Missing check for CAP_SYS_ADMIN before calling reconfigure_super()

From: tianyu zhou <tyjoe.linux@gmail.com>
To: Alexander Viro <viro@zeniv.linux.org.uk>, linux-fsdevel@vger.kernel.org
Subject: Missing check for CAP_SYS_ADMIN before calling reconfigure_super()
Date: Mon, 31 May 2021 23:17:34 +0800	[thread overview]
Message-ID: <CAM6ytZqioJ91r8Ax7KpNzkF0Ai9DSoU0oVt0VOT2Svv=zSGvRA@mail.gmail.com> (raw)

Hi, there exists a check for CAP_SYS_ADMIN in do_remount(),
do_umount() and vfs_fsconfig_locked() before they finally call
reconfigure_super().

---------------------
// fs/namespace.c
static int do_umount(struct mount *mnt, int flags)
{
        ...
        if (!ns_capable(sb->s_user_ns, CAP_SYS_ADMIN))
            return -EPERM;
        return do_umount_root(sb);
        ...
}

static int do_umount_root(struct super_block *sb)
{
                ...
                ret = reconfigure_super(fc);
                ...
}
---------------------

However, for function do_emergency_remount_callback(), vfs_get_super()
and reconfigure_single() in fs/super.c, there is no such check for
CAP_SYS_ADMIN before calling reconfigure_super(), neither do their
callers.

Is this a missing check bug which may break the protection for superblock?

Thanks!

Best regards,
Tianyu