[PATCH] Fix mounting with MS_I_VERSION

[PATCH] Fix mounting with MS_I_VERSION

[Matthew Garrett]

commit e462ec50cb5fa ("VFS: Differentiate mount flags (MS_*) from
internal superblock flags") reworked the flags that are passed through
do mount, and in the process dropped MS_I_VERSION. Confusingly, things
continue working if the i_version mount option is used because that's
directly passed to ext4 which interprets it, while iversion is turned
into MS_I_VERSION and dropped on the floor. This breaks IMA and EVM and
my heart.

Signed-off-by: Matthew Garrett <mjg59@google.com>
Cc: David Howells <dhowells@redhat.com>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Cc: stable@vger.kernel.org
---
 fs/namespace.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/namespace.c b/fs/namespace.c
index 3b601f115b6c..d18deb4c410b 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -2825,7 +2825,8 @@ long do_mount(const char *dev_name, const char __user *dir_name,
 			    SB_MANDLOCK |
 			    SB_DIRSYNC |
 			    SB_SILENT |
-			    SB_POSIXACL);
+			    SB_POSIXACL |
+			    SB_I_VERSION);
 
 	if (flags & MS_REMOUNT)
 		retval = do_remount(&path, flags, sb_flags, mnt_flags,
-- 
2.15.0.rc1.287.g2b38de12cc-goog

Re: [PATCH] Fix mounting with MS_I_VERSION

[Matthew Garrett]

On Tue, Oct 17, 2017 at 7:43 PM, Matthew Garrett <mjg59@google.com> wrote:
> Cc: stable@vger.kernel.org

Oh, on closer examination this didn't land until 4.14-rc1, so no need
for stable.

Re: [PATCH] Fix mounting with MS_I_VERSION

[David Howells]

Matthew Garrett <mjg59@google.com> wrote:

> commit e462ec50cb5fa ("VFS: Differentiate mount flags (MS_*) from
> internal superblock flags") reworked the flags that are passed through
> do mount, and in the process dropped MS_I_VERSION. Confusingly, things
> continue working if the i_version mount option is used because that's
> directly passed to ext4 which interprets it, while iversion is turned
> into MS_I_VERSION and dropped on the floor. This breaks IMA and EVM and
> my heart.

This patch isn't sufficient.  It also needs to change the filesystems' use of
it to be SB_I_VERSION.

David