Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1429258

[PATCH 4.6 13/81] bpf, inode: disallow userns mounts

Show all headers | View raw

4.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Daniel Borkmann <daniel@iogearbox.net>

[ Upstream commit 612bacad78ba6d0a91166fc4487af114bac172a8 ]

Follow-up to commit e27f4a942a0e ("bpf: Use mount_nodev not mount_ns
to mount the bpf filesystem"), which removes the FS_USERNS_MOUNT flag.

The original idea was to have a per mountns instance instead of a
single global fs instance, but that didn't work out and we had to
switch to mount_nodev() model. The intent of that middle ground was
that we avoid users who don't play nice to create endless instances
of bpf fs which are difficult to control and discover from an admin
point of view, but at the same time it would have allowed us to be
more flexible with regard to namespaces.

Therefore, since we now did the switch to mount_nodev() as a fix
where individual instances are created, we also need to remove userns
mount flag along with it to avoid running into mentioned situation.
I don't expect any breakage at this early point in time with removing
the flag and we can revisit this later should the requirement for
this come up with future users. This and commit e27f4a942a0e have
been split to facilitate tracking should any of them run into the
unlikely case of causing a regression.

Fixes: b2197755b263 ("bpf: add support for persistent maps/progs")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/bpf/inode.c |    1 -
 1 file changed, 1 deletion(-)

--- a/kernel/bpf/inode.c
+++ b/kernel/bpf/inode.c
@@ -386,7 +386,6 @@ static struct file_system_type bpf_fs_ty
 	.name		= "bpf",
 	.mount		= bpf_mount,
 	.kill_sb	= kill_litter_super,
-	.fs_flags	= FS_USERNS_MOUNT,
 };
 
 MODULE_ALIAS_FS("bpf");

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 4.6 00/81] 4.6.3-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-23 01:10 +0200
  [PATCH 4.6 12/81] ipv4: Fix non-initialized TTL when CONFIG_SYSCTL=n Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-23 01:10 +0200
  [PATCH 4.6 25/81] l2tp: fix configuration passed to setup_udp_tunnel_sock() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-23 01:10 +0200
  [PATCH 4.6 40/81] gpiolib: Fix NULL pointer deference Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-23 01:10 +0200
  [PATCH 4.6 27/81] KVM: arm/arm64: vgic-v2: Clear all dirty LRs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-23 01:10 +0200
  [PATCH 4.6 13/81] bpf, inode: disallow userns mounts Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-23 01:10 +0200
  [PATCH 4.6 45/81] crypto: public_key: select CRYPTO_AKCIPHER Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-23 01:10 +0200
  [PATCH 4.6 09/81] bpf: Use mount_nodev not mount_ns to mount the bpf filesystem Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-23 01:10 +0200
  [PATCH 4.6 19/81] net: stmmac: Fix incorrect memcpy source memory Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-23 01:10 +0200
  [PATCH 4.6 23/81] tcp: record TLP and ER timer stats in v6 stats Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-23 01:10 +0200
  [PATCH 4.6 02/81] scsi: Add QEMU CD-ROM to VPD Inquiry Blacklist Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-23 01:10 +0200
  [PATCH 4.6 43/81] s390/bpf: reduce maximum program size to 64 KB Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-23 01:10 +0200
  [PATCH 4.6 28/81] KVM: arm/arm64: vgic-v3: Clear all dirty LRs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-23 01:10 +0200
  [PATCH 4.6 15/81] net: hwbm: Fix unbalanced spinlock in error case Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-23 01:10 +0200
  [PATCH 4.6 08/81] tuntap: correctly wake up process during uninit Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-23 01:10 +0200
  [PATCH 4.6 00/87] 4.6.3-stable review -rc2 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-06-23 07:00 +0200
  Re: [PATCH 4.6 38/81] gpio: bail out silently on NULL descriptors Linus Walleij <linus.walleij@linaro.org> - 2016-06-23 09:30 +0200
    Re: [PATCH 4.6 38/81] gpio: bail out silently on NULL descriptors Hans de Goede <hdegoede@redhat.com> - 2016-06-23 11:20 +0200

csiph-web