From: ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org (Eric W. Biederman) To: Linux Containers <containers-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org> Cc: Miklos Szeredi <miklos-sUDqSbJrdHQHWmgEVkV9KA@public.gmane.org>, Andy Lutomirski <luto-kltTT9wpgjJwATOyAt5JVQ@public.gmane.org>, James Bottomley <James.Bottomley-d9PhHud1JfjCXq6kfMZ53/egYHeGw8Jk@public.gmane.org>, Seth Forshee <seth.forshee-Z7WLFzj8eWMS+FvcfC7Uqw@public.gmane.org>, linux-fsdevel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, Djalal Harouni <tixxdz-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org> Subject: [PATCH review 0/13] Adding a userns owner to struct super_block Date: Mon, 20 Jun 2016 12:09:43 -0500 [thread overview] Message-ID: <87fus77pns.fsf@x220.int.ebiederm.org> (raw) Available from git at: git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace.git for-testing This changeset is part of ongoing work by Seth Forshee and myself to update the VFS to allow ordinary users to mount filesystems with a backing store. The primary target is the fuse filesystem but there are other filesystems such as shiftfs that will benefit. The high level idea is to: - Assign filesystems a owning user namespace (s_user_ns). - Update permission checks (such as the one in remount) to use s_user_ns. - Interpret uids/gids from outside the kernels control as coming from inside s_user_ns. - Handle vfs uid and gid fields containing INVALID_UID and INVALID_GID indicating there is no mapping from the filesystem uids and gids into the kernel representation. This changeset addresses the first step in this process mounting filesystems, and adding a s_user_ns field to struct super_block and populating it appropriately. The goal is to keep everything that is not filesystem specific at the VFS layer and to ensure the VFS and security module issues are properly handled before updating adding support for filesystems with backing store external to the kernel such as fuse. The bulk of this changeset is spent in the weird corner cases that exist for the existing filesystems we allow mounting with just user namespace permissions. Cleaning up and reorganizing that code and handling the generic mount options nodeve, noexec and nosuid. The s_iflags flag SB_I_NODEV is added to mark filesystems that may never contain devices (which is everything except devpts that is mounted with just user namespace permissions). Eric W. Biederman (13): mnt: Account for MS_RDONLY in fs_fully_visible mnt: Refactor fs_fully_visible into mount_too_revealing ipc: Initialize ipc_namespace->user_ns early. vfs: Pass data, ns, and ns->userns to mount_ns proc: Convert proc_mount to use mount_ns. fs: Add user namespace member to struct super_block mnt: Move the FS_USERNS_MOUNT check into sget_userns kernfs: The cgroup filesystem also benefits from SB_I_NOEXEC ipc/mqueue: The mqueue filesystem should never contain executables vfs: Generalize filesystem nodev handling. mnt: Simplify mount_too_revealing userns: Remove implicit MNT_NODEV fragility. userns: Remove the now unnecessary FS_USERNS_DEV_MOUNT flag fs/block_dev.c | 2 +- fs/devpts/inode.c | 3 +- fs/kernfs/mount.c | 5 ++- fs/namei.c | 8 ++++- fs/namespace.c | 90 ++++++++++++++++++++++----------------------------- fs/nfsd/nfsctl.c | 13 +++----- fs/proc/inode.c | 8 ++++- fs/proc/internal.h | 3 +- fs/proc/root.c | 54 +++---------------------------- fs/super.c | 69 ++++++++++++++++++++++++++++++++++----- fs/sysfs/mount.c | 5 ++- include/linux/fs.h | 24 +++++++++++--- ipc/mqueue.c | 20 ++++++------ ipc/namespace.c | 5 +-- net/sunrpc/rpc_pipe.c | 8 ++--- 15 files changed, 169 insertions(+), 148 deletions(-) Eric
WARNING: multiple messages have this Message-ID (diff)
