/* Summary */
This contains two fixes for this merge window:
VFS:
- I noticed that it is possible for a privileged user to mount most filesystems
with a non-initial user namespace in sb->s_user_ns. When fsopen() is called
in a non-init namespace the caller's namespace is recorded in
fs_context->user_ns. If the returned file descriptor is then passed to a
process privileged in init_user_ns, that process can call
fsconfig(fd_fs, FSCONFIG_CMD_CREATE*), creating a new superblock with
sb->s_user_ns set to the namespace of the process which called fsopen().
This is problematic as only filesystems that raise FS_USERNS_MOUNT are known
to be able to support a non-initial s_user_ns. Others may suffer security
issues, on-disk corruption or outright crash the kernel. Prevent that by
restricting such delegation to filesystems that allow FS_USERNS_MOUNT.
Note, that this delegation requires a privileged process to actually create
the superblock so either the privileged process is cooperaing or someone must
have tricked a privileged process into operating on a fscontext file
descriptor whose origin it doesn't know (a stupid idea).
The bug dates back to about 5 years afaict.
misc:
- Fix hostfs parsing when the mount request comes in via the legacy mount api.
In the legacy mount api hostfs allows to specify the host directory mount
without any key. Restore that behavior.
/* Testing */
clang: Debian clang version 16.0.6 (27)
gcc: (Debian 13.2.0-25) 13.2.0
/* Conflicts */
No known conflicts.
The following changes since commit c33ffdb70cc6df4105160f991288e7d2567d7ffa:
Merge tag 'phy-for-6.11' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy (2024-07-24 13:11:28 -0700)
are available in the Git repository at:
git@xxxxxxxxxxxxxxxxxxx:pub/scm/linux/kernel/git/vfs/vfs tags/vfs-6.11-rc1.fixes.3
for you to fetch changes up to ef9ca17ca458ac7253ae71b552e601e49311fc48:
hostfs: fix the host directory parse when mounting. (2024-07-27 09:56:33 +0200)
Please consider pulling these changes from the signed vfs-6.11-rc1.fixes.3 tag.
Thanks!
Christian
----------------------------------------------------------------
vfs-6.11-rc1.fixes.3
----------------------------------------------------------------
Hongbo Li (1):
hostfs: fix the host directory parse when mounting.
Seth Forshee (DigitalOcean) (1):
fs: don't allow non-init s_user_ns for filesystems without FS_USERNS_MOUNT
fs/hostfs/hostfs_kern.c | 65 +++++++++++++++++++++++++++++++++++++++++--------
fs/super.c | 11 +++++++++
2 files changed, 66 insertions(+), 10 deletions(-)
