diff options
| author | Eric W. Biederman <ebiederm@xmission.com> | 2013-03-24 14:28:27 -0700 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2013-04-05 09:26:02 -0700 |
| commit | cfc13c72f4642f811c159cceb921df69cd158725 (patch) | |
| tree | 3aeebd2a9b1ab3ccc350a5810208779c7f8999e9 /kernel | |
| parent | 63795cc597539dff38550070dfd945dc08862eef (diff) | |
userns: Restrict when proc and sysfs can be mounted
commit 87a8ebd637dafc255070f503909a053cf0d98d3f upstream.
Only allow unprivileged mounts of proc and sysfs if they are already
mounted when the user namespace is created.
proc and sysfs are interesting because they have content that is
per namespace, and so fresh mounts are needed when new namespaces
are created while at the same time proc and sysfs have content that
is shared between every instance.
Respect the policy of who may see the shared content of proc and sysfs
by only allowing new mounts if there was an existing mount at the time
the user namespace was created.
In practice there are only two interesting cases: proc and sysfs are
mounted at their usual places, proc and sysfs are not mounted at all
(some form of mount namespace jail).
Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'kernel')
| -rw-r--r-- | kernel/user.c | 2 | ||||
| -rw-r--r-- | kernel/user_namespace.c | 2 |
2 files changed, 4 insertions, 0 deletions
diff --git a/kernel/user.c b/kernel/user.c index 33acb5e53a5..7f6ff2b81cf 100644 --- a/kernel/user.c +++ b/kernel/user.c @@ -53,6 +53,8 @@ struct user_namespace init_user_ns = { .owner = GLOBAL_ROOT_UID, .group = GLOBAL_ROOT_GID, .proc_inum = PROC_USER_INIT_INO, + .may_mount_sysfs = true, + .may_mount_proc = true, }; EXPORT_SYMBOL_GPL(init_user_ns); diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c index 1d9e40a525b..f45e12899c1 100644 --- a/kernel/user_namespace.c +++ b/kernel/user_namespace.c @@ -96,6 +96,8 @@ int create_user_ns(struct cred *new) set_cred_user_ns(new, ns); + update_mnt_policy(ns); + return 0; } |