Home » Mailing lists » Devel » [patch 0/8] mount ownership and unprivileged mount syscall (v4)
Re: [patch 1/8] add user mounts to the kernel [message #18473 is a reply to message #18451] |
Sun, 22 April 2007 16:22 ![Go to previous message Go to previous message](/theme/ovz3/images/up.png) ![Go to next message Go to previous message](/theme/ovz3/images/down.png) |
Miklos Szeredi
Messages: 161 Registered: April 2007
|
Senior Member |
|
|
> >> > +
> >> > + uid_t mnt_uid; /* owner of the mount */
> >>
> >> Can we please make this a user struct. That requires a bit of
> >> reference counting but it has uid namespace benefits as well
> >> as making it easy to implement per user mount rlimits.
> >
> > OK, can you ellaborate, what the uid namespace benifits are?
>
> In the uid namespace the comparison is simpler as are the propagations
> rules. Basically if you use a struct user you will never need to
> care about a uid namespace.
I tried to implement it but got stuck on this: fsuid doesn't have a
user_struct in task_struct (yet), so we'd now have to convert
current->fsuid to a user_struct. This can be done with alloc_uid(),
but this can fail, bringing in extra error handling complexity.
Also we'd have to compare current->fsuid with a user_struct, which we
don't yet know how will actually be done in the future.
So it seems, we still have to care about the uid namespace, at least
if fsuid is preferred to ruid.
Anyway, here's a patch fixing the other things you brought up, and
which I agree with. Does this look OK?
Thanks,
Miklos
Index: linux/fs/namespace.c
===================================================================
--- linux.orig/fs/namespace.c 2007-04-22 17:48:18.000000000 +0200
+++ linux/fs/namespace.c 2007-04-22 18:19:51.000000000 +0200
@@ -252,10 +252,12 @@ static int reserve_user_mount(void)
static void __set_mnt_user(struct vfsmount *mnt)
{
BUG_ON(mnt->mnt_flags & MNT_USER);
- mnt->mnt_uid = current->uid;
+ mnt->mnt_uid = current->fsuid;
mnt->mnt_flags |= MNT_USER;
- if (!capable(CAP_SYS_ADMIN))
- mnt->mnt_flags |= MNT_NOSUID | MNT_NODEV;
+ if (!capable(CAP_SETUID))
+ mnt->mnt_flags |= MNT_NOSUID;
+ if (!capable(CAP_MKNOD))
+ mnt->mnt_flags |= MNT_NODEV;
}
static void set_mnt_user(struct vfsmount *mnt)
@@ -725,10 +727,10 @@ static bool permit_umount(struct vfsmoun
if (!(mnt->mnt_flags & MNT_USER))
return false;
- if (flags & MNT_FORCE)
+ if ((flags & MNT_FORCE) && !(mnt->mnt_sb->s_type->fs_flags & FS_SAFE))
return false;
- return mnt->mnt_uid == current->uid;
+ return mnt->mnt_uid == current->fsuid;
}
/*
@@ -792,13 +794,13 @@ static bool permit_mount(struct nameidat
if (type && !(type->fs_flags & FS_SAFE))
return false;
- if (!S_ISDIR(inode->i_mode) && !S_ISREG(inode->i_mode))
+ if (S_ISLNK(inode->i_mode))
return false;
if (!(nd->mnt->mnt_flags & MNT_USER))
return false;
- if (nd->mnt->mnt_uid != current->uid)
+ if (nd->mnt->mnt_uid != current->fsuid)
return false;
*flags |= MS_SETUSER;
_______________________________________________
Containers mailing list
Containers@lists.linux-foundation.org
https://lists.linux-foundation.org/mailman/listinfo/containers
|
|
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
[patch 0/8] mount ownership and unprivileged mount syscall (v4)
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
[patch 1/8] add user mounts to the kernel
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 1/8] add user mounts to the kernel
By: akpm on Sat, 21 April 2007 07:55
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 1/8] add user mounts to the kernel
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 1/8] add user mounts to the kernel
By: ebiederm on Sat, 21 April 2007 13:14
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 1/8] add user mounts to the kernel
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 1/8] add user mounts to the kernel
By: ebiederm on Sun, 22 April 2007 07:43
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 1/8] add user mounts to the kernel
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 1/8] add user mounts to the kernel
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
[patch 2/8] allow unprivileged umount
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 2/8] allow unprivileged umount
By: akpm on Sat, 21 April 2007 07:55
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 2/8] allow unprivileged umount
By: hpa on Sat, 21 April 2007 08:01
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 2/8] allow unprivileged umount
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 2/8] allow unprivileged umount
By: akpm on Sat, 21 April 2007 08:36
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 2/8] allow unprivileged umount
By: ebiederm on Sat, 21 April 2007 12:53
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 2/8] allow unprivileged umount
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 2/8] allow unprivileged umount
By: ebiederm on Sat, 21 April 2007 13:29
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 2/8] allow unprivileged umount
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 2/8] allow unprivileged umount
By: ebiederm on Sun, 22 April 2007 07:09
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 2/8] allow unprivileged umount
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
[patch 3/8] account user mounts
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 3/8] account user mounts
By: akpm on Sat, 21 April 2007 07:55
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 3/8] account user mounts
By: ebiederm on Sat, 21 April 2007 13:37
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 3/8] account user mounts
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 3/8] account user mounts
By: ebiederm on Sun, 22 April 2007 07:49
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 3/8] account user mounts
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
[patch 4/8] propagate error values from clone_mnt
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 4/8] propagate error values from clone_mnt
By: ebiederm on Sat, 21 April 2007 13:40
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
[patch 5/8] allow unprivileged bind mounts
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 5/8] allow unprivileged bind mounts
By: ebiederm on Sat, 21 April 2007 14:00
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 5/8] allow unprivileged bind mounts
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
[patch 6/8] put declaration of put_filesystem() in fs.h
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
[patch 7/8] allow unprivileged mounts
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 7/8] allow unprivileged mounts
By: akpm on Sat, 21 April 2007 07:55
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 7/8] allow unprivileged mounts
By: ebiederm on Sat, 21 April 2007 14:10
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 7/8] allow unprivileged mounts
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 7/8] allow unprivileged mounts
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 7/8] allow unprivileged mounts
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 7/8] allow unprivileged mounts
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 7/8] allow unprivileged mounts
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 7/8] allow unprivileged mounts
By: ebiederm on Sat, 21 April 2007 16:57
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 7/8] allow unprivileged mounts
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 7/8] allow unprivileged mounts
By: ebiederm on Sat, 21 April 2007 21:00
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 7/8] allow unprivileged mounts
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 7/8] allow unprivileged mounts
By: ebiederm on Sat, 21 April 2007 21:33
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
[patch 8/8] allow unprivileged fuse mounts
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 8/8] allow unprivileged fuse mounts
By: akpm on Sat, 21 April 2007 07:55
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 8/8] allow unprivileged fuse mounts
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 8/8] allow unprivileged fuse mounts
By: ebiederm on Sat, 21 April 2007 14:18
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 8/8] allow unprivileged fuse mounts
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 0/8] mount ownership and unprivileged mount syscall (v4)
By: ebiederm on Wed, 25 April 2007 01:04
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 0/8] mount ownership and unprivileged mount syscall (v4)
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 0/8] mount ownership and unprivileged mount syscall (v4)
|
![Read Message Read Message](/theme/ovz3/images/read.png) |
|
Re: [patch 0/8] mount ownership and unprivileged mount syscall (v4)
|
Goto Forum:
Current Time: Tue Jul 16 11:46:14 GMT 2024
Total time taken to generate the page: 0.02859 seconds
|