| Message ID | 20210121131959.646623-28-christian.brauner@ubuntu.com (mailing list archive) |
|---|---|
| State | Not Applicable |
| Delegated to: | Paul Moore |
| Headers | show |
| Series | idmapped mounts | expand |
On Thu, 21 Jan 2021, Christian Brauner wrote: > Prevent ecryptfs from being mounted on top of idmapped mounts. > Stacking filesystems need to be prevented from being mounted on top of > idmapped mounts until they have have been converted to handle this. > > Link: https://lore.kernel.org/r/20210112220124.837960-39-christian.brauner@ubuntu.com > Cc: Christoph Hellwig <hch@lst.de> > Cc: David Howells <dhowells@redhat.com> > Cc: Al Viro <viro@zeniv.linux.org.uk> > Cc: linux-fsdevel@vger.kernel.org > Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com> Reviewed-by: James Morris <jamorris@linux.microsoft.com>
diff --git a/fs/ecryptfs/main.c b/fs/ecryptfs/main.c index e63259fdef28..cdf40a54a35d 100644 --- a/fs/ecryptfs/main.c +++ b/fs/ecryptfs/main.c @@ -531,6 +531,12 @@ static struct dentry *ecryptfs_mount(struct file_system_type *fs_type, int flags goto out_free; } + if (mnt_user_ns(path.mnt) != &init_user_ns) { + rc = -EINVAL; + printk(KERN_ERR "Mounting on idmapped mounts currently disallowed\n"); + goto out_free; + } + if (check_ruid && !uid_eq(d_inode(path.dentry)->i_uid, current_uid())) { rc = -EPERM; printk(KERN_ERR "Mount of device (uid: %d) not owned by "
Prevent ecryptfs from being mounted on top of idmapped mounts. Stacking filesystems need to be prevented from being mounted on top of idmapped mounts until they have have been converted to handle this. Link: https://lore.kernel.org/r/20210112220124.837960-39-christian.brauner@ubuntu.com Cc: Christoph Hellwig <hch@lst.de> Cc: David Howells <dhowells@redhat.com> Cc: Al Viro <viro@zeniv.linux.org.uk> Cc: linux-fsdevel@vger.kernel.org Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com> --- /* v2 */ patch introduced /* v3 */ - David Howells <dhowells@redhat.com>: - Adapt check after removing mnt_idmapped() helper. /* v4 */ unchanged /* v5 */ unchanged base-commit: 7c53f6b671f4aba70ff15e1b05148b10d58c2837 /* v6 */ unchanged base-commit: 19c329f6808995b142b3966301f217c831e7cf31 --- fs/ecryptfs/main.c | 6 ++++++ 1 file changed, 6 insertions(+)