The patch titled
user ns: hook permission
has been removed from the -mm tree. Its filename was
user-ns-hook-permission.patch
This patch was dropped because an updated version will be merged
------------------------------------------------------
Subject: user ns: hook permission
From: "Serge E. Hallyn" <serue@xxxxxxxxxx>
Hook permission to check vfsmnt->user_ns against current.
Signed-off-by: Serge E. Hallyn <serue@xxxxxxxxxx>
Cc: Herbert Poetzl <herbert@xxxxxxxxxxxx>
Cc: Kirill Korotaev <dev@xxxxx>
Cc: "Eric W. Biederman" <ebiederm@xxxxxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxx>
---
fs/namei.c | 4 ++++
1 files changed, 4 insertions(+)
diff -puN fs/namei.c~user-ns-hook-permission fs/namei.c
--- a/fs/namei.c~user-ns-hook-permission
+++ a/fs/namei.c
@@ -246,6 +246,8 @@ int permission(struct inode *inode, int
return -EACCES;
}
+ if (nd && !task_mnt_same_uidns(current, nd->mnt))
+ return -EACCES;
/*
* MAY_EXEC on regular files requires special handling: We override
@@ -433,6 +435,8 @@ static int exec_permission_lite(struct i
{
umode_t mode = inode->i_mode;
+ if (!task_mnt_same_uidns(current, nd->mnt))
+ return -EACCES;
if (inode->i_op && inode->i_op->permission)
return -EAGAIN;
_
Patches currently in -mm which might be from serue@xxxxxxxxxx are
implement-file-posix-capabilities.patch
file-capabilities-dont-do-file-caps-if-mnt_nosuid.patch
file-capabilities-honor-secure_noroot.patch
user-ns-hook-permission.patch
user-ns-prepare-copy_tree-copy_mnt-and-their-callers-to-handle-errs.patch
user-ns-implement-shared-mounts.patch
user_ns-handle-file-sigio.patch
user-ns-implement-user-ns-unshare.patch
rename-attach_pid-to-find_attach_pid.patch
attach_pid-with-struct-pid-parameter.patch
remove-find_attach_pid.patch
statically-initialize-struct-pid-for-swapper.patch
explicitly-set-pgid-sid-of-init.patch
uts-namespace-remove-config_uts_ns.patch
integrity-service-api-and-dummy-provider-fix.patch
sysctl-move-utsname-sysctls-to-their-own-file.patch
sysctl-move-sysv-ipc-sysctls-to-their-own-file.patch
-
To unsubscribe from this list: send the line "unsubscribe mm-commits" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
