| 4309 |
|
| 4310 | if ((flags & MS_REMOUNT) &&
|
| 4311 | ((flags & (MS_NOATIME | MS_NODIRATIME | MS_RELATIME |
|
| 4312 | MS_STRICTATIME)) == 0)) {
|
| 4313 | mnt_flags &= ~MNT_ATIME_MASK;
|
| 4314 | mnt_flags |= path->mnt->mnt_flags & MNT_ATIME_MASK;
|
| 4315 | }
|
| 4316 |
|
| 4317 | sb_flags = flags & (SB_RDONLY |
|
| 4318 | SB_SYNCHRONOUS |
|
| 4319 | SB_MANDLOCK |
|
| 4320 | SB_DIRSYNC |
|
| 4321 | SB_SILENT |
|
| 4322 | SB_POSIXACL |
|
| 4323 | SB_LAZYTIME |
|
| 4324 | SB_I_VERSION);
|
| 4325 |
|
| 4326 | if ((flags & (MS_REMOUNT | MS_BIND)) == (MS_REMOUNT | MS_BIND))
|
| 4327 | return do_reconfigure_mnt(path, mnt_flags);
|
| 4328 | if (flags & MS_REMOUNT)
|
| 4329 | return do_remount(path, sb_flags, mnt_flags, data_page);
|
| 4330 | if (flags & MS_BIND)
|
| 4331 | return do_loopback(path, dev_name, flags & MS_REC);
|
| 4332 | if (flags & (MS_SHARED | MS_PRIVATE | MS_SLAVE | MS_UNBINDABLE))
|
| 4333 | return do_change_type(path, flags);
|
| 4334 | if (flags & MS_MOVE)
|
| 4335 | return do_move_mount_old(path, dev_name);
|
| 4336 |
|
| 4337 | return do_new_mount(path, type_page, sb_flags, mnt_flags, dev_name,
|
| 4338 | data_page);
|
| 4339 | }
|
| 4340 |
|
| 4341 | int do_mount(const char *dev_name, const char __user *dir_name,
|
| 4342 | const char *type_page, unsigned long flags, void *data_page)
|
| 4343 | {
|
| 4344 | struct path path __free(path_put) = {};
|
| 4345 | int ret;
|
| 4346 |
|
| 4347 | ret = user_path_at(AT_FDCWD, dir_name, LOOKUP_FOLLOW, &path);
|
| 4348 | if (ret)
|
| 4349 | return ret;
|
| 4350 | return path_mount(dev_name, &path, type_page, flags, data_page);
|
| 4351 | }
|
| 4352 |
|
| 4353 | static struct ucounts *inc_mnt_namespaces(struct user_namespace *ns)
|
| 4354 | {
|
| 4355 | return inc_ucount(ns, current_euid(), UCOUNT_MNT_NAMESPACES);
|
| 4356 | }
|
| 4357 |
|
| 4358 | static void dec_mnt_namespaces(struct ucounts *ucounts)
|
| 4359 | {
|
| 4360 | dec_ucount(ucounts, UCOUNT_MNT_NAMESPACES);
|
| 4361 | }
|
| 4362 |
|
| 4363 | static void free_mnt_ns(struct mnt_namespace *ns)
|
| 4364 | {
|
| 4365 | if (!is_anon_ns(ns))
|
| 4366 | ns_common_free(ns);
|
| 4367 | dec_mnt_namespaces(ns->ucounts);
|
| 4368 |
|
| 4369 | fsnotify_mntns_delete(ns);
|
| 4370 | mnt_ns_tree_remove(ns);
|
| 4371 | }
|
| 4372 |
|
| 4373 | static struct mnt_namespace *alloc_mnt_ns(struct user_namespace *user_ns, bool anon)
|
| 4374 | {
|
| 4375 | struct mnt_namespace *new_ns;
|
| 4376 | struct ucounts *ucounts;
|
| 4377 | int ret;
|
| 4378 |
|
| 4379 | ucounts = inc_mnt_namespaces(user_ns);
|
| 4380 | if (!ucounts)
|
| 4381 | return ERR_PTR(-ENOSPC);
|
| 4382 |
|
| 4383 | new_ns = kzalloc_obj(struct mnt_namespace, GFP_KERNEL_ACCOUNT);
|
| 4384 | if (!new_ns) {
|
| 4385 | dec_mnt_namespaces(ucounts);
|
| 4386 | return ERR_PTR(-ENOMEM);
|
| 4387 | }
|
| 4388 |
|
| 4389 | if (anon)
|
| 4390 | ret = ns_common_init_inum(new_ns, MNT_NS_ANON_INO);
|
| 4391 | else
|
| 4392 | ret = ns_common_init(new_ns);
|
| 4393 | if (ret) {
|
| 4394 | kfree(new_ns);
|
| 4395 | dec_mnt_namespaces(ucounts);
|
| 4396 | return ERR_PTR(ret);
|
| 4397 | }
|
| 4398 | ns_tree_gen_id(new_ns);
|
| 4399 |
|
| 4400 | new_ns->is_anon = anon;
|
| 4401 | refcount_set(&new_ns->passive, 1);
|
| 4402 | new_ns->mounts = RB_ROOT;
|
| 4403 | init_waitqueue_head(&new_ns->poll);
|
| 4404 | new_ns->user_ns = get_user_ns(user_ns);
|
| 4405 | new_ns->ucounts = ucounts;
|
| 4406 | return new_ns;
|
| 4407 | }
|
| 4408 |
|
| 4409 | __latent_entropy
|
| 4410 | struct mnt_namespace *copy_mnt_ns(u64 flags, struct mnt_namespace *ns,
|
| 4411 | struct user_namespace *user_ns, struct fs_struct *new_fs)
|
| 4412 | {
|
| 4413 | struct mnt_namespace *new_ns;
|
| 4414 | struct path old_root __free(path_put) = {};
|
| 4415 | struct path old_pwd __free(path_put) = {};
|
| 4416 | struct mount *p, *q;
|
| 4417 | struct mount *old;
|
| 4418 | struct mount *new;
|
| 4419 | int copy_flags;
|
| 4420 |
|
| 4421 | if (likely(!(flags & CLONE_NEWNS))) {
|
| 4422 | get_mnt_ns(ns);
|
| 4423 | return ns;
|
| 4424 | }
|
| 4425 |
|
| 4426 | old = ns->root;
|
| 4427 |
|
| 4428 | new_ns = alloc_mnt_ns(user_ns, false);
|
| 4429 | if (IS_ERR(new_ns))
|
| 4430 | return new_ns;
|
| 4431 |
|
| 4432 | guard(namespace_excl)();
|
| 4433 |
|
| 4434 | if (flags & CLONE_EMPTY_MNTNS)
|
| 4435 | copy_flags = 0;
|
| 4436 | else
|
| 4437 | copy_flags = CL_COPY_UNBINDABLE | CL_EXPIRE;
|
| 4438 | if (user_ns != ns->user_ns)
|
| 4439 | copy_flags |= CL_SLAVE;
|
| 4440 |
|
| 4441 | if (flags & CLONE_EMPTY_MNTNS)
|
| 4442 | new = clone_mnt(old, old->mnt.mnt_root, copy_flags);
|
| 4443 | else
|
| 4444 | new = copy_tree(old, old->mnt.mnt_root, copy_flags);
|
| 4445 | if (IS_ERR(new)) {
|
| 4446 | emptied_ns = new_ns;
|
| 4447 | return ERR_CAST(new);
|
| 4448 | }
|
| 4449 | if (user_ns != ns->user_ns) {
|
| 4450 | guard(mount_writer)();
|
| 4451 | lock_mnt_tree(new);
|
| 4452 | }
|
| 4453 | new_ns->root = new;
|
| 4454 |
|
| 4455 | if (flags & CLONE_EMPTY_MNTNS) {
|
| 4456 | |
| 4457 | * Empty mount namespace: only the root mount exists.
|
| 4458 | * Reset root and pwd to the cloned mount's root dentry.
|
| 4459 |
|
| 4460 | if (new_fs) {
|
| 4461 | old_root = new_fs->root;
|
| 4462 | old_pwd = new_fs->pwd;
|
| 4463 |
|
| 4464 | new_fs->root.mnt = mntget(&new->mnt);
|
| 4465 | new_fs->root.dentry = dget(new->mnt.mnt_root);
|
| 4466 |
|
| 4467 | new_fs->pwd.mnt = mntget(&new->mnt);
|
| 4468 | new_fs->pwd.dentry = dget(new->mnt.mnt_root);
|
| 4469 | }
|
| 4470 | mnt_add_to_ns(new_ns, new);
|
| 4471 | new_ns->nr_mounts++;
|
| 4472 | } else {
|
| 4473 | |
| 4474 | * Full copy: walk old and new trees in parallel, switching
|
| 4475 | * the tsk->fs->* elements and marking new vfsmounts as
|
| 4476 | * belonging to new namespace. We have already acquired a
|
| 4477 | * private fs_struct, so tsk->fs->lock is not needed.
|
| 4478 |
|
| 4479 | p = old;
|
| 4480 | q = new;
|
| 4481 | while (p) {
|
| 4482 | mnt_add_to_ns(new_ns, q);
|
| 4483 | new_ns->nr_mounts++;
|
| 4484 | if (new_fs) {
|
| 4485 | if (&p->mnt == new_fs->root.mnt) {
|
| 4486 | old_root.mnt = new_fs->root.mnt;
|
| 4487 | new_fs->root.mnt = mntget(&q->mnt);
|
| 4488 | }
|
| 4489 | if (&p->mnt == new_fs->pwd.mnt) {
|
| 4490 | old_pwd.mnt = new_fs->pwd.mnt;
|
| 4491 | new_fs->pwd.mnt = mntget(&q->mnt);
|
| 4492 | }
|
| 4493 | }
|
| 4494 | p = next_mnt(p, old);
|
| 4495 | q = next_mnt(q, new);
|
| 4496 | if (!q)
|
| 4497 | break;
|
| 4498 | |
| 4499 | while (p->mnt.mnt_root != q->mnt.mnt_root)
|
| 4500 | p = next_mnt(skip_mnt_tree(p), old);
|
| 4501 | }
|
| 4502 | }
|
| 4503 | ns_tree_add_raw(new_ns);
|
| 4504 | return new_ns;
|
| 4505 | }
|
| 4506 |
|
| 4507 | struct dentry *mount_subtree(struct vfsmount *m, const char *name)
|
| 4508 | {
|
| 4509 | struct mount *mnt = real_mount(m);
|
| 4510 | struct mnt_namespace *ns;
|
| 4511 | struct super_block *s;
|
| 4512 | struct path path;
|
| 4513 | int err;
|
| 4514 |
|
| 4515 | ns = alloc_mnt_ns(&init_user_ns, true);
|
| 4516 | if (IS_ERR(ns)) {
|
| 4517 | mntput(m);
|
| 4518 | return ERR_CAST(ns);
|
| 4519 | }
|
| 4520 | ns->root = mnt;
|
| 4521 | ns->nr_mounts++;
|
| 4522 | mnt_add_to_ns(ns, mnt);
|
| 4523 |
|
| 4524 | err = vfs_path_lookup(m->mnt_root, m,
|
| 4525 | name, LOOKUP_FOLLOW|LOOKUP_AUTOMOUNT, &path);
|
| 4526 |
|
| 4527 | put_mnt_ns(ns);
|
| 4528 |
|
| 4529 | if (err)
|
| 4530 | return ERR_PTR(err);
|
| 4531 |
|
| 4532 |
|
| 4533 | s = path.mnt->mnt_sb;
|
| 4534 | atomic_inc(&s->s_active);
|
| 4535 | mntput(path.mnt);
|
| 4536 |
|
| 4537 | down_write(&s->s_umount);
|
| 4538 |
|
| 4539 | return path.dentry;
|
| 4540 | }
|
| 4541 | EXPORT_SYMBOL(mount_subtree);
|
| 4542 |
|
| 4543 | SYSCALL_DEFINE5(mount, char __user *, dev_name, char __user *, dir_name,
|
| 4544 | char __user *, type, unsigned long, flags, void __user *, data)
|
| 4545 | {
|
| 4546 | int ret;
|
| 4547 | char *kernel_type;
|
| 4548 | char *kernel_dev;
|
| 4549 | void *options;
|
| 4550 |
|
| 4551 | kernel_type = copy_mount_string(type);
|
| 4552 | ret = PTR_ERR(kernel_type);
|
| 4553 | if (IS_ERR(kernel_type))
|
| 4554 | goto out_type;
|
| 4555 |
|
| 4556 | kernel_dev = copy_mount_string(dev_name);
|
| 4557 | ret = PTR_ERR(kernel_dev);
|
| 4558 | if (IS_ERR(kernel_dev))
|
| 4559 | goto out_dev;
|
| 4560 |
|
| 4561 | options = copy_mount_options(data);
|
| 4562 | ret = PTR_ERR(options);
|
| 4563 | if (IS_ERR(options))
|
| 4564 | goto out_data;
|
| 4565 |
|
| 4566 | ret = do_mount(kernel_dev, dir_name, kernel_type, flags, options);
|
| 4567 |
|
| 4568 | kfree(options);
|
| 4569 | out_data:
|
| 4570 | kfree(kernel_dev);
|
| 4571 | out_dev:
|
| 4572 | kfree(kernel_type);
|
| 4573 | out_type:
|
| 4574 | return ret;
|
| 4575 | }
|
| 4576 |
|
| 4577 | #define FSMOUNT_VALID_FLAGS \
|
| 4578 | (MOUNT_ATTR_RDONLY | MOUNT_ATTR_NOSUID | MOUNT_ATTR_NODEV | \
|
| 4579 | MOUNT_ATTR_NOEXEC | MOUNT_ATTR__ATIME | MOUNT_ATTR_NODIRATIME | \
|
| 4580 | MOUNT_ATTR_NOSYMFOLLOW)
|
| 4581 |
|
| 4582 | #define MOUNT_SETATTR_VALID_FLAGS (FSMOUNT_VALID_FLAGS | MOUNT_ATTR_IDMAP)
|
| 4583 |
|
| 4584 | #define MOUNT_SETATTR_PROPAGATION_FLAGS \
|
| 4585 | (MS_UNBINDABLE | MS_PRIVATE | MS_SLAVE | MS_SHARED)
|
| 4586 |
|
| 4587 | static unsigned int attr_flags_to_mnt_flags(u64 attr_flags)
|
| 4588 | {
|
| 4589 | unsigned int mnt_flags = 0;
|
| 4590 |
|
| 4591 | if (attr_flags & MOUNT_ATTR_RDONLY)
|
| 4592 | mnt_flags |= MNT_READONLY;
|
| 4593 | if (attr_flags & MOUNT_ATTR_NOSUID)
|
| 4594 | mnt_flags |= MNT_NOSUID;
|
| 4595 | if (attr_flags & MOUNT_ATTR_NODEV)
|
| 4596 | mnt_flags |= MNT_NODEV;
|
| 4597 | if (attr_flags & MOUNT_ATTR_NOEXEC)
|
| 4598 | mnt_flags |= MNT_NOEXEC;
|
| 4599 | if (attr_flags & MOUNT_ATTR_NODIRATIME)
|
| 4600 | mnt_flags |= MNT_NODIRATIME;
|
| 4601 | if (attr_flags & MOUNT_ATTR_NOSYMFOLLOW)
|
| 4602 | mnt_flags |= MNT_NOSYMFOLLOW;
|
| 4603 |
|
| 4604 | return mnt_flags;
|
| 4605 | }
|
| 4606 |
|
| 4607 | |
| 4608 | * Create a kernel mount representation for a new, prepared superblock
|
| 4609 | * (specified by fs_fd) and attach to an open_tree-like file descriptor.
