mirrors
/
linux-stable
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
1
0
Fork 0
Code Issues Releases Wiki Activity

consolidate the capability checks in sget_{fc,userns}() 

... into a common helper - mount_capable(type, userns)

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
This commit is contained in:
Al Viro 2019-05-12 15:42:48 -04:00
parent feb8ae43a7
commit 0ce0cf12fc
1 changed files with 14 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
fs/super.c
View File

@ -476,6 +476,14 @@ void generic_shutdown_super(struct super_block *sb)
EXPORT_SYMBOL(generic_shutdown_super);
bool mount_capable(struct file_system_type *type, struct user_namespace *userns)
{
if (!(type->fs_flags & FS_USERNS_MOUNT))
return capable(CAP_SYS_ADMIN);
else
return ns_capable(userns, CAP_SYS_ADMIN);
}
/**
* sget_fc - Find or create a superblock
* @fc: Filesystem context.
@ -505,16 +513,8 @@ struct super_block *sget_fc(struct fs_context *fc,
if (!(fc->sb_flags & SB_KERNMOUNT) &&
fc->purpose != FS_CONTEXT_FOR_SUBMOUNT) {
/* Don't allow mounting unless the caller has CAP_SYS_ADMIN
* over the namespace.
*/
if (!(fc->fs_type->fs_flags & FS_USERNS_MOUNT)) {
if (!capable(CAP_SYS_ADMIN))
return ERR_PTR(-EPERM);
} else {
if (!ns_capable(fc->user_ns, CAP_SYS_ADMIN))
return ERR_PTR(-EPERM);
}
if (!mount_capable(fc->fs_type, user_ns))
return ERR_PTR(-EPERM);
}
retry:
@ -583,14 +583,10 @@ struct super_block *sget_userns(struct file_system_type *type,
struct super_block *old;
int err;
/* Ensure the requestor has permissions over the target filesystem */
if (!(flags & (SB_KERNMOUNT|SB_SUBMOUNT)) && !ns_capable(user_ns, CAP_SYS_ADMIN))
return ERR_PTR(-EPERM);
if (!(flags & (SB_KERNMOUNT|SB_SUBMOUNT)) &&
!(type->fs_flags & FS_USERNS_MOUNT) &&
!capable(CAP_SYS_ADMIN))
return ERR_PTR(-EPERM);
if (!(flags & (SB_KERNMOUNT|SB_SUBMOUNT))) {
if (!mount_capable(type, user_ns))
return ERR_PTR(-EPERM);
}
retry:
spin_lock(&sb_lock);
if (test) {