aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorEric W. Biederman <ebiederm@xmission.com>2016-06-10 14:03:05 -0400
committerEric W. Biederman <ebiederm@xmission.com>2016-06-23 16:41:56 -0400
commit29a517c232d21a717aecea29838aeb07131f6196 (patch)
tree6e49472e6f3efaf11831a4deb82d4e7656702553
parenta001e74cef34d95ede6535ef521011c612657a3a (diff)
kernfs: The cgroup filesystem also benefits from SB_I_NOEXEC
The cgroup filesystem is in the same boat as sysfs. No one ever permits executables of any kind on the cgroup filesystem, and there is no reasonable future case to support executables in the future. Therefore move the setting of SB_I_NOEXEC which makes the code proof against future mistakes of accidentally creating executables from sysfs to kernfs itself. Making the code simpler and covering the sysfs, cgroup, and cgroup2 filesystems. Acked-by: Seth Forshee <seth.forshee@canonical.com> Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
-rw-r--r--fs/kernfs/mount.c2
-rw-r--r--fs/sysfs/mount.c3
2 files changed, 3 insertions, 2 deletions
diff --git a/fs/kernfs/mount.c b/fs/kernfs/mount.c
index d90d574c15a2..1443df670260 100644
--- a/fs/kernfs/mount.c
+++ b/fs/kernfs/mount.c
@@ -152,6 +152,8 @@ static int kernfs_fill_super(struct super_block *sb, unsigned long magic)
152 struct dentry *root; 152 struct dentry *root;
153 153
154 info->sb = sb; 154 info->sb = sb;
155 /* Userspace would break if executables appear on sysfs */
156 sb->s_iflags |= SB_I_NOEXEC;
155 sb->s_blocksize = PAGE_SIZE; 157 sb->s_blocksize = PAGE_SIZE;
156 sb->s_blocksize_bits = PAGE_SHIFT; 158 sb->s_blocksize_bits = PAGE_SHIFT;
157 sb->s_magic = magic; 159 sb->s_magic = magic;
diff --git a/fs/sysfs/mount.c b/fs/sysfs/mount.c
index f31e36994dfb..20b8f82e115b 100644
--- a/fs/sysfs/mount.c
+++ b/fs/sysfs/mount.c
@@ -41,8 +41,7 @@ static struct dentry *sysfs_mount(struct file_system_type *fs_type,
41 if (IS_ERR(root) || !new_sb) 41 if (IS_ERR(root) || !new_sb)
42 kobj_ns_drop(KOBJ_NS_TYPE_NET, ns); 42 kobj_ns_drop(KOBJ_NS_TYPE_NET, ns);
43 else if (new_sb) 43 else if (new_sb)
44 /* Userspace would break if executables appear on sysfs */ 44 root->d_sb->s_iflags |= SB_I_USERNS_VISIBLE;
45 root->d_sb->s_iflags |= SB_I_USERNS_VISIBLE | SB_I_NOEXEC;
46 45
47 return root; 46 return root;
48} 47}