|
| 4610 |
|
| 4611 | SYSCALL_DEFINE3(fsmount, int, fs_fd, unsigned int, flags,
|
| 4612 | unsigned int, attr_flags)
|
| 4613 | {
|
| 4614 | struct path new_path __free(path_put) = {};
|
| 4615 | struct mnt_namespace *ns;
|
| 4616 | struct fs_context *fc;
|
| 4617 | struct vfsmount *new_mnt;
|
| 4618 | struct mount *mnt;
|
| 4619 | unsigned int mnt_flags = 0;
|
| 4620 | long ret;
|
| 4621 |
|
| 4622 | if ((flags & ~(FSMOUNT_CLOEXEC | FSMOUNT_NAMESPACE)) != 0)
|
| 4623 | return -EINVAL;
|
| 4624 |
|
| 4625 | if ((flags & FSMOUNT_NAMESPACE) &&
|
| 4626 | !ns_capable(current_user_ns(), CAP_SYS_ADMIN))
|
| 4627 | return -EPERM;
|
| 4628 |
|
| 4629 | if (!(flags & FSMOUNT_NAMESPACE) && !may_mount())
|
| 4630 | return -EPERM;
|
| 4631 |
|
| 4632 | if (attr_flags & ~FSMOUNT_VALID_FLAGS)
|
| 4633 | return -EINVAL;
|
| 4634 |
|
| 4635 | mnt_flags = attr_flags_to_mnt_flags(attr_flags);
|
| 4636 |
|
| 4637 | switch (attr_flags & MOUNT_ATTR__ATIME) {
|
| 4638 | case MOUNT_ATTR_STRICTATIME:
|
| 4639 | break;
|
| 4640 | case MOUNT_ATTR_NOATIME:
|
| 4641 | mnt_flags |= MNT_NOATIME;
|
| 4642 | break;
|
| 4643 | case MOUNT_ATTR_RELATIME:
|
| 4644 | mnt_flags |= MNT_RELATIME;
|
| 4645 | break;
|
| 4646 | default:
|
| 4647 | return -EINVAL;
|
| 4648 | }
|
| 4649 |
|
| 4650 | CLASS(fd, f)(fs_fd);
|
| 4651 | if (fd_empty(f))
|
| 4652 | return -EBADF;
|
| 4653 |
|
| 4654 | if (fd_file(f)->f_op != &fscontext_fops)
|
| 4655 | return -EINVAL;
|
| 4656 |
|
| 4657 | fc = fd_file(f)->private_data;
|
| 4658 |
|
| 4659 | ACQUIRE(mutex_intr, uapi_mutex)(&fc->uapi_mutex);
|
| 4660 | ret = ACQUIRE_ERR(mutex_intr, &uapi_mutex);
|
| 4661 | if (ret)
|
| 4662 | return ret;
|
| 4663 |
|
| 4664 |
|
| 4665 | ret = -EINVAL;
|
| 4666 | if (!fc->root)
|
| 4667 | return ret;
|
| 4668 |
|
| 4669 | ret = -EPERM;
|
| 4670 | if (mount_too_revealing(fc->root->d_sb, &mnt_flags)) {
|
| 4671 | errorfcp(fc, "VFS", "Mount too revealing");
|
| 4672 | return ret;
|
| 4673 | }
|
| 4674 |
|
| 4675 | ret = -EBUSY;
|
| 4676 | if (fc->phase != FS_CONTEXT_AWAITING_MOUNT)
|
| 4677 | return ret;
|
| 4678 |
|
| 4679 | if (fc->sb_flags & SB_MANDLOCK)
|
| 4680 | warn_mandlock();
|
| 4681 |
|
| 4682 | new_mnt = vfs_create_mount(fc);
|
| 4683 | if (IS_ERR(new_mnt))
|
| 4684 | return PTR_ERR(new_mnt);
|
| 4685 | if (new_mnt->mnt_sb->s_flags & SB_NOUSER) {
|
| 4686 | mntput(new_mnt);
|
| 4687 | return -EINVAL;
|
| 4688 | }
|
| 4689 | new_mnt->mnt_flags = mnt_flags;
|
| 4690 |
|
| 4691 | new_path.dentry = dget(fc->root);
|
| 4692 | new_path.mnt = new_mnt;
|
| 4693 |
|
| 4694 | |
| 4695 | * less the same state as if we'd done an fspick(). We don't want to
|
| 4696 | * do any memory allocation or anything like that at this point as we
|
| 4697 | * don't want to have to handle any errors incurred.
|
| 4698 |
|
| 4699 | vfs_clean_context(fc);
|
| 4700 |
|
| 4701 | if (flags & FSMOUNT_NAMESPACE)
|
| 4702 | return FD_ADD((flags & FSMOUNT_CLOEXEC) ? O_CLOEXEC : 0,
|
| 4703 | open_new_namespace(&new_path, MOUNT_COPY_NEW));
|
| 4704 |
|
| 4705 | ns = alloc_mnt_ns(current->nsproxy->mnt_ns->user_ns, true);
|
| 4706 | if (IS_ERR(ns))
|
| 4707 | return PTR_ERR(ns);
|
| 4708 | mnt = real_mount(new_path.mnt);
|
| 4709 | ns->root = mnt;
|
| 4710 | ns->nr_mounts = 1;
|
| 4711 | mnt_add_to_ns(ns, mnt);
|
| 4712 | mntget(new_path.mnt);
|
| 4713 |
|
| 4714 | FD_PREPARE(fdf, (flags & FSMOUNT_CLOEXEC) ? O_CLOEXEC : 0,
|
| 4715 | dentry_open(&new_path, O_PATH, fc->cred));
|
| 4716 | if (fdf->fd < 0) {
|
| 4717 | dissolve_on_fput(no_free_ptr(new_path.mnt));
|
| 4718 | return fdf->fd;
|
| 4719 | }
|
| 4720 |
|
| 4721 | |
| 4722 | * Attach to an apparent O_PATH fd with a note that we
|
| 4723 | * need to unmount it, not just simply put it.
|
| 4724 |
|
| 4725 | fdf->file->f_mode |= FMODE_NEED_UNMOUNT;
|
| 4726 | return fd_publish(fdf);
|
| 4727 | }
|
| 4728 |
|
| 4729 | static inline int vfs_move_mount(const struct path *from_path,
|
| 4730 | const struct path *to_path,
|
| 4731 | enum mnt_tree_flags_t mflags)
|
| 4732 | {
|
| 4733 | int ret;
|
| 4734 |
|
| 4735 | ret = security_move_mount(from_path, to_path);
|
| 4736 | if (ret)
|
| 4737 | return ret;
|
| 4738 |
|
| 4739 | if (mflags & MNT_TREE_PROPAGATION)
|
| 4740 | return do_set_group(from_path, to_path);
|
| 4741 |
|
| 4742 | return do_move_mount(from_path, to_path, mflags);
|
| 4743 | }
|
| 4744 |
|
| 4745 | |
| 4746 | * Move a mount from one place to another. In combination with
|
| 4747 | * fsopen()/fsmount() this is used to install a new mount and in combination
|
| 4748 | * with open_tree(OPEN_TREE_CLONE [| AT_RECURSIVE]) it can be used to copy
|
| 4749 | * a mount subtree.
|
| 4750 | *
|
| 4751 | * Note the flags value is a combination of MOVE_MOUNT_* flags.
|
| 4752 |
|
| 4753 | SYSCALL_DEFINE5(move_mount,
|
| 4754 | int, from_dfd, const char __user *, from_pathname,
|
| 4755 | int, to_dfd, const char __user *, to_pathname,
|
| 4756 | unsigned int, flags)
|
| 4757 | {
|
| 4758 | struct path to_path __free(path_put) = {};
|
| 4759 | struct path from_path __free(path_put) = {};
|
| 4760 | unsigned int lflags, uflags;
|
| 4761 | enum mnt_tree_flags_t mflags = 0;
|
| 4762 | int ret = 0;
|
| 4763 |
|
| 4764 | if (!may_mount())
|
| 4765 | return -EPERM;
|
| 4766 |
|
| 4767 | if (flags & ~MOVE_MOUNT__MASK)
|
| 4768 | return -EINVAL;
|
| 4769 |
|
| 4770 | if ((flags & (MOVE_MOUNT_BENEATH | MOVE_MOUNT_SET_GROUP)) ==
|
| 4771 | (MOVE_MOUNT_BENEATH | MOVE_MOUNT_SET_GROUP))
|
| 4772 | return -EINVAL;
|
| 4773 |
|
| 4774 | if (flags & MOVE_MOUNT_SET_GROUP) mflags |= MNT_TREE_PROPAGATION;
|
| 4775 | if (flags & MOVE_MOUNT_BENEATH) mflags |= MNT_TREE_BENEATH;
|
| 4776 |
|
| 4777 | uflags = 0;
|
| 4778 | if (flags & MOVE_MOUNT_T_EMPTY_PATH)
|
| 4779 | uflags = AT_EMPTY_PATH;
|
| 4780 |
|
| 4781 | CLASS(filename_maybe_null,to_name)(to_pathname, uflags);
|
| 4782 | if (!to_name && to_dfd >= 0) {
|
| 4783 | CLASS(fd_raw, f_to)(to_dfd);
|
| 4784 | if (fd_empty(f_to))
|
| 4785 | return -EBADF;
|
| 4786 |
|
| 4787 | to_path = fd_file(f_to)->f_path;
|
| 4788 | path_get(&to_path);
|
| 4789 | } else {
|
| 4790 | lflags = 0;
|
| 4791 | if (flags & MOVE_MOUNT_T_SYMLINKS)
|
| 4792 | lflags |= LOOKUP_FOLLOW;
|
| 4793 | if (flags & MOVE_MOUNT_T_AUTOMOUNTS)
|
| 4794 | lflags |= LOOKUP_AUTOMOUNT;
|
| 4795 | ret = filename_lookup(to_dfd, to_name, lflags, &to_path, NULL);
|
| 4796 | if (ret)
|
| 4797 | return ret;
|
| 4798 | }
|
| 4799 |
|
| 4800 | uflags = 0;
|
| 4801 | if (flags & MOVE_MOUNT_F_EMPTY_PATH)
|
| 4802 | uflags = AT_EMPTY_PATH;
|
| 4803 |
|
| 4804 | CLASS(filename_maybe_null,from_name)(from_pathname, uflags);
|
| 4805 | if (!from_name && from_dfd >= 0) {
|
| 4806 | CLASS(fd_raw, f_from)(from_dfd);
|
| 4807 | if (fd_empty(f_from))
|
| 4808 | return -EBADF;
|
| 4809 |
|
| 4810 | return vfs_move_mount(&fd_file(f_from)->f_path, &to_path, mflags);
|
| 4811 | }
|
| 4812 |
|
| 4813 | lflags = 0;
|
| 4814 | if (flags & MOVE_MOUNT_F_SYMLINKS)
|
| 4815 | lflags |= LOOKUP_FOLLOW;
|
| 4816 | if (flags & MOVE_MOUNT_F_AUTOMOUNTS)
|
| 4817 | lflags |= LOOKUP_AUTOMOUNT;
|
| 4818 | ret = filename_lookup(from_dfd, from_name, lflags, &from_path, NULL);
|
| 4819 | if (ret)
|
| 4820 | return ret;
|
| 4821 |
|
| 4822 | return vfs_move_mount(&from_path, &to_path, mflags);
|
| 4823 | }
|
| 4824 |
|
| 4825 | |
| 4826 | * Return true if path is reachable from root
|
| 4827 | *
|
| 4828 | * locks: mount_locked_reader || namespace_shared && is_mounted(mnt)
|
| 4829 |
|
| 4830 | bool is_path_reachable(struct mount *mnt, struct dentry *dentry,
|
| 4831 | const struct path *root)
|
| 4832 | {
|
| 4833 | while (&mnt->mnt != root->mnt && mnt_has_parent(mnt)) {
|
| 4834 | dentry = mnt->mnt_mountpoint;
|
| 4835 | mnt = mnt->mnt_parent;
|
| 4836 | }
|
| 4837 | return &mnt->mnt == root->mnt && is_subdir(dentry, root->dentry);
|
| 4838 | }
|
| 4839 |
|
| 4840 | bool path_is_under(const struct path *path1, const struct path *path2)
|
| 4841 | {
|
| 4842 | guard(mount_locked_reader)();
|
| 4843 | return is_path_reachable(real_mount(path1->mnt), path1->dentry, path2);
|
| 4844 | }
|
| 4845 | EXPORT_SYMBOL(path_is_under);
|
| 4846 |
|
| 4847 | int path_pivot_root(struct path *new, struct path *old)
|
| 4848 | {
|
| 4849 | struct path root __free(path_put) = {};
|
| 4850 | struct mount *new_mnt, *root_mnt, *old_mnt, *root_parent, *ex_parent;
|
| 4851 | int error;
|
| 4852 |
|
| 4853 | if (!may_mount())
|
| 4854 | return -EPERM;
|
| 4855 |
|
| 4856 | error = security_sb_pivotroot(old, new);
|
| 4857 | if (error)
|
| 4858 | return error;
|
| 4859 |
|
| 4860 | get_fs_root(current->fs, &root);
|
| 4861 |
|
| 4862 | LOCK_MOUNT(old_mp, old);
|
| 4863 | old_mnt = old_mp.parent;
|
| 4864 | if (IS_ERR(old_mnt))
|
| 4865 | return PTR_ERR(old_mnt);
|
| 4866 |
|
| 4867 | new_mnt = real_mount(new->mnt);
|
| 4868 | root_mnt = real_mount(root.mnt);
|
| 4869 |
|
| 4870 | if (!check_mnt(root_mnt) || !check_mnt(new_mnt))
|
| 4871 | return -EINVAL;
|
| 4872 | ex_parent = new_mnt->mnt_parent;
|
| 4873 | root_parent = root_mnt->mnt_parent;
|
| 4874 | if (IS_MNT_SHARED(old_mnt) ||
|
| 4875 | IS_MNT_SHARED(ex_parent) ||
|
| 4876 | IS_MNT_SHARED(root_parent))
|
| 4877 | return -EINVAL;
|
| 4878 | if (new_mnt->mnt.mnt_flags & MNT_LOCKED)
|
| 4879 | return -EINVAL;
|
| 4880 | if (d_unlinked(new->dentry))
|
| 4881 | return -ENOENT;
|
| 4882 | if (new_mnt == root_mnt || old_mnt == root_mnt)
|
| 4883 | return -EBUSY;
|
| 4884 | if (!path_mounted(&root))
|
| 4885 | return -EINVAL;
|
| 4886 | if (!mnt_has_parent(root_mnt))
|
| 4887 | return -EINVAL;
|
| 4888 | if (!path_mounted(new))
|
| 4889 | return -EINVAL;
|
| 4890 | if (!mnt_has_parent(new_mnt))
|
| 4891 | return -EINVAL;
|
| 4892 |
|
| 4893 | if (!is_path_reachable(old_mnt, old_mp.mp->m_dentry, new))
|
| 4894 | return -EINVAL;
|
| 4895 |
|
| 4896 | if (!is_path_reachable(new_mnt, new->dentry, &root))
|
| 4897 | return -EINVAL;
|
| 4898 | lock_mount_hash();
|
| 4899 | umount_mnt(new_mnt);
|
| 4900 | if (root_mnt->mnt.mnt_flags & MNT_LOCKED) {
|
| 4901 | new_mnt->mnt.mnt_flags |= MNT_LOCKED;
|
| 4902 | root_mnt->mnt.mnt_flags &= ~MNT_LOCKED;
|
| 4903 | }
|
| 4904 |
|
| 4905 | attach_mnt(new_mnt, root_parent, root_mnt->mnt_mp);
|
| 4906 | umount_mnt(root_mnt);
|
| 4907 |
|
| 4908 | attach_mnt(root_mnt, old_mnt, old_mp.mp);
|
| 4909 | touch_mnt_namespace(current->nsproxy->mnt_ns);
|
| 4910 |
|
| 4911 | list_del_init(&new_mnt->mnt_expire);
|
| 4912 | unlock_mount_hash();
|
| 4913 | mnt_notify_add(root_mnt);
|
| 4914 | mnt_notify_add(new_mnt);
|
| 4915 | chroot_fs_refs(&root, new);
|
| 4916 | return 0;
|
| 4917 | }
|
| 4918 |
|
| 4919 | |
| 4920 | * pivot_root Semantics:
|
| 4921 | * Moves the root file system of the current process to the directory put_old,
|
| 4922 | * makes new_root as the new root file system of the current process, and sets
|
| 4923 | * root/cwd of all processes which had them on the current root to new_root.