From: ebiederm@xmission.com (Eric W. Biederman) To: Linux Containers <containers@lists.linux-foundation.org> Cc: <linux-fsdevel@vger.kernel.org>, Miklos Szeredi <miklos@szeredi.hu>, James Bottomley <James.Bottomley@HansenPartnership.com>, Djalal Harouni <tixxdz@gmail.com>, Seth Forshee <seth.forshee@canonical.com>, "Serge E. Hallyn" <serge@hallyn.com>, Andy Lutomirski <luto@amacapital.net> Subject: [PATCH review 0/13] Adding a userns owner to struct super_block Date: Mon, 20 Jun 2016 12:09:43 -0500 [thread overview] Message-ID: <87fus77pns.fsf@x220.int.ebiederm.org> (raw) Available from git at: git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace.git for-testing This changeset is part of ongoing work by Seth Forshee and myself to update the VFS to allow ordinary users to mount filesystems with a backing store. The primary target is the fuse filesystem but there are other filesystems such as shiftfs that will benefit. The high level idea is to: - Assign filesystems a owning user namespace (s_user_ns). - Update permission checks (such as the one in remount) to use s_user_ns. - Interpret uids/gids from outside the kernels control as coming from inside s_user_ns. - Handle vfs uid and gid fields containing INVALID_UID and INVALID_GID indicating there is no mapping from the filesystem uids and gids into the kernel representation. This changeset addresses the first step in this process mounting filesystems, and adding a s_user_ns field to struct super_block and populating it appropriately. The goal is to keep everything that is not filesystem specific at the VFS layer and to ensure the VFS and security module issues are properly handled before updating adding support for filesystems with backing store external to the kernel such as fuse. The bulk of this changeset is spent in the weird corner cases that exist for the existing filesystems we allow mounting with just user namespace permissions. Cleaning up and reorganizing that code and handling the generic mount options nodeve, noexec and nosuid. The s_iflags flag SB_I_NODEV is added to mark filesystems that may never contain devices (which is everything except devpts that is mounted with just user namespace permissions). Eric W. Biederman (13): mnt: Account for MS_RDONLY in fs_fully_visible mnt: Refactor fs_fully_visible into mount_too_revealing ipc: Initialize ipc_namespace->user_ns early. vfs: Pass data, ns, and ns->userns to mount_ns proc: Convert proc_mount to use mount_ns. fs: Add user namespace member to struct super_block mnt: Move the FS_USERNS_MOUNT check into sget_userns kernfs: The cgroup filesystem also benefits from SB_I_NOEXEC ipc/mqueue: The mqueue filesystem should never contain executables vfs: Generalize filesystem nodev handling. mnt: Simplify mount_too_revealing userns: Remove implicit MNT_NODEV fragility. userns: Remove the now unnecessary FS_USERNS_DEV_MOUNT flag fs/block_dev.c | 2 +- fs/devpts/inode.c | 3 +- fs/kernfs/mount.c | 5 ++- fs/namei.c | 8 ++++- fs/namespace.c | 90 ++++++++++++++++++++++----------------------------- fs/nfsd/nfsctl.c | 13 +++----- fs/proc/inode.c | 8 ++++- fs/proc/internal.h | 3 +- fs/proc/root.c | 54 +++---------------------------- fs/super.c | 69 ++++++++++++++++++++++++++++++++++----- fs/sysfs/mount.c | 5 ++- include/linux/fs.h | 24 +++++++++++--- ipc/mqueue.c | 20 ++++++------ ipc/namespace.c | 5 +-- net/sunrpc/rpc_pipe.c | 8 ++--- 15 files changed, 169 insertions(+), 148 deletions(-) Eric
next reply other threads:[~2016-06-20 17:09 UTC|newest] Thread overview: 56+ messages / expand[flat|nested] mbox.gz Atom feed top 2016-06-20 17:09 Eric W. Biederman [this message] 2016-06-20 17:09 ` [PATCH review 0/13] Adding a userns owner to struct super_block Eric W. Biederman [not found] ` <87fus77pns.fsf-JOvCrm2gF+uungPnsOpG7nhyD016LWXt@public.gmane.org> 2016-06-20 17:21 ` [PATCH review 01/13] mnt: Account for MS_RDONLY in fs_fully_visible Eric W. Biederman 2016-06-20 17:21 ` Eric W. Biederman [not found] ` <20160620172130.15712-1-ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org> 2016-06-20 17:21 ` [PATCH review 02/13] mnt: Refactor fs_fully_visible into mount_too_revealing Eric W. Biederman 2016-06-20 17:21 ` Eric W. Biederman [not found] ` <20160620172130.15712-2-ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org> 2016-06-20 22:53 ` Andy Lutomirski 2016-06-20 22:53 ` Andy Lutomirski [not