From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.8 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0AB8CC43613 for ; Mon, 24 Jun 2019 10:22:49 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id D3B55216B7 for ; Mon, 24 Jun 2019 10:22:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1561371768; bh=WfFaIxEMITIz5eai5eS+2Gi1SVJf03WbAAv9BsFwjHw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=mHqKsGM6c19uNuxxOCOx8QJODNM1I/zTCvPc078EFEAWzJ1sz6upCHAx7m2xTjypI NyfiUWhTqUB8g7WcBMS00rqroRK8KtdnsV9rTnYwaMz1Jvy0haxgb+XH4cxW28W5TT 6v7/2psaqPc/4a1dIcUM+iHtXcD8lq+OtR2Tzmyo= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731160AbfFXKWr (ORCPT ); Mon, 24 Jun 2019 06:22:47 -0400 Received: from mail.kernel.org ([198.145.29.99]:58084 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730777AbfFXKWO (ORCPT ); Mon, 24 Jun 2019 06:22:14 -0400 Received: from localhost (f4.8f.5177.ip4.static.sl-reverse.com [119.81.143.244]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id A4ACB2133F; Mon, 24 Jun 2019 10:22:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1561371734; bh=WfFaIxEMITIz5eai5eS+2Gi1SVJf03WbAAv9BsFwjHw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=vH9Y0MdaWl1IedjW/+0HnDBQdh3qfc5/evuaBgPRfu5lPyph7jkDaLHL28Z4mi/Ku AlhVfmulkfgDKewsnLKEeW7RKwdW81Dvw2Tzul+gKzCy5rpz9yqcOj4EG1AkVngmgZ I7NHL7fJ76GCyYIW4F5BSSyZTsnC+jbJ7vzis2Xo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Linus Torvalds , Al Viro , Christian Brauner , "Eric W. Biederman" Subject: [PATCH 5.1 114/121] fs/namespace: fix unprivileged mount propagation Date: Mon, 24 Jun 2019 17:57:26 +0800 Message-Id: <20190624092326.475497997@linuxfoundation.org> X-Mailer: git-send-email 2.22.0 In-Reply-To: <20190624092320.652599624@linuxfoundation.org> References: <20190624092320.652599624@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Christian Brauner commit d728cf79164bb38e9628d15276e636539f857ef1 upstream. When propagating mounts across mount namespaces owned by different user namespaces it is not possible anymore to move or umount the mount in the less privileged mount namespace. Here is a reproducer: sudo mount -t tmpfs tmpfs /mnt sudo --make-rshared /mnt # create unprivileged user + mount namespace and preserve propagation unshare -U -m --map-root --propagation=unchanged # now change back to the original mount namespace in another terminal: sudo mkdir /mnt/aaa sudo mount -t tmpfs tmpfs /mnt/aaa # now in the unprivileged user + mount namespace mount --move /mnt/aaa /opt Unfortunately, this is a pretty big deal for userspace since this is e.g. used to inject mounts into running unprivileged containers. So this regression really needs to go away rather quickly. The problem is that a recent change falsely locked the root of the newly added mounts by setting MNT_LOCKED. Fix this by only locking the mounts on copy_mnt_ns() and not when adding a new mount. Fixes: 3bd045cc9c4b ("separate copying and locking mount tree on cross-userns copies") Cc: Linus Torvalds Cc: Al Viro Cc: Tested-by: Christian Brauner Acked-by: Christian Brauner Signed-off-by: "Eric W. Biederman" Signed-off-by: Christian Brauner Signed-off-by: Al Viro Signed-off-by: Greg Kroah-Hartman --- fs/namespace.c | 1 + fs/pnode.c | 1 - 2 files changed, 1 insertion(+), 1 deletion(-) --- a/fs/namespace.c +++ b/fs/namespace.c @@ -2079,6 +2079,7 @@ static int attach_recursive_mnt(struct m /* Notice when we are propagating across user namespaces */ if (child->mnt_parent->mnt_ns->user_ns != user_ns) lock_mnt_tree(child); + child->mnt.mnt_flags &= ~MNT_LOCKED; commit_tree(child); } put_mountpoint(smp); --- a/fs/pnode.c +++ b/fs/pnode.c @@ -262,7 +262,6 @@ static int propagate_one(struct mount *m child = copy_tree(last_source, last_source->mnt.mnt_root, type); if (IS_ERR(child)) return PTR_ERR(child); - child->mnt.mnt_flags &= ~MNT_LOCKED; mnt_set_mountpoint(m, mp, child); last_dest = m; last_source = child;