|
| 4924 | *
|
| 4925 | * Restrictions:
|
| 4926 | * The new_root and put_old must be directories, and must not be on the
|
| 4927 | * same file system as the current process root. The put_old must be
|
| 4928 | * underneath new_root, i.e. adding a non-zero number of /.. to the string
|
| 4929 | * pointed to by put_old must yield the same directory as new_root. No other
|
| 4930 | * file system may be mounted on put_old. After all, new_root is a mountpoint.
|
| 4931 | *
|
| 4932 | * The immutable nullfs filesystem is mounted as the true root of the VFS
|
| 4933 | * hierarchy. The mutable rootfs (tmpfs/ramfs) is layered on top of this,
|
| 4934 | * allowing pivot_root() to work normally from initramfs.
|
| 4935 | *
|
| 4936 | * Notes:
|
| 4937 | * - we don't move root/cwd if they are not at the root (reason: if something
|
| 4938 | * cared enough to change them, it's probably wrong to force them elsewhere)
|
| 4939 | * - it's okay to pick a root that isn't the root of a file system, e.g.
|
| 4940 | * /nfs/my_root where /nfs is the mount point. It must be a mountpoint,
|
| 4941 | * though, so you may need to say mount --bind /nfs/my_root /nfs/my_root
|
| 4942 | * first.
|
| 4943 |
|
| 4944 | SYSCALL_DEFINE2(pivot_root, const char __user *, new_root,
|
| 4945 | const char __user *, put_old)
|
| 4946 | {
|
| 4947 | struct path new __free(path_put) = {};
|
| 4948 | struct path old __free(path_put) = {};
|
| 4949 | int error;
|
| 4950 |
|
| 4951 | error = user_path_at(AT_FDCWD, new_root,
|
| 4952 | LOOKUP_FOLLOW | LOOKUP_DIRECTORY, &new);
|
| 4953 | if (error)
|
| 4954 | return error;
|
| 4955 |
|
| 4956 | error = user_path_at(AT_FDCWD, put_old,
|
| 4957 | LOOKUP_FOLLOW | LOOKUP_DIRECTORY, &old);
|
| 4958 | if (error)
|
| 4959 | return error;
|
| 4960 |
|
| 4961 | return path_pivot_root(&new, &old);
|
| 4962 | }
|
| 4963 |
|
| 4964 | static unsigned int recalc_flags(struct mount_kattr *kattr, struct mount *mnt)
|
| 4965 | {
|
| 4966 | unsigned int flags = mnt->mnt.mnt_flags;
|
| 4967 |
|
| 4968 |
|
| 4969 | flags &= ~kattr->attr_clr;
|
| 4970 |
|
| 4971 | flags |= kattr->attr_set;
|
| 4972 |
|
| 4973 | return flags;
|
| 4974 | }
|
| 4975 |
|
| 4976 | static int can_idmap_mount(const struct mount_kattr *kattr, struct mount *mnt)
|
| 4977 | {
|
| 4978 | struct vfsmount *m = &mnt->mnt;
|
| 4979 | struct user_namespace *fs_userns = m->mnt_sb->s_user_ns;
|
| 4980 |
|
| 4981 | if (!kattr->mnt_idmap)
|
| 4982 | return 0;
|
| 4983 |
|
| 4984 | |
| 4985 | * Creating an idmapped mount with the filesystem wide idmapping
|
| 4986 | * doesn't make sense so block that. We don't allow mushy semantics.
|
| 4987 |
|
| 4988 | if (kattr->mnt_userns == m->mnt_sb->s_user_ns)
|
| 4989 | return -EINVAL;
|
| 4990 |
|
| 4991 | |
| 4992 | * We only allow an mount to change it's idmapping if it has
|
| 4993 | * never been accessible to userspace.
|
| 4994 |
|
| 4995 | if (!(kattr->kflags & MOUNT_KATTR_IDMAP_REPLACE) && is_idmapped_mnt(m))
|
| 4996 | return -EPERM;
|
| 4997 |
|
| 4998 |
|
| 4999 | if (!(m->mnt_sb->s_type->fs_flags & FS_ALLOW_IDMAP))
|
| 5000 | return -EINVAL;
|
| 5001 |
|
| 5002 |
|
| 5003 | if (m->mnt_sb->s_iflags & SB_I_NOIDMAP)
|
| 5004 | return -EINVAL;
|
| 5005 |
|
| 5006 |
|
| 5007 | if (!ns_capable(fs_userns, CAP_SYS_ADMIN))
|
| 5008 | return -EPERM;
|
| 5009 |
|
| 5010 |
|
| 5011 | if (!is_anon_ns(mnt->mnt_ns))
|
| 5012 | return -EINVAL;
|
| 5013 |
|
| 5014 | return 0;
|
| 5015 | }
|
| 5016 |
|
| 5017 | |
| 5018 | * mnt_allow_writers() - check whether the attribute change allows writers
|
| 5019 | * @kattr: the new mount attributes
|
| 5020 | * @mnt: the mount to which @kattr will be applied
|
| 5021 | *
|
| 5022 | * Check whether thew new mount attributes in @kattr allow concurrent writers.
|
| 5023 | *
|
| 5024 | * Return: true if writers need to be held, false if not
|
| 5025 |
|
| 5026 | static inline bool mnt_allow_writers(const struct mount_kattr *kattr,
|
| 5027 | const struct mount *mnt)
|
| 5028 | {
|
| 5029 | return (!(kattr->attr_set & MNT_READONLY) ||
|
| 5030 | (mnt->mnt.mnt_flags & MNT_READONLY)) &&
|
| 5031 | !kattr->mnt_idmap;
|
| 5032 | }
|
| 5033 |
|
| 5034 | static int mount_setattr_prepare(struct mount_kattr *kattr, struct mount *mnt)
|
| 5035 | {
|
| 5036 | struct mount *m;
|
| 5037 | int err;
|
| 5038 |
|
| 5039 | for (m = mnt; m; m = next_mnt(m, mnt)) {
|
| 5040 | if (!can_change_locked_flags(m, recalc_flags(kattr, m))) {
|
| 5041 | err = -EPERM;
|
| 5042 | break;
|
| 5043 | }
|
| 5044 |
|
| 5045 | err = can_idmap_mount(kattr, m);
|
| 5046 | if (err)
|
| 5047 | break;
|
| 5048 |
|
| 5049 | if (!mnt_allow_writers(kattr, m)) {
|
| 5050 | err = mnt_hold_writers(m);
|
| 5051 | if (err) {
|
| 5052 | m = next_mnt(m, mnt);
|
| 5053 | break;
|
| 5054 | }
|
| 5055 | }
|
| 5056 |
|
| 5057 | if (!(kattr->kflags & MOUNT_KATTR_RECURSE))
|
| 5058 | return 0;
|
| 5059 | }
|
| 5060 |
|
| 5061 | if (err) {
|
| 5062 |
|
| 5063 | for (struct mount *p = mnt; p != m; p = next_mnt(p, mnt))
|
| 5064 | mnt_unhold_writers(p);
|
| 5065 | }
|
| 5066 | return err;
|
| 5067 | }
|
| 5068 |
|
| 5069 | static void do_idmap_mount(const struct mount_kattr *kattr, struct mount *mnt)
|
| 5070 | {
|
| 5071 | const struct mnt_idmap *old_idmap;
|
| 5072 |
|
| 5073 | if (!kattr->mnt_idmap)
|
| 5074 | return;
|
| 5075 |
|
| 5076 | old_idmap = mnt_idmap(&mnt->mnt);
|
| 5077 |
|
| 5078 |
|
| 5079 | smp_store_release(&mnt->mnt.mnt_idmap, mnt_idmap_get(kattr->mnt_idmap));
|
| 5080 | mnt_idmap_put(old_idmap);
|
| 5081 | }
|
| 5082 |
|
| 5083 | static void mount_setattr_commit(struct mount_kattr *kattr, struct mount *mnt)
|
| 5084 | {
|
| 5085 | struct mount *m;
|
| 5086 |
|
| 5087 | for (m = mnt; m; m = next_mnt(m, mnt)) {
|
| 5088 | unsigned int flags;
|
| 5089 |
|
| 5090 | do_idmap_mount(kattr, m);
|
| 5091 | flags = recalc_flags(kattr, m);
|
| 5092 | WRITE_ONCE(m->mnt.mnt_flags, flags);
|
| 5093 |
|
| 5094 |
|
| 5095 | mnt_unhold_writers(m);
|
| 5096 |
|
| 5097 | if (kattr->propagation)
|
| 5098 | change_mnt_propagation(m, kattr->propagation);
|
| 5099 | if (!(kattr->kflags & MOUNT_KATTR_RECURSE))
|
| 5100 | break;
|
| 5101 | }
|
| 5102 | touch_mnt_namespace(mnt->mnt_ns);
|
| 5103 | }
|
| 5104 |
|
| 5105 | static int do_mount_setattr(const struct path *path, struct mount_kattr *kattr)
|
| 5106 | {
|
| 5107 | struct mount *mnt = real_mount(path->mnt);
|
| 5108 | int err = 0;
|
| 5109 |
|
| 5110 | if (!path_mounted(path))
|
| 5111 | return -EINVAL;
|
| 5112 |
|
| 5113 | if (kattr->mnt_userns) {
|
| 5114 | const struct mnt_idmap *mnt_idmap;
|
| 5115 |
|
| 5116 | mnt_idmap = alloc_mnt_idmap(kattr->mnt_userns);
|
| 5117 | if (IS_ERR(mnt_idmap))
|
| 5118 | return PTR_ERR(mnt_idmap);
|
| 5119 | kattr->mnt_idmap = mnt_idmap;
|
| 5120 | }
|
| 5121 |
|
| 5122 | if (kattr->propagation) {
|
| 5123 | |
| 5124 | * Only take namespace_lock() if we're actually changing
|
| 5125 | * propagation.
|
| 5126 |
|
| 5127 | namespace_lock();
|
| 5128 |
|
| 5129 | if (!anon_ns_root(mnt) && !check_mnt(mnt)) {
|
| 5130 | namespace_unlock();
|
| 5131 | return -EINVAL;
|
| 5132 | }
|
| 5133 | if (kattr->propagation == MS_SHARED) {
|
| 5134 | err = invent_group_ids(mnt, kattr->kflags & MOUNT_KATTR_RECURSE);
|
| 5135 | if (err) {
|
| 5136 | namespace_unlock();
|
| 5137 | return err;
|
| 5138 | }
|
| 5139 | }
|
| 5140 | }
|
| 5141 |
|
| 5142 | err = -EINVAL;
|
| 5143 | lock_mount_hash();
|
| 5144 |
|
| 5145 |
|
| 5146 | if (!anon_ns_root(mnt) && !check_mnt(mnt))
|
| 5147 | goto out;
|
| 5148 |
|
| 5149 | |
| 5150 | * First, we get the mount tree in a shape where we can change mount
|
| 5151 | * properties without failure. If we succeeded to do so we commit all
|
| 5152 | * changes and if we failed we clean up.
|
| 5153 |
|
| 5154 | err = mount_setattr_prepare(kattr, mnt);
|
| 5155 | if (!err)
|
| 5156 | mount_setattr_commit(kattr, mnt);
|
| 5157 |
|
| 5158 | out:
|
| 5159 | unlock_mount_hash();
|
| 5160 |
|
| 5161 | if (kattr->propagation) {
|
| 5162 | if (err)
|
| 5163 | cleanup_group_ids(mnt, NULL);
|
| 5164 | namespace_unlock();
|
| 5165 | }
|
| 5166 |
|
| 5167 | return err;
|
| 5168 | }
|
| 5169 |
|
| 5170 | static int build_mount_idmapped(const struct mount_attr *attr, size_t usize,
|
| 5171 | struct mount_kattr *kattr)
|
| 5172 | {
|
| 5173 | struct ns_common *ns;
|
| 5174 | struct user_namespace *mnt_userns;
|
| 5175 |
|
| 5176 | if (!((attr->attr_set | attr->attr_clr) & MOUNT_ATTR_IDMAP))
|
| 5177 | return 0;
|
| 5178 |
|
| 5179 | if (attr->attr_clr & MOUNT_ATTR_IDMAP) {
|
| 5180 | |
| 5181 | * We can only remove an idmapping if it's never been
|
| 5182 | * exposed to userspace.
|
| 5183 |
|
| 5184 | if (!(kattr->kflags & MOUNT_KATTR_IDMAP_REPLACE))
|
| 5185 | return -EINVAL;
|
| 5186 |
|
| 5187 | |
| 5188 | * Removal of idmappings is equivalent to setting
|
| 5189 | * nop_mnt_idmap.
|
| 5190 |
|
| 5191 | if (!(attr->attr_set & MOUNT_ATTR_IDMAP)) {
|
| 5192 | kattr->mnt_idmap = &nop_mnt_idmap;
|
| 5193 | return 0;
|
| 5194 | }
|
| 5195 | }
|
| 5196 |
|
| 5197 | if (attr->userns_fd > INT_MAX)
|
| 5198 | return -EINVAL;
|
| 5199 |
|
| 5200 | CLASS(fd, f)(attr->userns_fd);
|
| 5201 | if (fd_empty(f))
|
| 5202 | return -EBADF;
|
| 5203 |
|
| 5204 | if (!proc_ns_file(fd_file(f)))
|
| 5205 | return -EINVAL;
|
| 5206 |
|
| 5207 | ns = get_proc_ns(file_inode(fd_file(f)));
|
| 5208 | if (ns->ns_type != CLONE_NEWUSER)
|
| 5209 | return -EINVAL;
|
| 5210 |
|
| 5211 | |
| 5212 | * The initial idmapping cannot be used to create an idmapped
|
| 5213 | * mount. We use the initial idmapping as an indicator of a mount
|
| 5214 | * that is not idmapped. It can simply be passed into helpers that
|
| 5215 | * are aware of idmapped mounts as a convenient shortcut. A user
|
| 5216 | * can just create a dedicated identity mapping to achieve the same
|
| 5217 | * result.
