vfs: syscall: Add move_mount(2) to move mounts around

Add a move_mount() system call that will move a mount from one place to
another and, in the next commit, allow to attach an unattached mount tree.

The new system call looks like the following:

	int move_mount(int from_dfd, const char *from_path,
		       int to_dfd, const char *to_path,
		       unsigned int flags);

Signed-off-by: David Howells <dhowells@redhat.com>
cc: linux-api@vger.kernel.org
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

3 files changed, 16 insertions, 0 deletions

diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h
index a9b8ff578b6b..cb33f81cf5a1 100644
--- a/include/linux/lsm_hooks.h
+++ b/include/linux/lsm_hooks.h
@@ -160,6 +160,10 @@
  *      Parse a string of security data filling in the opts structure
  *      @options string containing all mount options known by the LSM
  *      @opts binary data structure usable by the LSM
+ * @move_mount:
+ *      Check permission before a mount is moved.
+ *      @from_path indicates the mount that is going to be moved.
+ *      @to_path indicates the mountpoint that will be mounted upon.
  * @dentry_init_security:
  *      Compute a context for a dentry as the inode is not yet available
  *      since NFSv4 has no label backed by an EA anyway.
@@ -1501,6 +1505,7 @@ union security_list_options {
                                         unsigned long *set_kern_flags);
         int (*sb_add_mnt_opt)(const char *option, const char *val, int len,
                               void **mnt_opts);
+        int (*move_mount)(const struct path *from_path, const struct path *to_path);
         int (*dentry_init_security)(struct dentry *dentry, int mode,
                                         const struct qstr *name, void **ctx,
                                         u32 *ctxlen);
@@ -1835,6 +1840,7 @@ struct security_hook_heads {
         struct hlist_head sb_set_mnt_opts;
         struct hlist_head sb_clone_mnt_opts;
         struct hlist_head sb_add_mnt_opt;
+        struct hlist_head move_mount;
         struct hlist_head dentry_init_security;
         struct hlist_head dentry_create_files_as;
 #ifdef CONFIG_SECURITY_PATH
diff --git a/include/linux/security.h b/include/linux/security.h
index 49f2685324b0..1f2e06afc28f 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -250,6 +250,7 @@ int security_sb_clone_mnt_opts(const struct super_block *oldsb,
                                 unsigned long *set_kern_flags);
 int security_add_mnt_opt(const char *option, const char *val,
                                 int len, void **mnt_opts);
+int security_move_mount(const struct path *from_path, const struct path *to_path);
 int security_dentry_init_security(struct dentry *dentry, int mode,
                                         const struct qstr *name, void **ctx,
                                         u32 *ctxlen);
@@ -611,6 +612,12 @@ static inline int security_add_mnt_opt(const char *option, const char *val,
         return 0;
 }
 
+static inline int security_move_mount(const struct path *from_path,
+                                      const struct path *to_path)
+{
+        return 0;
+}
+
 static inline int security_inode_alloc(struct inode *inode)
 {
         return 0;
diff --git a/include/linux/syscalls.h b/include/linux/syscalls.h
index 6c29d586e66b..84347fc0a1a7 100644
--- a/include/linux/syscalls.h
+++ b/include/linux/syscalls.h
@@ -986,6 +986,9 @@ asmlinkage long sys_statx(int dfd, const char __user *path, unsigned flags,
 asmlinkage long sys_rseq(struct rseq __user *rseq, uint32_t rseq_len,
                          int flags, uint32_t sig);
 asmlinkage long sys_open_tree(int dfd, const char __user *path, unsigned flags);
+asmlinkage long sys_move_mount(int from_dfd, const char __user *from_path,
+                               int to_dfd, const char __user *to_path,
+                               unsigned int ms_flags);
 asmlinkage long sys_pidfd_send_signal(int pidfd, int sig,
                                        siginfo_t __user *info,
                                        unsigned int flags);