From: Christian Brauner <brauner@kernel.org>
To: Luis Chamberlain <mcgrof@kernel.org>, Hugh Dickins <hughd@google.com>
Cc: Christian Brauner <brauner@kernel.org>,
akpm@linux-foundation.org, willy@infradead.org,
linux-mm@kvack.org, p.raghav@samsung.com, da.gomez@samsung.com,
a.manzanares@samsung.com, dave@stgolabs.net,
yosryahmed@google.com, keescook@chromium.org,
patches@lists.linux.dev, linux-kernel@vger.kernel.org
Subject: [PATCH] shmem: restrict noswap option to initial user namespace
Date: Thu, 20 Apr 2023 10:57:43 +0200 [thread overview]
Message-ID: <20230420-faxen-advokat-40abb4c1a152@brauner> (raw)
In-Reply-To: <ZD8Q2SzVr3xDmCgY@bombadil.infradead.org>
Prevent tmpfs instances mounted in an unprivileged namespaces from
evading accounting of locked memory by using the "noswap" mount option.
Cc: Luis Chamberlain <mcgrof@kernel.org>
Reported-by: Hugh Dickins <hughd@google.com>
Link: https://lore.kernel.org/lkml/79eae9fe-7818-a65c-89c6-138b55d609a@google.com
Signed-off-by: Christian Brauner <brauner@kernel.org>
---
mm/shmem.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/mm/shmem.c b/mm/shmem.c
index 787e83791eb5..21ce9b26bb4d 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -3571,6 +3571,10 @@ static int shmem_parse_one(struct fs_context *fc, struct fs_parameter *param)
ctx->seen |= SHMEM_SEEN_INUMS;
break;
case Opt_noswap:
+ if ((fc->user_ns != &init_user_ns) || !capable(CAP_SYS_ADMIN)) {
+ return invalfc(fc,
+ "Turning off swap in unprivileged tmpfs mounts unsupported");
+ }
ctx->noswap = true;
ctx->seen |= SHMEM_SEEN_NOSWAP;
break;
--
2.34.1
next prev parent reply other threads:[~2023-04-20 8:58 UTC|newest]
Thread overview: 30+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-03-09 23:05 [PATCH v2 0/6] tmpfs: add the option to disable swap Luis Chamberlain
2023-03-09 23:05 ` [PATCH v2 1/6] shmem: remove check for folio lock on writepage() Luis Chamberlain
2023-03-09 23:05 ` [PATCH v2 2/6] shmem: set shmem_writepage() variables early Luis Chamberlain
2023-03-09 23:05 ` [PATCH v2 3/6] shmem: move reclaim check early on writepages() Luis Chamberlain
2023-03-09 23:05 ` [PATCH v2 4/6] shmem: skip page split if we're not reclaiming Luis Chamberlain
2023-03-09 23:09 ` Yosry Ahmed
2023-04-18 4:41 ` Hugh Dickins
2023-04-18 21:11 ` Luis Chamberlain
2023-04-18 21:20 ` Hugh Dickins
2023-03-09 23:05 ` [PATCH v2 5/6] shmem: update documentation Luis Chamberlain
2023-04-18 5:29 ` Hugh Dickins
2023-04-18 21:20 ` Luis Chamberlain
2023-04-18 21:41 ` Hugh Dickins
2023-04-18 21:49 ` Luis Chamberlain
2023-03-09 23:05 ` [PATCH v2 6/6] shmem: add support to ignore swap Luis Chamberlain
2023-04-18 5:50 ` Hugh Dickins
2023-04-18 7:38 ` Christian Brauner
2023-04-18 21:51 ` Luis Chamberlain
2023-04-20 8:57 ` Christian Brauner [this message]
2023-04-20 19:18 ` [PATCH] shmem: restrict noswap option to initial user namespace Luis Chamberlain
2023-04-18 21:22 ` [PATCH v2 6/6] shmem: add support to ignore swap Luis Chamberlain
2023-04-18 21:30 ` Randy Dunlap
2023-03-14 1:21 ` [PATCH v2 0/6] tmpfs: add the option to disable swap Davidlohr Bueso
2023-03-14 2:46 ` haoxin
2023-03-19 20:32 ` Luis Chamberlain
2023-03-20 11:14 ` haoxin
2023-03-20 21:36 ` Luis Chamberlain
2023-03-21 11:37 ` haoxin
2023-04-18 4:31 ` Hugh Dickins
2023-04-18 20:55 ` Luis Chamberlain
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230420-faxen-advokat-40abb4c1a152@brauner \
--to=brauner@kernel.org \
--cc=a.manzanares@samsung.com \
--cc=akpm@linux-foundation.org \
--cc=da.gomez@samsung.com \
--cc=dave@stgolabs.net \
--cc=hughd@google.com \
--cc=keescook@chromium.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=mcgrof@kernel.org \
--cc=p.raghav@samsung.com \
--cc=patches@lists.linux.dev \
--cc=willy@infradead.org \
--cc=yosryahmed@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).