|
| 5218 |
|
| 5219 | mnt_userns = container_of(ns, struct user_namespace, ns);
|
| 5220 | if (mnt_userns == &init_user_ns)
|
| 5221 | return -EPERM;
|
| 5222 |
|
| 5223 |
|
| 5224 | if (!ns_capable(mnt_userns, CAP_SYS_ADMIN))
|
| 5225 | return -EPERM;
|
| 5226 |
|
| 5227 | kattr->mnt_userns = get_user_ns(mnt_userns);
|
| 5228 | return 0;
|
| 5229 | }
|
| 5230 |
|
| 5231 | static int build_mount_kattr(const struct mount_attr *attr, size_t usize,
|
| 5232 | struct mount_kattr *kattr)
|
| 5233 | {
|
| 5234 | if (attr->propagation & ~MOUNT_SETATTR_PROPAGATION_FLAGS)
|
| 5235 | return -EINVAL;
|
| 5236 | if (hweight32(attr->propagation & MOUNT_SETATTR_PROPAGATION_FLAGS) > 1)
|
| 5237 | return -EINVAL;
|
| 5238 | kattr->propagation = attr->propagation;
|
| 5239 |
|
| 5240 | if ((attr->attr_set | attr->attr_clr) & ~MOUNT_SETATTR_VALID_FLAGS)
|
| 5241 | return -EINVAL;
|
| 5242 |
|
| 5243 | kattr->attr_set = attr_flags_to_mnt_flags(attr->attr_set);
|
| 5244 | kattr->attr_clr = attr_flags_to_mnt_flags(attr->attr_clr);
|
| 5245 |
|
| 5246 | |
| 5247 | * Since the MOUNT_ATTR_<atime> values are an enum, not a bitmap,
|
| 5248 | * users wanting to transition to a different atime setting cannot
|
| 5249 | * simply specify the atime setting in @attr_set, but must also
|
| 5250 | * specify MOUNT_ATTR__ATIME in the @attr_clr field.
|
| 5251 | * So ensure that MOUNT_ATTR__ATIME can't be partially set in
|
| 5252 | * @attr_clr and that @attr_set can't have any atime bits set if
|
| 5253 | * MOUNT_ATTR__ATIME isn't set in @attr_clr.
|
| 5254 |
|
| 5255 | if (attr->attr_clr & MOUNT_ATTR__ATIME) {
|
| 5256 | if ((attr->attr_clr & MOUNT_ATTR__ATIME) != MOUNT_ATTR__ATIME)
|
| 5257 | return -EINVAL;
|
| 5258 |
|
| 5259 | |
| 5260 | * Clear all previous time settings as they are mutually
|
| 5261 | * exclusive.
|
| 5262 |
|
| 5263 | kattr->attr_clr |= MNT_RELATIME | MNT_NOATIME;
|
| 5264 | switch (attr->attr_set & MOUNT_ATTR__ATIME) {
|
| 5265 | case MOUNT_ATTR_RELATIME:
|
| 5266 | kattr->attr_set |= MNT_RELATIME;
|
| 5267 | break;
|
| 5268 | case MOUNT_ATTR_NOATIME:
|
| 5269 | kattr->attr_set |= MNT_NOATIME;
|
| 5270 | break;
|
| 5271 | case MOUNT_ATTR_STRICTATIME:
|
| 5272 | break;
|
| 5273 | default:
|
| 5274 | return -EINVAL;
|
| 5275 | }
|
| 5276 | } else {
|
| 5277 | if (attr->attr_set & MOUNT_ATTR__ATIME)
|
| 5278 | return -EINVAL;
|
| 5279 | }
|
| 5280 |
|
| 5281 | return build_mount_idmapped(attr, usize, kattr);
|
| 5282 | }
|
| 5283 |
|
| 5284 | static void finish_mount_kattr(struct mount_kattr *kattr)
|
| 5285 | {
|
| 5286 | if (kattr->mnt_userns) {
|
| 5287 | put_user_ns(kattr->mnt_userns);
|
| 5288 | kattr->mnt_userns = NULL;
|
| 5289 | }
|
| 5290 |
|
| 5291 | if (kattr->mnt_idmap)
|
| 5292 | mnt_idmap_put(kattr->mnt_idmap);
|
| 5293 | }
|
| 5294 |
|
| 5295 | static int wants_mount_setattr(struct mount_attr __user *uattr, size_t usize,
|
| 5296 | struct mount_kattr *kattr)
|
| 5297 | {
|
| 5298 | int ret;
|
| 5299 | struct mount_attr attr;
|
| 5300 |
|
| 5301 | BUILD_BUG_ON(sizeof(struct mount_attr) != MOUNT_ATTR_SIZE_VER0);
|
| 5302 |
|
| 5303 | if (unlikely(usize > PAGE_SIZE))
|
| 5304 | return -E2BIG;
|
| 5305 | if (unlikely(usize < MOUNT_ATTR_SIZE_VER0))
|
| 5306 | return -EINVAL;
|
| 5307 |
|
| 5308 | if (!may_mount())
|
| 5309 | return -EPERM;
|
| 5310 |
|
| 5311 | ret = copy_struct_from_user(&attr, sizeof(attr), uattr, usize);
|
| 5312 | if (ret)
|
| 5313 | return ret;
|
| 5314 |
|
| 5315 |
|
| 5316 | if (attr.attr_set == 0 &&
|
| 5317 | attr.attr_clr == 0 &&
|
| 5318 | attr.propagation == 0)
|
| 5319 | return 0;
|
| 5320 |
|
| 5321 | ret = build_mount_kattr(&attr, usize, kattr);
|
| 5322 | if (ret < 0)
|
| 5323 | return ret;
|
| 5324 |
|
| 5325 | return 1;
|
| 5326 | }
|
| 5327 |
|
| 5328 | SYSCALL_DEFINE5(mount_setattr, int, dfd, const char __user *, path,
|
| 5329 | unsigned int, flags, struct mount_attr __user *, uattr,
|
| 5330 | size_t, usize)
|
| 5331 | {
|
| 5332 | int err;
|
| 5333 | struct path target;
|
| 5334 | struct mount_kattr kattr;
|
| 5335 | unsigned int lookup_flags = LOOKUP_AUTOMOUNT | LOOKUP_FOLLOW;
|
| 5336 |
|
| 5337 | if (flags & ~(AT_EMPTY_PATH |
|
| 5338 | AT_RECURSIVE |
|
| 5339 | AT_SYMLINK_NOFOLLOW |
|
| 5340 | AT_NO_AUTOMOUNT))
|
| 5341 | return -EINVAL;
|
| 5342 |
|
| 5343 | if (flags & AT_NO_AUTOMOUNT)
|
| 5344 | lookup_flags &= ~LOOKUP_AUTOMOUNT;
|
| 5345 | if (flags & AT_SYMLINK_NOFOLLOW)
|
| 5346 | lookup_flags &= ~LOOKUP_FOLLOW;
|
| 5347 |
|
| 5348 | kattr = (struct mount_kattr) {
|
| 5349 | .lookup_flags = lookup_flags,
|
| 5350 | };
|
| 5351 |
|
| 5352 | if (flags & AT_RECURSIVE)
|
| 5353 | kattr.kflags |= MOUNT_KATTR_RECURSE;
|
| 5354 |
|
| 5355 | err = wants_mount_setattr(uattr, usize, &kattr);
|
| 5356 | if (err <= 0)
|
| 5357 | return err;
|
| 5358 |
|
| 5359 | CLASS(filename_uflags, name)(path, flags);
|
| 5360 | err = filename_lookup(dfd, name, kattr.lookup_flags, &target, NULL);
|
| 5361 | if (!err) {
|
| 5362 | err = do_mount_setattr(&target, &kattr);
|
| 5363 | path_put(&target);
|
| 5364 | }
|
| 5365 | finish_mount_kattr(&kattr);
|
| 5366 | return err;
|
| 5367 | }
|
| 5368 |
|
| 5369 | SYSCALL_DEFINE5(open_tree_attr, int, dfd, const char __user *, filename,
|
| 5370 | unsigned, flags, struct mount_attr __user *, uattr,
|
| 5371 | size_t, usize)
|
| 5372 | {
|
| 5373 | if (!uattr && usize)
|
| 5374 | return -EINVAL;
|
| 5375 |
|
| 5376 | FD_PREPARE(fdf, flags, vfs_open_tree(dfd, filename, flags));
|
| 5377 | if (fdf->fd < 0)
|
| 5378 | return fdf->fd;
|
| 5379 |
|
| 5380 | if (uattr) {
|
| 5381 | struct mount_kattr kattr = {};
|
| 5382 | struct file *file = fdf->file;
|
| 5383 | int ret;
|
| 5384 |
|
| 5385 | if (flags & OPEN_TREE_CLONE)
|
| 5386 | kattr.kflags = MOUNT_KATTR_IDMAP_REPLACE;
|
| 5387 | if (flags & AT_RECURSIVE)
|
| 5388 | kattr.kflags |= MOUNT_KATTR_RECURSE;
|
| 5389 |
|
| 5390 | ret = wants_mount_setattr(uattr, usize, &kattr);
|
| 5391 | if (ret > 0) {
|
| 5392 | ret = do_mount_setattr(&file->f_path, &kattr);
|
| 5393 | finish_mount_kattr(&kattr);
|
| 5394 | }
|
| 5395 | if (ret)
|
| 5396 | return ret;
|
| 5397 | }
|
| 5398 |
|
| 5399 | return fd_publish(fdf);
|
| 5400 | }
|
| 5401 |
|
| 5402 | int show_path(struct seq_file *m, struct dentry *root)
|
| 5403 | {
|
| 5404 | if (root->d_sb->s_op->show_path)
|
| 5405 | return root->d_sb->s_op->show_path(m, root);
|
| 5406 |
|
| 5407 | seq_dentry(m, root, " \t\n\\");
|
| 5408 | return 0;
|
| 5409 | }
|
| 5410 |
|
| 5411 | static struct vfsmount *lookup_mnt_in_ns(u64 id, struct mnt_namespace *ns)
|
| 5412 | {
|
| 5413 | struct mount *mnt = mnt_find_id_at(ns, id);
|
| 5414 |
|
| 5415 | if (!mnt || mnt->mnt_id_unique != id)
|
| 5416 | return NULL;
|
| 5417 |
|
| 5418 | return &mnt->mnt;
|
| 5419 | }
|
| 5420 |
|
| 5421 | struct kstatmount {
|
| 5422 | struct statmount __user *buf;
|
| 5423 | size_t bufsize;
|
| 5424 | struct vfsmount *mnt;
|
| 5425 | const struct mnt_idmap *idmap;
|
| 5426 | u64 mask;
|
| 5427 | struct path root;
|
| 5428 | struct seq_file seq;
|
| 5429 |
|
| 5430 |
|
| 5431 | struct statmount sm;
|
| 5432 | };
|
| 5433 |
|
| 5434 | static u64 mnt_to_attr_flags(struct vfsmount *mnt)
|
| 5435 | {
|
| 5436 | unsigned int mnt_flags = READ_ONCE(mnt->mnt_flags);
|
| 5437 | u64 attr_flags = 0;
|
| 5438 |
|
| 5439 | if (mnt_flags & MNT_READONLY)
|
| 5440 | attr_flags |= MOUNT_ATTR_RDONLY;
|
| 5441 | if (mnt_flags & MNT_NOSUID)
|
| 5442 | attr_flags |= MOUNT_ATTR_NOSUID;
|
| 5443 | if (mnt_flags & MNT_NODEV)
|
| 5444 | attr_flags |= MOUNT_ATTR_NODEV;
|
| 5445 | if (mnt_flags & MNT_NOEXEC)
|
| 5446 | attr_flags |= MOUNT_ATTR_NOEXEC;
|
| 5447 | if (mnt_flags & MNT_NODIRATIME)
|
| 5448 | attr_flags |= MOUNT_ATTR_NODIRATIME;
|
| 5449 | if (mnt_flags & MNT_NOSYMFOLLOW)
|
| 5450 | attr_flags |= MOUNT_ATTR_NOSYMFOLLOW;
|
| 5451 |
|
| 5452 | if (mnt_flags & MNT_NOATIME)
|
| 5453 | attr_flags |= MOUNT_ATTR_NOATIME;
|
| 5454 | else if (mnt_flags & MNT_RELATIME)
|
| 5455 | attr_flags |= MOUNT_ATTR_RELATIME;
|
| 5456 | else
|
| 5457 | attr_flags |= MOUNT_ATTR_STRICTATIME;
|
| 5458 |
|
| 5459 | if (is_idmapped_mnt(mnt))
|
| 5460 | attr_flags |= MOUNT_ATTR_IDMAP;
|
| 5461 |
|
| 5462 | return attr_flags;
|
| 5463 | }
|
| 5464 |
|
| 5465 | static u64 mnt_to_propagation_flags(struct mount *m)
|
| 5466 | {
|
| 5467 | u64 propagation = 0;
|
| 5468 |
|
| 5469 | if (IS_MNT_SHARED(m))
|
| 5470 | propagation |= MS_SHARED;
|
| 5471 | if (IS_MNT_SLAVE(m))
|
| 5472 | propagation |= MS_SLAVE;
|
| 5473 | if (IS_MNT_UNBINDABLE(m))
|
| 5474 | propagation |= MS_UNBINDABLE;
|
| 5475 | if (!propagation)
|
| 5476 | propagation |= MS_PRIVATE;
|
| 5477 |
|
| 5478 | return propagation;
|
| 5479 | }
|
| 5480 |
|
| 5481 | u64 vfsmount_to_propagation_flags(struct vfsmount *mnt)
|
| 5482 | {
|
| 5483 | return mnt_to_propagation_flags(real_mount(mnt));
|
| 5484 | }
|
| 5485 | EXPORT_SYMBOL_GPL(vfsmount_to_propagation_flags);
|
| 5486 |
|
| 5487 | static void statmount_sb_basic(struct kstatmount *s)
|
| 5488 | {
|
| 5489 | struct super_block *sb = s->mnt->mnt_sb;
|
| 5490 |
|
| 5491 | s->sm.mask |= STATMOUNT_SB_BASIC;
|
| 5492 | s->sm.sb_dev_major = MAJOR(sb->s_dev);
|
| 5493 | s->sm.sb_dev_minor = MINOR(sb->s_dev);
|
| 5494 | s->sm.sb_magic = sb->s_magic;
|
| 5495 | s->sm.sb_flags = sb->s_flags & (SB_RDONLY|SB_SYNCHRONOUS|SB_DIRSYNC|SB_LAZYTIME);
|
| 5496 | }
|
| 5497 |
|
| 5498 | static void statmount_mnt_parent(struct kstatmount *s, const struct mount *m)
|
| 5499 | {
|
| 5500 | s->sm.mnt_parent_id = m->mnt_parent->mnt_id_unique;
|
| 5501 | s->sm.mnt_parent_id_old = m->mnt_parent->mnt_id;
|
| 5502 | }
|
| 5503 |
|
| 5504 | static void statmount_mnt_basic(struct kstatmount *s)
|
| 5505 | {
|
| 5506 | struct mount *m = real_mount(s->mnt);
|
| 5507 |
|
| 5508 | s->sm.mask |= STATMOUNT_MNT_BASIC;
|
| 5509 | s->sm.mnt_id = m->mnt_id_unique;
|
| 5510 | s->sm.mnt_id_old = m->mnt_id;
|
| 5511 |
|
| 5512 | if (likely(is_mounted(s->mnt)))
|
| 5513 | statmount_mnt_parent(s, m);
|
| 5514 | else
|
| 5515 | scoped_guard(mount_locked_reader)
|
| 5516 | statmount_mnt_parent(s, m);
|
| 5517 | s->sm.mnt_attr = mnt_to_attr_flags(&m->mnt);
|
| 5518 | s->sm.mnt_propagation = mnt_to_propagation_flags(m);
|
| 5519 | s->sm.mnt_peer_group = m->mnt_group_id;
|
| 5520 | s->sm.mnt_master = IS_MNT_SLAVE(m) ? m->mnt_master->mnt_group_id : 0;
|
| 5521 | }
|
| 5522 |
|
| 5523 | static void statmount_propagate_from(struct kstatmount *s)
|
| 5524 | {
|
| 5525 | struct mount *m = real_mount(s->mnt);
|
| 5526 |
|
| 5527 | s->sm.mask |= STATMOUNT_PROPAGATE_FROM;
|
| 5528 | if (IS_MNT_SLAVE(m))
|
| 5529 | s->sm.propagate_from = get_dominating_id(m, ¤t->fs->root);
|
| 5530 | }
|
| 5531 |
|
| 5532 | static int statmount_mnt_root(struct kstatmount *s, struct seq_file *seq)
|
| 5533 | {
|
| 5534 | int ret;
|
| 5535 | size_t start = seq->count;
|
| 5536 |
|
| 5537 | ret = show_path(seq, s->mnt->mnt_root);
|
| 5538 | if (ret)
|
| 5539 | return ret;
|
| 5540 |
|
| 5541 | if (unlikely(seq_has_overflowed(seq)))
|
| 5542 | return -EAGAIN;
|
| 5543 |
|
| 5544 | |
| 5545 | * Unescape the result. It would be better if supplied string was not
|
| 5546 | * escaped in the first place, but that's a pretty invasive change.