found] ` <CALCETrXv2aeP38AmUaRVMC+O-oeWKwDcy8fPfsOCu1f8mncZEA-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org> 2016-06-21 18:54 ` Eric W. Biederman 2016-06-21 18:54 ` Eric W. Biederman [not found] ` <874m8m4bky.fsf-JOvCrm2gF+uungPnsOpG7nhyD016LWXt@public.gmane.org> 2016-06-23 21:23 ` Djalal Harouni 2016-06-23 21:23 ` Djalal Harouni 2016-06-24 6:56 ` Serge E. Hallyn 2016-06-24 6:56 ` Serge E. Hallyn 2016-06-22 19:40 ` Seth Forshee 2016-06-22 19:40 ` Seth Forshee 2016-06-20 17:21 ` [PATCH review 03/13] ipc: Initialize ipc_namespace->user_ns early Eric W. Biederman 2016-06-20 17:21 ` Eric W. Biederman [not found] ` <20160620172130.15712-3-ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org> 2016-06-24 14:34 ` Djalal Harouni 2016-06-24 14:34 ` Djalal Harouni 2016-06-20 17:21 ` [PATCH review 04/13] vfs: Pass data, ns, and ns->userns to mount_ns Eric W. Biederman 2016-06-20 17:21 ` Eric W. Biederman 2016-06-20 17:21 ` [PATCH review 05/13] proc: Convert proc_mount to use mount_ns Eric W. Biederman 2016-06-20 17:21 ` Eric W. Biederman [not found] ` <20160620172130.15712-5-ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org> 2016-06-23 11:50 ` Djalal Harouni 2016-06-23 11:50 ` Djalal Harouni 2016-06-20 17:21 ` [PATCH review 06/13] fs: Add user namespace member to struct super_block Eric W. Biederman 2016-06-20 17:21 ` Eric W. Biederman 2016-06-20 17:21 ` [PATCH review 07/13] mnt: Move the FS_USERNS_MOUNT check into sget_userns Eric W. Biederman 2016-06-20 17:21 ` Eric W. Biederman [not found] ` <20160620172130.15712-7-ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org> 2016-06-22 19:43 ` Seth Forshee 2016-06-22 19:43 ` Seth Forshee 2016-06-20 17:21 ` [PATCH review 08/13] kernfs: The cgroup filesystem also benefits from SB_I_NOEXEC Eric W. Biederman 2016-06-20 17:21 ` Eric W. Biederman 2016-06-20 17:21 ` [PATCH review 09/13] ipc/mqueue: The mqueue filesystem should never contain executables Eric W. Biederman 2016-06-20 17:21 ` Eric W. Biederman 2016-06-20 17:21 ` [PATCH review 10/13] vfs: Generalize filesystem nodev handling Eric W. Biederman 2016-06-20 17:21 ` Eric W. Biederman [not found] ` <20160620172130.15712-10-ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org> 2016-06-20 22:57 ` Andy Lutomirski 2016-06-20 22:57 ` Andy Lutomirski [not found] ` <CALCETrUWsnRgjyRyb+_0u0PYubx9gg=hUAso=073yjJY+m205g-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org> 2016-06-21 19:09 ` Eric W. Biederman 2016-06-21 19:09 ` Eric W. Biederman 2016-06-20 17:21 ` [PATCH review 11/13] mnt: Simplify mount_too_revealing Eric W. Biederman 2016-06-20 17:21 ` Eric W. Biederman [not found] ` <20160620172130.15712-11-ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org> 2016-06-22 19:48 ` Seth Forshee 2016-06-22 19:48 ` Seth Forshee 2016-06-20 17:21 ` [PATCH review 12/13] userns: Remove implicit MNT_NODEV fragility Eric W. Biederman 2016-06-20 17:21 ` Eric W. Biederman 2016-06-22 19:49 ` Seth Forshee [not found] ` <20160620172130.15712-12-ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org> 2016-06-20 22:58 ` Andy Lutomirski 2016-06-20 22:58 ` Andy Lutomirski 2016-06-22 19:49 ` Seth Forshee 2016-06-20 17:21 ` [PATCH review 13/13] userns: Remove the now unnecessary FS_USERNS_DEV_MOUNT flag Eric W. Biederman 2016-06-20 17:21 ` Eric W. Biederman 2016-06-22 19:50 ` Seth Forshee [not found] ` <20160620172130.15712-13-ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org> 2016-06-22 19:50 ` Seth Forshee
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=87fus77pns.fsf@x220.int.ebiederm.org \ --to=ebiederm-as9lmozglivwk0htik3j/w@public.gmane.org \ --cc=James.Bottomley-d9PhHud1JfjCXq6kfMZ53/egYHeGw8Jk@public.gmane.org \ --cc=containers-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org \ --cc=linux-fsdevel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \ --cc=luto-kltTT9wpgjJwATOyAt5JVQ@public.gmane.org \ --cc=miklos-sUDqSbJrdHQHWmgEVkV9KA@public.gmane.org \ --cc=seth.forshee-Z7WLFzj8eWMS+FvcfC7Uqw@public.gmane.org \ --cc=tixxdz-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.