Daniel Borkmann 612bacad78 bpf, inode: disallow userns mounts ... Follow-up to commit e27f4a942a ("bpf: Use mount_nodev not mount_ns to mount the bpf filesystem"), which removes the FS_USERNS_MOUNT flag. The original idea was to have a per mountns instance instead of a single global fs instance, but that didn't work out and we had to switch to mount_nodev() model. The intent of that middle ground was that we avoid users who don't play nice to create endless instances of bpf fs which are difficult to control and discover from an admin point of view, but at the same time it would have allowed us to be more flexible with regard to namespaces. Therefore, since we now did the switch to mount_nodev() as a fix where individual instances are created, we also need to remove userns mount flag along with it to avoid running into mentioned situation. I don't expect any breakage at this early point in time with removing the flag and we can revisit this later should the requirement for this come up with future users. This and commit e27f4a942a have been split to facilitate tracking should any of them run into the unlikely case of causing a regression. Fixes: b2197755b2 ("bpf: add support for persistent maps/progs") Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org> Acked-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net>		2016-05-23 15:08:26 -07:00
..
bpf	bpf, inode: disallow userns mounts	2016-05-23 15:08:26 -07:00
configs
debug	mm/init: Add 'rodata=off' boot cmdline parameter to disable read-only kernel mappings	2016-02-22 08:51:37 +01:00
events	x86: remove more uaccess_32.h complexity	2016-05-22 17:21:27 -07:00
gcov	gcov: use within_module() helper.	2015-12-04 22:46:25 +01:00
irq	radix-tree: introduce radix_tree_empty	2016-05-20 17:58:30 -07:00
livepatch	Merge branches 'for-4.7/core', 'for-4.7/livepatching-doc' and 'for-4.7/livepatching-ppc64' into for-linus	2016-05-17 12:06:35 +02:00
locking	Merge branch 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2016-05-16 14:47:16 -07:00
power	PM / Hibernate: Call flush_icache_range() on pages restored in-place	2016-04-28 13:35:48 +01:00
printk	printk/nmi: flush NMI messages on the system panic	2016-05-20 17:58:30 -07:00
rcu	debugobjects: insulate non-fixup logic related to static obj from fixup callbacks	2016-05-19 19:12:14 -07:00
sched	Power management material for v4.7-rc1	2016-05-16 19:17:22 -07:00
time	debugobjects: insulate non-fixup logic related to static obj from fixup callbacks	2016-05-19 19:12:14 -07:00
trace	Three more changes.	2016-05-22 19:40:39 -07:00
.gitignore	certs: add .gitignore to stop git nagging about x509_certificate_list	2015-10-21 15:18:35 +01:00
acct.c
async.c	async: export current_is_async()	2015-11-19 17:51:48 +01:00
audit.c	Merge branch 'stable-4.7' of git://git.infradead.org/users/pcmoore/audit	2016-05-18 18:46:55 -07:00
audit.h	security: Make inode argument of inode_getsecid non-const	2015-12-24 11:09:39 -05:00
audit_fsnotify.c	wrappers for ->i_mutex access	2016-01-22 18:04:28 -05:00
audit_tree.c	audit: cleanup prune_tree_thread	2016-04-04 09:46:47 -04:00
audit_watch.c	don't bother with ->d_inode->i_sb - it's always equal to ->d_sb	2016-04-10 17:11:51 -04:00
auditfilter.c	audit: Fix typo in comment	2016-02-08 11:25:39 -05:00
auditsc.c	Merge branch 'stable-4.7' of git://git.infradead.org/users/pcmoore/audit	2016-05-18 18:46:55 -07:00
backtracetest.c
bounds.c
capability.c
cgroup.c	cgroup: fix compile warning	2016-05-12 11:05:27 -04:00
cgroup_freezer.c	cgroup: kill cgrp_ss_priv[CGROUP_CANFORK_COUNT] and friends	2015-12-03 10:24:08 -05:00
cgroup_pids.c	cgroup_pids: fix a typo.	2015-12-14 14:54:37 -05:00
compat.c
configs.c
context_tracking.c	context_tracking: Switch to new static_branch API	2015-11-24 09:56:43 +01:00
cpu.c	sched/hotplug: Make activate() the last hotplug step	2016-05-06 14:58:25 +02:00
cpu_pm.c	kernel/cpu_pm: fix cpu_cluster_pm_exit comment	2015-09-03 02:42:20 +02:00
cpuset.c	cpuset: use static key better and convert to new API	2016-05-19 19:12:14 -07:00
crash_dump.c
cred.c	kmemcg: account certain kmem allocations to memcg	2016-01-14 16:00:49 -08:00
delayacct.c	kmemcg: account certain kmem allocations to memcg	2016-01-14 16:00:49 -08:00
dma.c
elfcore.c
exec_domain.c
exit.c	exit_thread: accept a task parameter to be exited	2016-05-20 17:58:30 -07:00
extable.c	kernel/extable.c: remove duplicated include	2015-09-10 13:29:01 -07:00
fork.c	fork: free thread in copy_process on failure	2016-05-20 17:58:30 -07:00
freezer.c
futex.c	x86: remove more uaccess_32.h complexity	2016-05-22 17:21:27 -07:00
futex_compat.c	ptrace: use fsuid, fsgid, effective creds for fs access checks	2016-01-20 17:09:18 -08:00
groups.c
hung_task.c	kernel/hung_task.c: use timeout diff when timeout is updated	2016-03-22 15:36:02 -07:00