|
| 5547 |
|
| 5548 | seq->buf[seq->count] = '\0';
|
| 5549 | seq->count = start;
|
| 5550 | seq_commit(seq, string_unescape_inplace(seq->buf + start, UNESCAPE_OCTAL));
|
| 5551 | return 0;
|
| 5552 | }
|
| 5553 |
|
| 5554 | static int statmount_mnt_point(struct kstatmount *s, struct seq_file *seq)
|
| 5555 | {
|
| 5556 | struct vfsmount *mnt = s->mnt;
|
| 5557 | struct path mnt_path = { .dentry = mnt->mnt_root, .mnt = mnt };
|
| 5558 | int err;
|
| 5559 |
|
| 5560 | err = seq_path_root(seq, &mnt_path, &s->root, "");
|
| 5561 | return err == SEQ_SKIP ? 0 : err;
|
| 5562 | }
|
| 5563 |
|
| 5564 | static int statmount_fs_type(struct kstatmount *s, struct seq_file *seq)
|
| 5565 | {
|
| 5566 | struct super_block *sb = s->mnt->mnt_sb;
|
| 5567 |
|
| 5568 | seq_puts(seq, sb->s_type->name);
|
| 5569 | return 0;
|
| 5570 | }
|
| 5571 |
|
| 5572 | static void statmount_fs_subtype(struct kstatmount *s, struct seq_file *seq)
|
| 5573 | {
|
| 5574 | struct super_block *sb = s->mnt->mnt_sb;
|
| 5575 |
|
| 5576 | if (sb->s_subtype)
|
| 5577 | seq_puts(seq, sb->s_subtype);
|
| 5578 | }
|
| 5579 |
|
| 5580 | static int statmount_sb_source(struct kstatmount *s, struct seq_file *seq)
|
| 5581 | {
|
| 5582 | struct super_block *sb = s->mnt->mnt_sb;
|
| 5583 | struct mount *r = real_mount(s->mnt);
|
| 5584 |
|
| 5585 | if (sb->s_op->show_devname) {
|
| 5586 | size_t start = seq->count;
|
| 5587 | int ret;
|
| 5588 |
|
| 5589 | ret = sb->s_op->show_devname(seq, s->mnt->mnt_root);
|
| 5590 | if (ret)
|
| 5591 | return ret;
|
| 5592 |
|
| 5593 | if (unlikely(seq_has_overflowed(seq)))
|
| 5594 | return -EAGAIN;
|
| 5595 |
|
| 5596 |
|
| 5597 | seq->buf[seq->count] = '\0';
|
| 5598 | seq->count = start;
|
| 5599 | seq_commit(seq, string_unescape_inplace(seq->buf + start, UNESCAPE_OCTAL));
|
| 5600 | } else {
|
| 5601 | seq_puts(seq, r->mnt_devname);
|
| 5602 | }
|
| 5603 | return 0;
|
| 5604 | }
|
| 5605 |
|
| 5606 | static void statmount_mnt_ns_id(struct kstatmount *s, struct mnt_namespace *ns)
|
| 5607 | {
|
| 5608 | s->sm.mask |= STATMOUNT_MNT_NS_ID;
|
| 5609 | s->sm.mnt_ns_id = ns->ns.ns_id;
|
| 5610 | }
|
| 5611 |
|
| 5612 | static int statmount_mnt_opts(struct kstatmount *s, struct seq_file *seq)
|
| 5613 | {
|
| 5614 | struct vfsmount *mnt = s->mnt;
|
| 5615 | struct super_block *sb = mnt->mnt_sb;
|
| 5616 | size_t start = seq->count;
|
| 5617 | int err;
|
| 5618 |
|
| 5619 | err = security_sb_show_options(seq, sb);
|
| 5620 | if (err)
|
| 5621 | return err;
|
| 5622 |
|
| 5623 | if (sb->s_op->show_options) {
|
| 5624 | err = sb->s_op->show_options(seq, mnt->mnt_root);
|
| 5625 | if (err)
|
| 5626 | return err;
|
| 5627 | }
|
| 5628 |
|
| 5629 | if (unlikely(seq_has_overflowed(seq)))
|
| 5630 | return -EAGAIN;
|
| 5631 |
|
| 5632 | if (seq->count == start)
|
| 5633 | return 0;
|
| 5634 |
|
| 5635 |
|
| 5636 | memmove(seq->buf + start, seq->buf + start + 1,
|
| 5637 | seq->count - start - 1);
|
| 5638 | seq->count--;
|
| 5639 |
|
| 5640 | return 0;
|
| 5641 | }
|
| 5642 |
|
| 5643 | static inline int statmount_opt_process(struct seq_file *seq, size_t start)
|
| 5644 | {
|
| 5645 | char *buf_end, *opt_end, *src, *dst;
|
| 5646 | int count = 0;
|
| 5647 |
|
| 5648 | if (unlikely(seq_has_overflowed(seq)))
|
| 5649 | return -EAGAIN;
|
| 5650 |
|
| 5651 | buf_end = seq->buf + seq->count;
|
| 5652 | dst = seq->buf + start;
|
| 5653 | src = dst + 1;
|
| 5654 |
|
| 5655 | if (src >= buf_end) {
|
| 5656 | seq->count = start;
|
| 5657 | return 0;
|
| 5658 | }
|
| 5659 |
|
| 5660 | *buf_end = '\0';
|
| 5661 | for (; src < buf_end; src = opt_end + 1) {
|
| 5662 | opt_end = strchrnul(src, ',');
|
| 5663 | *opt_end = '\0';
|
| 5664 | dst += string_unescape(src, dst, 0, UNESCAPE_OCTAL) + 1;
|
| 5665 | if (WARN_ON_ONCE(++count == INT_MAX))
|
| 5666 | return -EOVERFLOW;
|
| 5667 | }
|
| 5668 | seq->count = dst - 1 - seq->buf;
|
| 5669 | return count;
|
| 5670 | }
|
| 5671 |
|
| 5672 | static int statmount_opt_array(struct kstatmount *s, struct seq_file *seq)
|
| 5673 | {
|
| 5674 | struct vfsmount *mnt = s->mnt;
|
| 5675 | struct super_block *sb = mnt->mnt_sb;
|
| 5676 | size_t start = seq->count;
|
| 5677 | int err;
|
| 5678 |
|
| 5679 | if (!sb->s_op->show_options)
|
| 5680 | return 0;
|
| 5681 |
|
| 5682 | err = sb->s_op->show_options(seq, mnt->mnt_root);
|
| 5683 | if (err)
|
| 5684 | return err;
|
| 5685 |
|
| 5686 | err = statmount_opt_process(seq, start);
|
| 5687 | if (err < 0)
|
| 5688 | return err;
|
| 5689 |
|
| 5690 | s->sm.opt_num = err;
|
| 5691 | return 0;
|
| 5692 | }
|
| 5693 |
|
| 5694 | static int statmount_opt_sec_array(struct kstatmount *s, struct seq_file *seq)
|
| 5695 | {
|
| 5696 | struct vfsmount *mnt = s->mnt;
|
| 5697 | struct super_block *sb = mnt->mnt_sb;
|
| 5698 | size_t start = seq->count;
|
| 5699 | int err;
|
| 5700 |
|
| 5701 | err = security_sb_show_options(seq, sb);
|
| 5702 | if (err)
|
| 5703 | return err;
|
| 5704 |
|
| 5705 | err = statmount_opt_process(seq, start);
|
| 5706 | if (err < 0)
|
| 5707 | return err;
|
| 5708 |
|
| 5709 | s->sm.opt_sec_num = err;
|
| 5710 | return 0;
|
| 5711 | }
|
| 5712 |
|
| 5713 | static inline int statmount_mnt_uidmap(struct kstatmount *s, struct seq_file *seq)
|
| 5714 | {
|
| 5715 | int ret;
|
| 5716 |
|
| 5717 | ret = statmount_mnt_idmap(s->idmap, seq, true);
|
| 5718 | if (ret < 0)
|
| 5719 | return ret;
|
| 5720 |
|
| 5721 | s->sm.mnt_uidmap_num = ret;
|
| 5722 | |
| 5723 | * Always raise STATMOUNT_MNT_UIDMAP even if there are no valid
|
| 5724 | * mappings. This allows userspace to distinguish between a
|
| 5725 | * non-idmapped mount and an idmapped mount where none of the
|
| 5726 | * individual mappings are valid in the caller's idmapping.
|
| 5727 |
|
| 5728 | if (is_valid_mnt_idmap(s->idmap))
|
| 5729 | s->sm.mask |= STATMOUNT_MNT_UIDMAP;
|
| 5730 | return 0;
|
| 5731 | }
|
| 5732 |
|
| 5733 | static inline int statmount_mnt_gidmap(struct kstatmount *s, struct seq_file *seq)
|
| 5734 | {
|
| 5735 | int ret;
|
| 5736 |
|
| 5737 | ret = statmount_mnt_idmap(s->idmap, seq, false);
|
| 5738 | if (ret < 0)
|
| 5739 | return ret;
|
| 5740 |
|
| 5741 | s->sm.mnt_gidmap_num = ret;
|
| 5742 | |
| 5743 | * Always raise STATMOUNT_MNT_GIDMAP even if there are no valid
|
| 5744 | * mappings. This allows userspace to distinguish between a
|
| 5745 | * non-idmapped mount and an idmapped mount where none of the
|
| 5746 | * individual mappings are valid in the caller's idmapping.
|
| 5747 |
|
| 5748 | if (is_valid_mnt_idmap(s->idmap))
|
| 5749 | s->sm.mask |= STATMOUNT_MNT_GIDMAP;
|
| 5750 | return 0;
|
| 5751 | }
|
| 5752 |
|
| 5753 | static int statmount_string(struct kstatmount *s, u64 flag)
|
| 5754 | {
|
| 5755 | int ret = 0;
|
| 5756 | size_t kbufsize;
|
| 5757 | struct seq_file *seq = &s->seq;
|
| 5758 | struct statmount *sm = &s->sm;
|
| 5759 | u32 start, *offp;
|
| 5760 |
|
| 5761 |
|
| 5762 | if (!seq->count)
|
| 5763 | seq_putc(seq, 0);
|
| 5764 |
|
| 5765 | start = seq->count;
|
| 5766 |
|
| 5767 | switch (flag) {
|
| 5768 | case STATMOUNT_FS_TYPE:
|
| 5769 | offp = &sm->fs_type;
|
| 5770 | ret = statmount_fs_type(s, seq);
|
| 5771 | break;
|
| 5772 | case STATMOUNT_MNT_ROOT:
|
| 5773 | offp = &sm->mnt_root;
|
| 5774 | ret = statmount_mnt_root(s, seq);
|
| 5775 | break;
|
| 5776 | case STATMOUNT_MNT_POINT:
|
| 5777 | offp = &sm->mnt_point;
|
| 5778 | ret = statmount_mnt_point(s, seq);
|
| 5779 | break;
|
| 5780 | case STATMOUNT_MNT_OPTS:
|
| 5781 | offp = &sm->mnt_opts;
|
| 5782 | ret = statmount_mnt_opts(s, seq);
|
| 5783 | break;
|
| 5784 | case STATMOUNT_OPT_ARRAY:
|
| 5785 | offp = &sm->opt_array;
|
| 5786 | ret = statmount_opt_array(s, seq);
|
| 5787 | break;
|
| 5788 | case STATMOUNT_OPT_SEC_ARRAY:
|
| 5789 | offp = &sm->opt_sec_array;
|
| 5790 | ret = statmount_opt_sec_array(s, seq);
|
| 5791 | break;
|
| 5792 | case STATMOUNT_FS_SUBTYPE:
|
| 5793 | offp = &sm->fs_subtype;
|
| 5794 | statmount_fs_subtype(s, seq);
|
| 5795 | break;
|
| 5796 | case STATMOUNT_SB_SOURCE:
|
| 5797 | offp = &sm->sb_source;
|
| 5798 | ret = statmount_sb_source(s, seq);
|
| 5799 | break;
|
| 5800 | case STATMOUNT_MNT_UIDMAP:
|
| 5801 | offp = &sm->mnt_uidmap;
|
| 5802 | ret = statmount_mnt_uidmap(s, seq);
|
| 5803 | break;
|
| 5804 | case STATMOUNT_MNT_GIDMAP:
|
| 5805 | offp = &sm->mnt_gidmap;
|
| 5806 | ret = statmount_mnt_gidmap(s, seq);
|
| 5807 | break;
|
| 5808 | default:
|
| 5809 | WARN_ON_ONCE(true);
|
| 5810 | return -EINVAL;
|
| 5811 | }
|
| 5812 |
|
| 5813 | |
| 5814 | * If nothing was emitted, return to avoid setting the flag
|
| 5815 | * and terminating the buffer.
|
| 5816 |
|
| 5817 | if (seq->count == start)
|
| 5818 | return ret;
|
| 5819 | if (unlikely(check_add_overflow(sizeof(*sm), seq->count, &kbufsize)))
|
| 5820 | return -EOVERFLOW;
|
| 5821 | if (kbufsize >= s->bufsize)
|
| 5822 | return -EOVERFLOW;
|
| 5823 |
|
| 5824 |
|
| 5825 | if (unlikely(seq_has_overflowed(seq)))
|
| 5826 | return -EAGAIN;
|
| 5827 |
|
| 5828 | if (ret)
|
| 5829 | return ret;
|
| 5830 |
|
| 5831 | seq->buf[seq->count++] = '\0';
|
| 5832 | sm->mask |= flag;
|
| 5833 | *offp = start;
|
| 5834 | return 0;
|
| 5835 | }
|
| 5836 |
|
| 5837 | static int copy_statmount_to_user(struct kstatmount *s)
|
| 5838 | {
|
| 5839 | struct statmount *sm = &s->sm;
|
| 5840 | struct seq_file *seq = &s->seq;
|
| 5841 | char __user *str = ((char __user *)s->buf) + sizeof(*sm);
|
| 5842 | size_t copysize = min_t(size_t, s->bufsize, sizeof(*sm));
|
| 5843 |
|
| 5844 | if (seq->count && copy_to_user(str, seq->buf, seq->count))
|
| 5845 | return -EFAULT;
|
| 5846 |
|
| 5847 |
|
| 5848 | sm->size = copysize + seq->count;
|
| 5849 | if (copy_to_user(s->buf, sm, copysize))
|
| 5850 | return -EFAULT;
|
| 5851 |
|
| 5852 | return 0;
|
| 5853 | }
|
| 5854 |
|
| 5855 | static struct mount *listmnt_next(struct mount *curr, bool reverse)
|
| 5856 | {
|
| 5857 | struct rb_node *node;
|
| 5858 |
|
| 5859 | if (reverse)
|
| 5860 | node = rb_prev(&curr->mnt_node);
|
| 5861 | else
|
| 5862 | node = rb_next(&curr->mnt_node);
|
| 5863 |
|
| 5864 | return node_to_mount(node);
|
| 5865 | }
|
| 5866 |
|
| 5867 | static int grab_requested_root(struct mnt_namespace *ns, struct path *root)
|
| 5868 | {
|
| 5869 | struct mount *first, *child;
|
| 5870 |
|
| 5871 | rwsem_assert_held(&namespace_sem);
|
| 5872 |
|
| 5873 |
|
| 5874 | if (ns == current->nsproxy->mnt_ns) {
|
| 5875 | get_fs_root(current->fs, root);
|
| 5876 | return 0;
|
| 5877 | }
|
| 5878 |
|
| 5879 | |
| 5880 | * We have to find the first mount in our ns and use that, however it
|
| 5881 | * may not exist, so handle that properly.
