vfs: Only support slave subtrees across different user namespaces

Sharing mount subtress with mount namespaces created by unprivileged
users allows unprivileged mounts created by unprivileged users to
propagate to mount namespaces controlled by privileged users.

Prevent nasty consequences by changing shared subtrees to slave
subtress when an unprivileged users creates a new mount namespace.

Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>

1 files changed, 8 insertions, 3 deletions

diff --git a/fs/namespace.c b/fs/namespace.c
index 207c7ba84ad3..4dfcaf05d17c 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -786,7 +786,7 @@ static struct mount *clone_mnt(struct mount *old, struct dentry *root,
         if (!mnt)
                 return ERR_PTR(-ENOMEM);
 
-        if (flag & (CL_SLAVE | CL_PRIVATE))
+        if (flag & (CL_SLAVE | CL_PRIVATE | CL_SHARED_TO_SLAVE))
                 mnt->mnt_group_id = 0; /* not a peer of original */
         else
                 mnt->mnt_group_id = old->mnt_group_id;
@@ -807,7 +807,8 @@ static struct mount *clone_mnt(struct mount *old, struct dentry *root,
         list_add_tail(&mnt->mnt_instance, &sb->s_mounts);
         br_write_unlock(&vfsmount_lock);
 
-        if (flag & CL_SLAVE) {
+        if ((flag & CL_SLAVE) ||
+            ((flag & CL_SHARED_TO_SLAVE) && IS_MNT_SHARED(old))) {
                 list_add(&mnt->mnt_slave, &old->mnt_slave_list);
                 mnt->mnt_master = old;
                 CLEAR_MNT_SHARED(mnt);
@@ -2331,6 +2332,7 @@ static struct mnt_namespace *dup_mnt_ns(struct mnt_namespace *mnt_ns,
         struct mount *p, *q;
         struct mount *old = mnt_ns->root;
         struct mount *new;
+        int copy_flags;
 
         new_ns = alloc_mnt_ns(user_ns);
         if (IS_ERR(new_ns))
@@ -2338,7 +2340,10 @@ static struct mnt_namespace *dup_mnt_ns(struct mnt_namespace *mnt_ns,
 
         down_write(&namespace_sem);
         /* First pass: copy the tree topology */
-        new = copy_tree(old, old->mnt.mnt_root, CL_COPY_ALL | CL_EXPIRE);
+        copy_flags = CL_COPY_ALL | CL_EXPIRE;
+        if (user_ns != mnt_ns->user_ns)
+                copy_flags |= CL_SHARED_TO_SLAVE;
+        new = copy_tree(old, old->mnt.mnt_root, copy_flags);
         if (IS_ERR(new)) {
                 up_write(&namespace_sem);
                 free_mnt_ns(new_ns);