irq_work.c	treewide: Remove old email address	2015-11-23 09:44:58 +01:00
jump_label.c	treewide: Remove old email address	2015-11-23 09:44:58 +01:00
kallsyms.c	kallsyms: add support for relative offsets in kallsyms address table	2016-03-15 16:55:16 -07:00
kcmp.c	ptrace: use fsuid, fsgid, effective creds for fs access checks	2016-01-20 17:09:18 -08:00
Kconfig.freezer
Kconfig.hz
Kconfig.locks
Kconfig.preempt
kcov.c	kcov: don't profile branches in kcov	2016-04-28 19:34:04 -07:00
kexec.c	kexec: set KEXEC_TYPE_CRASH before sanity_check_segment_list()	2016-01-20 17:09:18 -08:00
kexec_core.c	printk/nmi: flush NMI messages on the system panic	2016-05-20 17:58:30 -07:00
kexec_file.c	Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security	2016-03-17 11:33:45 -07:00
kexec_internal.h	kexec: move some memembers and definitions within the scope of CONFIG_KEXEC_FILE	2016-01-20 17:09:18 -08:00
kmod.c	kmod: don't run async usermode helper as a child of kworker thread	2015-10-23 17:55:10 +09:00
kprobes.c
ksysfs.c	rcu: Remove TINY_RCU bloat from pointless boot parameters	2015-12-07 16:59:37 -08:00
kthread.c	kernel/kthread.c:kthread_create_on_node(): clarify documentation	2015-09-04 16:54:41 -07:00
latencytop.c	sched/debug: Make schedstats a runtime tunable that is disabled by default	2016-02-09 11:54:23 +01:00
Makefile	kernel: add kcov code coverage	2016-03-22 15:36:02 -07:00
membarrier.c	sys_membarrier(): system-wide memory barrier (generic, x86)	2015-09-11 15:21:34 -07:00
memremap.c	memremap: add arch specific hook for MEMREMAP_WB mappings	2016-04-04 10:26:41 +02:00
module-internal.h
module.c	module: preserve Elf information for livepatch modules	2016-04-01 15:00:10 +02:00
module_signing.c	KEYS: Move the point of trust determination to __key_link()	2016-04-11 22:43:43 +01:00
notifier.c	Merge branch 'x86-asm-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2015-09-01 08:40:25 -07:00
nsproxy.c	cgroup: introduce cgroup namespaces	2016-02-16 13:04:58 -05:00
padata.c	kernel/padata.c: hide unused functions	2016-05-19 19:12:14 -07:00
panic.c	printk/nmi: flush NMI messages on the system panic	2016-05-20 17:58:30 -07:00
params.c	Nothing exciting, minor tweaks and cleanups.	2015-11-09 15:53:39 -08:00
pid.c	Merge branch 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2016-01-31 15:44:04 -08:00
pid_namespace.c
profile.c	profile: hide unused functions when !CONFIG_PROC_FS	2016-03-22 15:36:02 -07:00
ptrace.c	ptrace: change __ptrace_unlink() to clear ->ptrace under ->siglock	2016-03-22 15:36:02 -07:00
range.c
reboot.c	kexec: split kexec_load syscall from kexec core code	2015-09-10 13:29:01 -07:00
relay.c	wrappers for ->i_mutex access	2016-01-22 18:04:28 -05:00
resource.c	/proc/iomem: only expose physical resource addresses to privileged users	2016-04-14 12:56:09 -07:00
seccomp.c	Merge branch 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus	2016-05-19 10:02:26 -07:00
signal.c	signals/sigaltstack: Report current flag bits in sigaltstack()	2016-05-04 08:34:14 +02:00
smp.c	Merge branch 'smp-hotplug-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2016-03-15 13:50:29 -07:00
smpboot.c	cpu/hotplug: Unpark smpboot threads from the state machine	2016-03-01 20:36:56 +01:00
smpboot.h	cpu/hotplug: Create hotplug threads	2016-03-01 20:36:56 +01:00
softirq.c	arch, ftrace: for KASAN put hard/soft IRQ entries into separate sections	2016-03-25 16:37:42 -07:00
stacktrace.c
stop_machine.c	kernel/stop_machine.c: remove CONFIG_SMP dependencies	2016-01-16 11:17:24 -08:00
sys.c	timer: convert timer_slack_ns from unsigned long to u64	2016-03-17 15:09:34 -07:00
sys_ni.c	vfs: add copy_file_range syscall and vfs helper	2015-12-01 14:00:53 -05:00
sysctl.c	mm: /proc/sys/vm/stat_refresh to force vmstat update	2016-05-19 19:12:14 -07:00
sysctl_binary.c	kernel/sysctl_binary.c: use generic UUID library	2016-05-20 17:58:30 -07:00
task_work.c	task_work: remove fifo ordering guarantee	2015-09-05 13:46:58 -07:00
taskstats.c	taskstats: use the libnl API to align nlattr on 64-bit	2016-04-23 20:13:25 -04:00
test_kprobes.c
torture.c	rcutorture: Dump trace buffer upon shutdown	2016-04-21 13:47:04 -07:00
tracepoint.c	kernel/...: convert pr_warning to pr_warn	2016-03-22 15:36:02 -07:00
tsacct.c	time, acct: Drop irq save & restore from __acct_update_integrals()	2016-02-29 09:53:09 +01:00
uid16.c
up.c
user-return-notifier.c
user.c
user_namespace.c	kernel/*: switch to memdup_user_nul()	2016-01-04 10:27:55 -05:00
utsname.c
utsname_sysctl.c
watchdog.c	watchdog: don't run proc_watchdog_update if new value is same as old	2016-03-17 15:09:34 -07:00
workqueue.c	debugobjects: insulate non-fixup logic related to static obj from fixup callbacks	2016-05-19 19:12:14 -07:00
workqueue_internal.h	sched/core: Get rid of 'cpu' argument in wq_worker_sleeping()	2016-03-02 10:28:47 -05:00