|
| 5882 |
|
| 5883 | if (mnt_ns_empty(ns))
|
| 5884 | return -ENOENT;
|
| 5885 |
|
| 5886 | first = ns->root;
|
| 5887 | for (child = node_to_mount(ns->mnt_first_node); child;
|
| 5888 | child = listmnt_next(child, false)) {
|
| 5889 | if (child != first && child->mnt_parent == first)
|
| 5890 | break;
|
| 5891 | }
|
| 5892 | if (!child)
|
| 5893 | return -ENOENT;
|
| 5894 |
|
| 5895 | root->mnt = mntget(&child->mnt);
|
| 5896 | root->dentry = dget(root->mnt->mnt_root);
|
| 5897 | return 0;
|
| 5898 | }
|
| 5899 |
|
| 5900 |
|
| 5901 | #define STATMOUNT_SUPPORTED (STATMOUNT_SB_BASIC | \
|
| 5902 | STATMOUNT_MNT_BASIC | \
|
| 5903 | STATMOUNT_PROPAGATE_FROM | \
|
| 5904 | STATMOUNT_MNT_ROOT | \
|
| 5905 | STATMOUNT_MNT_POINT | \
|
| 5906 | STATMOUNT_FS_TYPE | \
|
| 5907 | STATMOUNT_MNT_NS_ID | \
|
| 5908 | STATMOUNT_MNT_OPTS | \
|
| 5909 | STATMOUNT_FS_SUBTYPE | \
|
| 5910 | STATMOUNT_SB_SOURCE | \
|
| 5911 | STATMOUNT_OPT_ARRAY | \
|
| 5912 | STATMOUNT_OPT_SEC_ARRAY | \
|
| 5913 | STATMOUNT_SUPPORTED_MASK | \
|
| 5914 | STATMOUNT_MNT_UIDMAP | \
|
| 5915 | STATMOUNT_MNT_GIDMAP)
|
| 5916 |
|
| 5917 |
|
| 5918 | static int do_statmount(struct kstatmount *s, u64 mnt_id, u64 mnt_ns_id,
|
| 5919 | struct file *mnt_file, struct mnt_namespace *ns)
|
| 5920 | {
|
| 5921 | int err;
|
| 5922 |
|
| 5923 | if (mnt_file) {
|
| 5924 | WARN_ON_ONCE(ns != NULL);
|
| 5925 |
|
| 5926 | s->mnt = mnt_file->f_path.mnt;
|
| 5927 | ns = real_mount(s->mnt)->mnt_ns;
|
| 5928 | if (IS_ERR(ns))
|
| 5929 | return PTR_ERR(ns);
|
| 5930 | if (!ns)
|
| 5931 | |
| 5932 | * We can't set mount point and mnt_ns_id since we don't have a
|
| 5933 | * ns for the mount. This can happen if the mount is unmounted
|
| 5934 | * with MNT_DETACH.
|
| 5935 |
|
| 5936 | s->mask &= ~(STATMOUNT_MNT_POINT | STATMOUNT_MNT_NS_ID);
|
| 5937 | } else {
|
| 5938 |
|
| 5939 | if (mnt_ns_id && mnt_ns_empty(ns))
|
| 5940 | return -ENOENT;
|
| 5941 |
|
| 5942 | s->mnt = lookup_mnt_in_ns(mnt_id, ns);
|
| 5943 | if (!s->mnt)
|
| 5944 | return -ENOENT;
|
| 5945 | }
|
| 5946 |
|
| 5947 | if (ns) {
|
| 5948 | err = grab_requested_root(ns, &s->root);
|
| 5949 | if (err)
|
| 5950 | return err;
|
| 5951 |
|
| 5952 | if (!mnt_file) {
|
| 5953 | struct mount *m;
|
| 5954 | |
| 5955 | * Don't trigger audit denials. We just want to determine what
|
| 5956 | * mounts to show users.
|
| 5957 |
|
| 5958 | m = real_mount(s->mnt);
|
| 5959 | if (!is_path_reachable(m, m->mnt.mnt_root, &s->root) &&
|
| 5960 | !ns_capable_noaudit(ns->user_ns, CAP_SYS_ADMIN))
|
| 5961 | return -EPERM;
|
| 5962 | }
|
| 5963 | }
|
| 5964 |
|
| 5965 | err = security_sb_statfs(s->mnt->mnt_root);
|
| 5966 | if (err)
|
| 5967 | return err;
|
| 5968 |
|
| 5969 | |
| 5970 | * Note that mount properties in mnt->mnt_flags, mnt->mnt_idmap
|
| 5971 | * can change concurrently as we only hold the read-side of the
|
| 5972 | * namespace semaphore and mount properties may change with only
|
| 5973 | * the mount lock held.
|
| 5974 | *
|
| 5975 | * We could sample the mount lock sequence counter to detect
|
| 5976 | * those changes and retry. But it's not worth it. Worst that
|
| 5977 | * happens is that the mnt->mnt_idmap pointer is already changed
|
| 5978 | * while mnt->mnt_flags isn't or vica versa. So what.
|
| 5979 | *
|
| 5980 | * Both mnt->mnt_flags and mnt->mnt_idmap are set and retrieved
|
| 5981 | * via READ_ONCE()/WRITE_ONCE() and guard against theoretical
|
| 5982 | * torn read/write. That's all we care about right now.
|
| 5983 |
|
| 5984 | s->idmap = mnt_idmap(s->mnt);
|
| 5985 | if (s->mask & STATMOUNT_MNT_BASIC)
|
| 5986 | statmount_mnt_basic(s);
|
| 5987 |
|
| 5988 | if (s->mask & STATMOUNT_SB_BASIC)
|
| 5989 | statmount_sb_basic(s);
|
| 5990 |
|
| 5991 | if (s->mask & STATMOUNT_PROPAGATE_FROM)
|
| 5992 | statmount_propagate_from(s);
|
| 5993 |
|
| 5994 | if (s->mask & STATMOUNT_FS_TYPE)
|
| 5995 | err = statmount_string(s, STATMOUNT_FS_TYPE);
|
| 5996 |
|
| 5997 | if (!err && s->mask & STATMOUNT_MNT_ROOT)
|
| 5998 | err = statmount_string(s, STATMOUNT_MNT_ROOT);
|
| 5999 |
|
| 6000 | if (!err && s->mask & STATMOUNT_MNT_POINT)
|
| 6001 | err = statmount_string(s, STATMOUNT_MNT_POINT);
|
| 6002 |
|
| 6003 | if (!err && s->mask & STATMOUNT_MNT_OPTS)
|
| 6004 | err = statmount_string(s, STATMOUNT_MNT_OPTS);
|
| 6005 |
|
| 6006 | if (!err && s->mask & STATMOUNT_OPT_ARRAY)
|
| 6007 | err = statmount_string(s, STATMOUNT_OPT_ARRAY);
|
| 6008 |
|
| 6009 | if (!err && s->mask & STATMOUNT_OPT_SEC_ARRAY)
|
| 6010 | err = statmount_string(s, STATMOUNT_OPT_SEC_ARRAY);
|
| 6011 |
|
| 6012 | if (!err && s->mask & STATMOUNT_FS_SUBTYPE)
|
| 6013 | err = statmount_string(s, STATMOUNT_FS_SUBTYPE);
|
| 6014 |
|
| 6015 | if (!err && s->mask & STATMOUNT_SB_SOURCE)
|
| 6016 | err = statmount_string(s, STATMOUNT_SB_SOURCE);
|
| 6017 |
|
| 6018 | if (!err && s->mask & STATMOUNT_MNT_UIDMAP)
|
| 6019 | err = statmount_string(s, STATMOUNT_MNT_UIDMAP);
|
| 6020 |
|
| 6021 | if (!err && s->mask & STATMOUNT_MNT_GIDMAP)
|
| 6022 | err = statmount_string(s, STATMOUNT_MNT_GIDMAP);
|
| 6023 |
|
| 6024 | if (!err && s->mask & STATMOUNT_MNT_NS_ID)
|
| 6025 | statmount_mnt_ns_id(s, ns);
|
| 6026 |
|
| 6027 | if (!err && s->mask & STATMOUNT_SUPPORTED_MASK) {
|
| 6028 | s->sm.mask |= STATMOUNT_SUPPORTED_MASK;
|
| 6029 | s->sm.supported_mask = STATMOUNT_SUPPORTED;
|
| 6030 | }
|
| 6031 |
|
| 6032 | if (err)
|
| 6033 | return err;
|
| 6034 |
|
| 6035 |
|
| 6036 | WARN_ON_ONCE(~STATMOUNT_SUPPORTED & s->sm.mask);
|
| 6037 |
|
| 6038 | return 0;
|
| 6039 | }
|
| 6040 |
|
| 6041 | static inline bool retry_statmount(const long ret, size_t *seq_size)
|
| 6042 | {
|
| 6043 | if (likely(ret != -EAGAIN))
|
| 6044 | return false;
|
| 6045 | if (unlikely(check_mul_overflow(*seq_size, 2, seq_size)))
|
| 6046 | return false;
|
| 6047 | if (unlikely(*seq_size > MAX_RW_COUNT))
|
| 6048 | return false;
|
| 6049 | return true;
|
| 6050 | }
|
| 6051 |
|
| 6052 | #define STATMOUNT_STRING_REQ (STATMOUNT_MNT_ROOT | STATMOUNT_MNT_POINT | \
|
| 6053 | STATMOUNT_FS_TYPE | STATMOUNT_MNT_OPTS | \
|
| 6054 | STATMOUNT_FS_SUBTYPE | STATMOUNT_SB_SOURCE | \
|
| 6055 | STATMOUNT_OPT_ARRAY | STATMOUNT_OPT_SEC_ARRAY | \
|
| 6056 | STATMOUNT_MNT_UIDMAP | STATMOUNT_MNT_GIDMAP)
|
| 6057 |
|
| 6058 | static int prepare_kstatmount(struct kstatmount *ks, struct mnt_id_req *kreq,
|
| 6059 | struct statmount __user *buf, size_t bufsize,
|
| 6060 | size_t seq_size)
|
| 6061 | {
|
| 6062 | if (!access_ok(buf, bufsize))
|
| 6063 | return -EFAULT;
|
| 6064 |
|
| 6065 | memset(ks, 0, sizeof(*ks));
|
| 6066 | ks->mask = kreq->param;
|
| 6067 | ks->buf = buf;
|
| 6068 | ks->bufsize = bufsize;
|
| 6069 |
|
| 6070 | if (ks->mask & STATMOUNT_STRING_REQ) {
|
| 6071 | if (bufsize == sizeof(ks->sm))
|
| 6072 | return -EOVERFLOW;
|
| 6073 |
|
| 6074 | ks->seq.buf = kvmalloc(seq_size, GFP_KERNEL_ACCOUNT);
|
| 6075 | if (!ks->seq.buf)
|
| 6076 | return -ENOMEM;
|
| 6077 |
|
| 6078 | ks->seq.size = seq_size;
|
| 6079 | }
|
| 6080 |
|
| 6081 | return 0;
|
| 6082 | }
|
| 6083 |
|
| 6084 | static int copy_mnt_id_req(const struct mnt_id_req __user *req,
|
| 6085 | struct mnt_id_req *kreq, unsigned int flags)
|
| 6086 | {
|
| 6087 | int ret;
|
| 6088 | size_t usize;
|
| 6089 |
|
| 6090 | BUILD_BUG_ON(sizeof(struct mnt_id_req) != MNT_ID_REQ_SIZE_VER1);
|
| 6091 |
|
| 6092 | ret = get_user(usize, &req->size);
|
| 6093 | if (ret)
|
| 6094 | return -EFAULT;
|
| 6095 | if (unlikely(usize > PAGE_SIZE))
|
| 6096 | return -E2BIG;
|
| 6097 | if (unlikely(usize < MNT_ID_REQ_SIZE_VER0))
|
| 6098 | return -EINVAL;
|
| 6099 | memset(kreq, 0, sizeof(*kreq));
|
| 6100 | ret = copy_struct_from_user(kreq, sizeof(*kreq), req, usize);
|
| 6101 | if (ret)
|
| 6102 | return ret;
|
| 6103 |
|
| 6104 | if (flags & STATMOUNT_BY_FD) {
|
| 6105 | if (kreq->mnt_id || kreq->mnt_ns_id)
|
| 6106 | return -EINVAL;
|
| 6107 | } else {
|
| 6108 | if (kreq->mnt_ns_fd != 0 && kreq->mnt_ns_id)
|
| 6109 | return -EINVAL;
|
| 6110 |
|
| 6111 | if (kreq->mnt_id <= MNT_UNIQUE_ID_OFFSET)
|
| 6112 | return -EINVAL;
|
| 6113 | }
|
| 6114 | return 0;
|
| 6115 | }
|
| 6116 |
|
| 6117 | |
| 6118 | * If the user requested a specific mount namespace id, look that up and return
|
| 6119 | * that, or if not simply grab a passive reference on our mount namespace and
|
| 6120 | * return that.
|
| 6121 |
|
| 6122 | static struct mnt_namespace *grab_requested_mnt_ns(const struct mnt_id_req *kreq)
|
| 6123 | {
|
| 6124 | struct mnt_namespace *mnt_ns;
|
| 6125 |
|
| 6126 | if (kreq->mnt_ns_id) {
|
| 6127 | mnt_ns = lookup_mnt_ns(kreq->mnt_ns_id);
|
| 6128 | if (!mnt_ns)
|
| 6129 | return ERR_PTR(-ENOENT);
|
| 6130 | } else if (kreq->mnt_ns_fd) {
|
| 6131 | struct ns_common *ns;
|
| 6132 |
|
| 6133 | CLASS(fd, f)(kreq->mnt_ns_fd);
|
| 6134 | if (fd_empty(f))
|
| 6135 | return ERR_PTR(-EBADF);
|
| 6136 |
|
| 6137 | if (!proc_ns_file(fd_file(f)))
|
| 6138 | return ERR_PTR(-EINVAL);
|
| 6139 |
|
| 6140 | ns = get_proc_ns(file_inode(fd_file(f)));
|
| 6141 | if (ns->ns_type != CLONE_NEWNS)
|
| 6142 | return ERR_PTR(-EINVAL);
|
| 6143 |
|
| 6144 | mnt_ns = to_mnt_ns(ns);
|
| 6145 | refcount_inc(&mnt_ns->passive);
|
| 6146 | } else {
|
| 6147 | mnt_ns = current->nsproxy->mnt_ns;
|
| 6148 | refcount_inc(&mnt_ns->passive);
|
| 6149 | }
|
| 6150 |
|
| 6151 | return mnt_ns;
|
| 6152 | }
|
| 6153 |
|
| 6154 | SYSCALL_DEFINE4(statmount, const struct mnt_id_req __user *, req,
|
| 6155 | struct statmount __user *, buf, size_t, bufsize,
|
| 6156 | unsigned int, flags)
|
| 6157 | {
|
| 6158 | struct mnt_namespace *ns __free(mnt_ns_release) = NULL;
|
| 6159 | struct kstatmount *ks __free(kfree) = NULL;
|
| 6160 | struct file *mnt_file __free(fput) = NULL;
|
| 6161 | struct mnt_id_req kreq;
|
| 6162 |
|
| 6163 | size_t seq_size = 3 * PATH_MAX;
|
| 6164 | int ret;
|
| 6165 |
|
| 6166 | if (flags & ~STATMOUNT_BY_FD)
|
| 6167 | return -EINVAL;
|
| 6168 |
|
| 6169 | ret = copy_mnt_id_req(req, &kreq, flags);
|
| 6170 | if (ret)
|
| 6171 | return ret;
|
| 6172 |
|
| 6173 | if (flags & STATMOUNT_BY_FD) {
|
| 6174 | mnt_file = fget_raw(kreq.mnt_fd);
|
| 6175 | if (!mnt_file)
|
| 6176 | return -EBADF;
|
| 6177 |
|
| 6178 | } else {
|
| 6179 | ns = grab_requested_mnt_ns(&kreq);
|
| 6180 | if (IS_ERR(ns))
|
| 6181 | return PTR_ERR(ns);
|
| 6182 |
|
| 6183 | if (kreq.mnt_ns_id && (ns != current->nsproxy->mnt_ns) &&
|
| 6184 | !ns_capable_noaudit(ns->user_ns, CAP_SYS_ADMIN))
|
| 6185 | return -EPERM;
|
| 6186 | }
|
| 6187 |
|
| 6188 | ks = kmalloc_obj(*ks, GFP_KERNEL_ACCOUNT);
|
| 6189 | if (!ks)
|
| 6190 | return -ENOMEM;
|
| 6191 |
|
| 6192 | retry:
|
| 6193 | ret = prepare_kstatmount(ks, &kreq, buf, bufsize, seq_size);
|
| 6194 | if (ret)
|
| 6195 | return ret;
|
| 6196 |
|
| 6197 | scoped_guard(namespace_shared)
|
| 6198 | ret = do_statmount(ks, kreq.mnt_id, kreq.mnt_ns_id, mnt_file, ns);
|
| 6199 |
|
| 6200 | if (!ret)
|
| 6201 | ret = copy_statmount_to_user(ks);
|
| 6202 | kvfree(ks->seq.buf);
|
| 6203 | path_put(&ks->root);
|
| 6204 | if (retry_statmount(ret, &seq_size))
|
| 6205 | goto retry;
|
| 6206 | return ret;
|
| 6207 | }
|
| 6208 |
|
| 6209 | struct klistmount {
|
| 6210 | u64 last_mnt_id;
|
| 6211 | u64 mnt_parent_id;
|
| 6212 | u64 *kmnt_ids;
|
| 6213 | u32 nr_mnt_ids;
|
| 6214 | struct mnt_namespace *ns;
|
| 6215 | struct path root;
|
| 6216 | };
|
| 6217 |
|
| 6218 |
|
| 6219 | static ssize_t do_listmount(struct klistmount *kls, bool reverse)
|
| 6220 | {
|
| 6221 | struct mnt_namespace *ns = kls->ns;
|
| 6222 | u64 mnt_parent_id = kls->mnt_parent_id;
|
| 6223 | u64 last_mnt_id = kls->last_mnt_id;
|
| 6224 | u64 *mnt_ids = kls->kmnt_ids;
|
| 6225 | size_t nr_mnt_ids = kls->nr_mnt_ids;
|
| 6226 | struct path orig;
|
| 6227 | struct mount *r, *first;
|
| 6228 | ssize_t ret;
|
| 6229 |
|
| 6230 | rwsem_assert_held(&namespace_sem);
|
| 6231 |
|
| 6232 | ret = grab_requested_root(ns, &kls->root);
|
| 6233 | if (ret)
|
| 6234 | return ret;
|
| 6235 |
|
| 6236 | if (mnt_parent_id == LSMT_ROOT) {
|
| 6237 | orig = kls->root;
|
| 6238 | } else {
|
| 6239 | orig.mnt = lookup_mnt_in_ns(mnt_parent_id, ns);
|
| 6240 | if (!orig.mnt)
|
| 6241 | return -ENOENT;
|
| 6242 | orig.dentry = orig.mnt->mnt_root;
|
| 6243 | }
|
| 6244 |
|
| 6245 | |
| 6246 | * Don't trigger audit denials. We just want to determine what
|
| 6247 | * mounts to show users.
|
| 6248 |
|
| 6249 | if (!is_path_reachable(real_mount(orig.mnt), orig.dentry, &kls->root) &&
|
| 6250 | !ns_capable_noaudit(ns->user_ns, CAP_SYS_ADMIN))
|
| 6251 | return -EPERM;
|
| 6252 |
|
| 6253 | ret = security_sb_statfs(orig.dentry);
|
| 6254 | if (ret)
|
| 6255 | return ret;
|
| 6256 |
|
| 6257 | if (!last_mnt_id) {
|
| 6258 | if (reverse)
|
| 6259 | first = node_to_mount(ns->mnt_last_node);
|
| 6260 | else
|
| 6261 | first = node_to_mount(ns->mnt_first_node);
|
| 6262 | } else {
|
| 6263 | if (reverse)
|
| 6264 | first = mnt_find_id_at_reverse(ns, last_mnt_id - 1);
|
| 6265 | else
|
| 6266 | first = mnt_find_id_at(ns, last_mnt_id + 1);
|
| 6267 | }
|
| 6268 |
|
| 6269 | for (ret = 0, r = first; r && nr_mnt_ids; r = listmnt_next(r, reverse)) {
|
| 6270 | if (r->mnt_id_unique == mnt_parent_id)
|
| 6271 | continue;
|
| 6272 | if (!is_path_reachable(r, r->mnt.mnt_root, &orig))
|
| 6273 | continue;
|
| 6274 | *mnt_ids = r->mnt_id_unique;
|
| 6275 | mnt_ids++;
|
| 6276 | nr_mnt_ids--;
|
| 6277 | ret++;
|
| 6278 | }
|
| 6279 | return ret;
|
| 6280 | }
|
| 6281 |
|
| 6282 | static void __free_klistmount_free(const struct klistmount *kls)
|
| 6283 | {
|
| 6284 | path_put(&kls->root);
|
| 6285 | kvfree(kls->kmnt_ids);
|
| 6286 | mnt_ns_release(kls->ns);
|
| 6287 | }
|
| 6288 |
|
| 6289 | static inline int prepare_klistmount(struct klistmount *kls, struct mnt_id_req *kreq,
|
| 6290 | size_t nr_mnt_ids)
|
| 6291 | {
|
| 6292 | u64 last_mnt_id = kreq->param;
|
| 6293 | struct mnt_namespace *ns;
|
| 6294 |
|
| 6295 |
|
| 6296 | if (last_mnt_id != 0 && last_mnt_id <= MNT_UNIQUE_ID_OFFSET)
|
| 6297 | return -EINVAL;
|
| 6298 |
|
| 6299 | kls->last_mnt_id = last_mnt_id;
|
| 6300 |
|
| 6301 | kls->nr_mnt_ids = nr_mnt_ids;
|
| 6302 | kls->kmnt_ids = kvmalloc_array(nr_mnt_ids, sizeof(*kls->kmnt_ids),
|
| 6303 | GFP_KERNEL_ACCOUNT);
|
| 6304 | if (!kls->kmnt_ids)
|
| 6305 | return -ENOMEM;
|
| 6306 |
|
| 6307 | ns = grab_requested_mnt_ns(kreq);
|
| 6308 | if (IS_ERR(ns))
|
| 6309 | return PTR_ERR(ns);
|
| 6310 | kls->ns = ns;
|
| 6311 |
|
| 6312 | kls->mnt_parent_id = kreq->mnt_id;
|
| 6313 | return 0;
|
| 6314 | }
|
| 6315 |
|
| 6316 | SYSCALL_DEFINE4(listmount, const struct mnt_id_req __user *, req,
|
| 6317 | u64 __user *, mnt_ids, size_t, nr_mnt_ids, unsigned int, flags)
|
| 6318 | {
|
| 6319 | struct klistmount kls __free(klistmount_free) = {};
|
| 6320 | const size_t maxcount = 1000000;
|
| 6321 | struct mnt_id_req kreq;
|
| 6322 | ssize_t ret;
|
| 6323 |
|
| 6324 | if (flags & ~LISTMOUNT_REVERSE)
|
| 6325 | return -EINVAL;
|
| 6326 |
|
| 6327 | |
| 6328 | * If the mount namespace really has more than 1 million mounts the
|
| 6329 | * caller must iterate over the mount namespace (and reconsider their
|
| 6330 | * system design...).
|
| 6331 |
|
| 6332 | if (unlikely(nr_mnt_ids > maxcount))
|
| 6333 | return -EOVERFLOW;
|
| 6334 |
|
| 6335 | if (!access_ok(mnt_ids, nr_mnt_ids * sizeof(*mnt_ids)))
|
| 6336 | return -EFAULT;
|
| 6337 |
|
| 6338 | ret = copy_mnt_id_req(req, &kreq, 0);
|
| 6339 | if (ret)
|
| 6340 | return ret;
|
| 6341 |
|
| 6342 | ret = prepare_klistmount(&kls, &kreq, nr_mnt_ids);
|
| 6343 | if (ret)
|
| 6344 | return ret;
|
| 6345 |
|
| 6346 | if (kreq.mnt_ns_id && (kls.ns != current->nsproxy->mnt_ns) &&
|
| 6347 | !ns_capable_noaudit(kls.ns->user_ns, CAP_SYS_ADMIN))
|
| 6348 | return -ENOENT;
|
| 6349 |
|
| 6350 | |
| 6351 | * We only need to guard against mount topology changes as
|
| 6352 | * listmount() doesn't care about any mount properties.
|
| 6353 |
|
| 6354 | scoped_guard(namespace_shared)
|
| 6355 | ret = do_listmount(&kls, (flags & LISTMOUNT_REVERSE));
|
| 6356 | if (ret <= 0)
|
| 6357 | return ret;
|
| 6358 |
|
| 6359 | if (copy_to_user(mnt_ids, kls.kmnt_ids, ret * sizeof(*mnt_ids)))
|
| 6360 | return -EFAULT;
|
| 6361 |
|
| 6362 | return ret;
|
| 6363 | }
|
| 6364 |
|
| 6365 | struct mnt_namespace init_mnt_ns = {
|
| 6366 | .ns = NS_COMMON_INIT(init_mnt_ns),
|
| 6367 | .user_ns = &init_user_ns,
|
| 6368 | .passive = REFCOUNT_INIT(1),
|
| 6369 | .mounts = RB_ROOT,
|
| 6370 | .poll = __WAIT_QUEUE_HEAD_INITIALIZER(init_mnt_ns.poll),
|
| 6371 | };
|
| 6372 |
|
| 6373 | static void __init mount_rootfs_on_nullfs(struct vfsmount *mnt,
|
| 6374 | struct vfsmount *nullfs_mnt)
|
| 6375 | {
|
| 6376 | struct path root = {
|
| 6377 | .mnt = nullfs_mnt,
|
| 6378 | .dentry = nullfs_mnt->mnt_root,
|
| 6379 | };
|
| 6380 |
|
| 6381 | LOCK_MOUNT_EXACT(mp, &root);
|
| 6382 | if (unlikely(IS_ERR(mp.parent)))
|
| 6383 | panic("VFS: Failed to mount rootfs on nullfs");
|
| 6384 | scoped_guard(mount_writer)
|
| 6385 | attach_mnt(real_mount(mnt), mp.parent, mp.mp);
|
| 6386 | }
|
| 6387 |
|
| 6388 | static struct vfsmount *__init knullfs_file_mount(void)
|
| 6389 | {
|
| 6390 | struct dentry *file;
|
| 6391 | struct mount *mnt;
|
| 6392 |
|
| 6393 | file = nullfs_new_file(knullfs->mnt_sb);
|
| 6394 | if (IS_ERR(file))
|
| 6395 | return ERR_CAST(file);
|
| 6396 | mnt = clone_mnt(real_mount(knullfs), file, CL_PRIVATE);
|
| 6397 | dput(file);
|
| 6398 | if (IS_ERR(mnt))
|
| 6399 | return ERR_CAST(mnt);
|
| 6400 | mnt->mnt_ns = MNT_NS_INTERNAL;
|
| 6401 | mnt->mnt.mnt_flags |= MNT_INTERNAL;
|
| 6402 | mnt->mnt.mnt_flags &= ~MNT_READONLY;
|
| 6403 | dont_mount(mnt->mnt.mnt_root);
|
| 6404 | return &mnt->mnt;
|
| 6405 | }
|
| 6406 |
|
| 6407 | static void __init init_mount_tree(void)
|
| 6408 | {
|
| 6409 | struct vfsmount *mnt, *nullfs_mnt;
|
| 6410 | struct mount *mnt_root;
|
| 6411 | struct path root;
|
| 6412 |
|
| 6413 | |
| 6414 | * We create three mounts:
|
| 6415 | *
|
| 6416 | * (1) nullfs with mount id 1
|
| 6417 | * (2) mutable rootfs with mount id 2
|
| 6418 | * (3) private nullfs for kthreads (SB_KERNMOUNT), kept in knullfs
|
| 6419 | * (4) a second mount of (3) rooted on a regular file, kept in
|
| 6420 | * knullfs_file
|
| 6421 | *
|
| 6422 | * with (2) mounted on top of (1). The init_task's root and pwd
|
| 6423 | * are pointed at (3) so all kthreads start isolated in nullfs.
|
| 6424 | * A lookup at the cover an unmounted mount left behind finds (3)
|
| 6425 | * or (4), see __lookup_mnt().
|
| 6426 |
|
| 6427 | nullfs_mnt = vfs_kern_mount(&nullfs_fs_type, 0, "nullfs", NULL);
|
| 6428 | if (IS_ERR(nullfs_mnt))
|
| 6429 | panic("VFS: Failed to create nullfs");
|
| 6430 |
|
| 6431 | mnt = vfs_kern_mount(&rootfs_fs_type, 0, "rootfs", initramfs_options);
|
| 6432 | if (IS_ERR(mnt))
|
| 6433 | panic("Can't create rootfs");
|
| 6434 |
|
| 6435 | VFS_WARN_ON_ONCE(real_mount(nullfs_mnt)->mnt_id != 1);
|
| 6436 | VFS_WARN_ON_ONCE(real_mount(mnt)->mnt_id != 2);
|
| 6437 |
|
| 6438 |
|
| 6439 | mnt_root = real_mount(nullfs_mnt);
|
| 6440 | init_mnt_ns.root = mnt_root;
|
| 6441 |
|
| 6442 | mount_rootfs_on_nullfs(mnt, nullfs_mnt);
|
| 6443 |
|
| 6444 | pr_info("VFS: Finished mounting rootfs on nullfs\n");
|
| 6445 |
|
| 6446 | |
| 6447 | * We've dropped all locks here but that's fine. Not just are we
|
| 6448 | * the only task that's running, there's no other mount
|
| 6449 | * namespace in existence and the initial mount namespace is
|
| 6450 | * completely empty until we add the mounts we just created.
|
| 6451 |
|
| 6452 | for (struct mount *p = mnt_root; p; p = next_mnt(p, mnt_root)) {
|
| 6453 | mnt_add_to_ns(&init_mnt_ns, p);
|
| 6454 | init_mnt_ns.nr_mounts++;
|
| 6455 | }
|
| 6456 |
|
| 6457 | knullfs = kern_mount(&nullfs_fs_type);
|
| 6458 | if (IS_ERR(knullfs))
|
| 6459 | panic("VFS: Failed to create private nullfs instance");
|
| 6460 |
|
| 6461 | dont_mount(knullfs->mnt_root);
|
| 6462 |
|
| 6463 | knullfs->mnt_flags |= MNT_READONLY;
|
| 6464 | knullfs_file = knullfs_file_mount();
|
| 6465 | if (IS_ERR(knullfs_file))
|
| 6466 | panic("VFS: Failed to create the nullfs file stand-in");
|
| 6467 | root.mnt = knullfs;
|
| 6468 | root.dentry = knullfs->mnt_root;
|
| 6469 |
|
| 6470 | init_task.nsproxy->mnt_ns = &init_mnt_ns;
|
| 6471 | get_mnt_ns(&init_mnt_ns);
|
| 6472 | set_fs_pwd(current->fs, &root);
|
| 6473 | set_fs_root(current->fs, &root);
|
| 6474 |
|
| 6475 | ns_tree_add(&init_mnt_ns);
|
| 6476 | }
|
| 6477 |
|
| 6478 | void __init mnt_init(void)
|
| 6479 | {
|
| 6480 | int err;
|
| 6481 |
|
| 6482 | mnt_cache = kmem_cache_create("mnt_cache", sizeof(struct mount),
|
| 6483 | 0, SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_ACCOUNT, NULL);
|
| 6484 |
|
| 6485 | mount_hashtable = alloc_large_system_hash("Mount-cache",
|
| 6486 | sizeof(struct hlist_head),
|
| 6487 | mhash_entries, 19,
|
| 6488 | HASH_ZERO,
|
| 6489 | &m_hash_shift, &m_hash_mask, 0, 0);
|
| 6490 | mountpoint_hashtable = alloc_large_system_hash("Mountpoint-cache",
|
| 6491 | sizeof(struct hlist_head),
|
| 6492 | mphash_entries, 19,
|
| 6493 | HASH_ZERO,
|
| 6494 | &mp_hash_shift, &mp_hash_mask, 0, 0);
|
| 6495 |
|
| 6496 | super_dev_init();
|
| 6497 |
|
| 6498 | kernfs_init();
|
| 6499 |
|
| 6500 | err = sysfs_init();
|
| 6501 | if (err)
|
| 6502 | printk(KERN_WARNING "%s: sysfs_init error: %d\n",
|
| 6503 | __func__, err);
|
| 6504 | fs_kobj = kobject_create_and_add("fs", NULL);
|
| 6505 | if (!fs_kobj)
|
| 6506 | printk(KERN_WARNING "%s: kobj create error\n", __func__);
|
| 6507 | shmem_init();
|
| 6508 | init_rootfs();
|
| 6509 | init_mount_tree();
|
| 6510 | failfs_init();
|
| 6511 | }
|
| 6512 |
|
| 6513 | void put_mnt_ns(struct mnt_namespace *ns)
|
| 6514 | {
|
| 6515 | if (!ns_ref_put(ns))
|
| 6516 | return;
|
| 6517 | guard(namespace_excl)();
|
| 6518 | emptied_ns = ns;
|
| 6519 | guard(mount_writer)();
|
| 6520 | umount_tree(ns->root, 0);
|
| 6521 | }
|
| 6522 |
|
| 6523 | struct vfsmount *kern_mount(struct file_system_type *type)
|
| 6524 | {
|
| 6525 | struct vfsmount *mnt;
|
| 6526 | mnt = vfs_kern_mount(type, SB_KERNMOUNT, type->name, NULL);
|
| 6527 | if (!IS_ERR(mnt)) {
|
| 6528 | |
| 6529 | * it is a longterm mount, don't release mnt until
|
| 6530 | * we unmount before file sys is unregistered
|
| 6531 |
|
| 6532 | real_mount(mnt)->mnt_ns = MNT_NS_INTERNAL;
|
| 6533 | }
|
| 6534 | return mnt;
|
| 6535 | }
|
| 6536 | EXPORT_SYMBOL_GPL(kern_mount);
|
| 6537 |
|
| 6538 | void kern_unmount(struct vfsmount *mnt)
|
| 6539 | {
|
| 6540 |
|
| 6541 | if (!IS_ERR(mnt)) {
|
| 6542 | mnt_make_shortterm(mnt);
|
| 6543 | synchronize_rcu();
|
| 6544 | mntput(mnt);
|
| 6545 | }
|
| 6546 | }
|
| 6547 | EXPORT_SYMBOL(kern_unmount);
|
| 6548 |
|
| 6549 | void kern_unmount_array(struct vfsmount *mnt[], unsigned int num)
|
| 6550 | {
|
| 6551 | unsigned int i;
|
| 6552 |
|
| 6553 | for (i = 0; i < num; i++)
|
| 6554 | mnt_make_shortterm(mnt[i]);
|
| 6555 | synchronize_rcu_expedited();
|
| 6556 | for (i = 0; i < num; i++)
|
| 6557 | mntput(mnt[i]);
|
| 6558 | }
|
| 6559 | EXPORT_SYMBOL(kern_unmount_array);
|
| 6560 |
|
| 6561 | bool our_mnt(struct vfsmount *mnt)
|
| 6562 | {
|
| 6563 | return check_mnt(real_mount(mnt));
|
| 6564 | }
|
| 6565 |
|
| 6566 | bool current_chrooted(void)
|
| 6567 | {
|
| 6568 |
|
| 6569 | struct path fs_root __free(path_put) = {};
|
| 6570 | struct mount *root;
|
| 6571 |
|
| 6572 | get_fs_root(current->fs, &fs_root);
|
| 6573 |
|
| 6574 |
|
| 6575 |
|
| 6576 | guard(mount_locked_reader)();
|
| 6577 |
|
| 6578 | root = topmost_overmount(current->nsproxy->mnt_ns->root);
|
| 6579 |
|
| 6580 | return fs_root.mnt != &root->mnt || !path_mounted(&fs_root);
|
| 6581 | }
|
| 6582 |
|
| 6583 | static bool mnt_already_visible(struct mnt_namespace *ns,
|
| 6584 | const struct super_block *sb,
|
| 6585 | int *new_mnt_flags)
|
| 6586 | {
|
| 6587 | int new_flags = *new_mnt_flags;
|
| 6588 | struct mount *mnt;
|
| 6589 |
|
| 6590 |
|
| 6591 | if (hlist_empty(&ns->mnt_visible_mounts))
|
| 6592 | return false;
|
| 6593 |
|
| 6594 | guard(namespace_shared)();
|
| 6595 | hlist_for_each_entry(mnt, &ns->mnt_visible_mounts, mnt_ns_visible) {
|
| 6596 | const struct super_block *sb_visible = mnt->mnt.mnt_sb;
|
| 6597 | struct mount *child;
|
| 6598 | int mnt_flags;
|
| 6599 |
|
| 6600 | if (sb_visible->s_type != sb->s_type)
|
| 6601 | continue;
|
| 6602 |
|
| 6603 | |
| 6604 | * Restricted variants are not compatible with anything, even
|
| 6605 | * other restricted variants.
|
| 6606 |
|
| 6607 | if (sb_visible->s_iflags & SB_I_RESTRICTED_VARIANT)
|
| 6608 | continue;
|
| 6609 |
|
| 6610 |
|
| 6611 | mnt_flags = mnt->mnt.mnt_flags;
|
| 6612 |
|
| 6613 |
|
| 6614 | if (sb_rdonly(mnt->mnt.mnt_sb))
|
| 6615 | mnt_flags |= MNT_LOCK_READONLY;
|
| 6616 |
|
| 6617 | |
| 6618 | * than the proposed new mount.
|
| 6619 |
|
| 6620 | if ((mnt_flags & MNT_LOCK_READONLY) &&
|
| 6621 | !(new_flags & MNT_READONLY))
|
| 6622 | continue;
|
| 6623 | if ((mnt_flags & MNT_LOCK_ATIME) &&
|
| 6624 | ((mnt_flags & MNT_ATIME_MASK) != (new_flags & MNT_ATIME_MASK)))
|
| 6625 | continue;
|
| 6626 |
|
| 6627 | |
| 6628 | * locked child mounts that cover anything except for
|
| 6629 | * empty directories.
|
| 6630 |
|
| 6631 | list_for_each_entry(child, &mnt->mnt_mounts, mnt_child) {
|
| 6632 | struct inode *inode = child->mnt_mountpoint->d_inode;
|
| 6633 |
|
| 6634 | if (!(child->mnt.mnt_flags & MNT_LOCKED))
|
| 6635 | continue;
|
| 6636 |
|
| 6637 | if (!is_empty_dir_inode(inode))
|
| 6638 | goto next;
|
| 6639 | }
|
| 6640 |
|
| 6641 | *new_mnt_flags |= mnt_flags & (MNT_LOCK_READONLY | \
|
| 6642 | MNT_LOCK_ATIME);
|
| 6643 | return true;
|
| 6644 | next: ;
|
| 6645 | }
|
| 6646 | return false;
|
| 6647 | }
|
| 6648 |
|
| 6649 | static bool mount_too_revealing(const struct super_block *sb, int *new_mnt_flags)
|
| 6650 | {
|
| 6651 | const unsigned long required_iflags = SB_I_NOEXEC | SB_I_NODEV;
|
| 6652 | struct mnt_namespace *ns = current->nsproxy->mnt_ns;
|
| 6653 | unsigned long s_iflags;
|
| 6654 |
|
| 6655 | if (ns->user_ns == &init_user_ns)
|
| 6656 | return false;
|
| 6657 |
|
| 6658 |
|
| 6659 | if (!(sb->s_type->fs_flags & FS_USERNS_MOUNT_RESTRICTED))
|
| 6660 | return false;
|
| 6661 |
|
| 6662 | s_iflags = sb->s_iflags;
|
| 6663 | if ((s_iflags & required_iflags) != required_iflags) {
|
| 6664 | WARN_ONCE(1, "Expected s_iflags to contain 0x%lx\n",
|
| 6665 | required_iflags);
|
| 6666 | return true;
|
| 6667 | }
|
| 6668 |
|
| 6669 | |
| 6670 | * Restricted variants don't need an already visible mount because they
|
| 6671 | * don't expose the full filesystem view.
|
| 6672 |
|
| 6673 | if (s_iflags & SB_I_RESTRICTED_VARIANT)
|
| 6674 | return false;
|
| 6675 |
|
| 6676 | return !mnt_already_visible(ns, sb, new_mnt_flags);
|
| 6677 | }
|
| 6678 |
|
| 6679 | bool mnt_may_suid(struct vfsmount *mnt)
|
| 6680 | {
|
| 6681 | |
| 6682 | * Foreign mounts (accessed via fchdir or through /proc
|
| 6683 | * symlinks) are always treated as if they are nosuid. This
|
| 6684 | * prevents namespaces from trusting potentially unsafe
|
| 6685 | * suid/sgid bits, file caps, or security labels that originate
|
| 6686 | * in other namespaces.
|
| 6687 |
|
| 6688 | return !(mnt->mnt_flags & MNT_NOSUID) && check_mnt(real_mount(mnt)) &&
|
| 6689 | current_in_userns(mnt->mnt_sb->s_user_ns);
|
| 6690 | }
|
| 6691 |
|
| 6692 | static struct ns_common *mntns_get(struct task_struct *task)
|
| 6693 | {
|
| 6694 | struct ns_common *ns = NULL;
|
| 6695 | struct nsproxy *nsproxy;
|
| 6696 |
|
| 6697 | task_lock(task);
|
| 6698 | nsproxy = task->nsproxy;
|
| 6699 | if (nsproxy) {
|
| 6700 | ns = &nsproxy->mnt_ns->ns;
|
| 6701 | get_mnt_ns(to_mnt_ns(ns));
|
| 6702 | }
|
| 6703 | task_unlock(task);
|
| 6704 |
|
| 6705 | return ns;
|
| 6706 | }
|
| 6707 |
|
| 6708 | static void mntns_put(struct ns_common *ns)
|
| 6709 | {
|
| 6710 | put_mnt_ns(to_mnt_ns(ns));
|
| 6711 | }
|
| 6712 |
|
| 6713 | static int mntns_install(struct nsset *nsset, struct ns_common *ns)
|
| 6714 | {
|
| 6715 | struct nsproxy *nsproxy = nsset->nsproxy;
|
| 6716 | struct fs_struct *fs = nsset->fs;
|
| 6717 | struct mnt_namespace *mnt_ns = to_mnt_ns(ns), *old_mnt_ns;
|
| 6718 | struct user_namespace *user_ns = nsset->cred->user_ns;
|
| 6719 | struct path root;
|
| 6720 | int err;
|
| 6721 |
|
| 6722 | if (!ns_capable(mnt_ns->user_ns, CAP_SYS_ADMIN) ||
|
| 6723 | !ns_capable(user_ns, CAP_SYS_CHROOT) ||
|
| 6724 | !ns_capable(user_ns, CAP_SYS_ADMIN))
|
| 6725 | return -EPERM;
|
| 6726 |
|
| 6727 | if (is_anon_ns(mnt_ns))
|
| 6728 | return -EINVAL;
|
| 6729 |
|
| 6730 | if (fs->users != 1)
|
| 6731 | return -EINVAL;
|
| 6732 |
|
| 6733 | get_mnt_ns(mnt_ns);
|
| 6734 | old_mnt_ns = nsproxy->mnt_ns;
|
| 6735 | nsproxy->mnt_ns = mnt_ns;
|
| 6736 |
|
| 6737 |
|
| 6738 | err = vfs_path_lookup(mnt_ns->root->mnt.mnt_root, &mnt_ns->root->mnt,
|
| 6739 | "/", LOOKUP_DOWN, &root);
|
| 6740 | if (err) {
|
| 6741 |
|
| 6742 | nsproxy->mnt_ns = old_mnt_ns;
|
| 6743 | put_mnt_ns(mnt_ns);
|
| 6744 | return err;
|
| 6745 | }
|
| 6746 |
|
| 6747 | put_mnt_ns(old_mnt_ns);
|
| 6748 |
|
| 6749 |
|
| 6750 | set_fs_pwd(fs, &root);
|
| 6751 | set_fs_root(fs, &root);
|
| 6752 |
|
| 6753 | path_put(&root);
|
| 6754 | return 0;
|
| 6755 | }
|
| 6756 |
|
| 6757 | static struct user_namespace *mntns_owner(struct ns_common *ns)
|
| 6758 | {
|
| 6759 | return to_mnt_ns(ns)->user_ns;
|
| 6760 | }
|
| 6761 |
|
| 6762 | const struct proc_ns_operations mntns_operations = {
|
| 6763 | .name = "mnt",
|
| 6764 | .get = mntns_get,
|
| 6765 | .put = mntns_put,
|
| 6766 | .install = mntns_install,
|
| 6767 | .owner = mntns_owner,
|
| 6768 | };
|
| 6769 |
|
| 6770 | #ifdef CONFIG_SYSCTL
|
| 6771 | static const struct ctl_table fs_namespace_sysctls[] = {
|
| 6772 | {
|
| 6773 | .procname = "mount-max",
|
| 6774 | .data = &sysctl_mount_max,
|
| 6775 | .maxlen = sizeof(unsigned int),
|
| 6776 | .mode = 0644,
|
| 6777 | .proc_handler = proc_dointvec_minmax,
|
| 6778 | .extra1 = SYSCTL_ONE,
|
| 6779 | },
|
| 6780 | };
|
| 6781 |
|
| 6782 | static int __init init_fs_namespace_sysctls(void)
|
| 6783 | {
|
| 6784 | register_sysctl_init("fs", fs_namespace_sysctls);
|
| 6785 | return 0;
|
| 6786 | }
|
| 6787 | fs_initcall(init_fs_namespace_sysctls);
|
| 6788 |
|
| 6789 | #endif
|