Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace

Pull namespace updates from Eric Biederman:
 "This is a bunch of small changes built against 3.16-rc6.  The most
  significant change for users is the first patch which makes setns
  drmatically faster by removing unneded rcu handling.

  The next chunk of changes are so that "mount -o remount,.." will not
  allow the user namespace root to drop flags on a mount set by the
  system wide root.  Aks this forces read-only mounts to stay read-only,
  no-dev mounts to stay no-dev, no-suid mounts to stay no-suid, no-exec
  mounts to stay no exec and it prevents unprivileged users from messing
  with a mounts atime settings.  I have included my test case as the
  last patch in this series so people performing backports can verify
  this change works correctly.

  The next change fixes a bug in NFS that was discovered while auditing
  nsproxy users for the first optimization.  Today you can oops the
  kernel by reading /proc/fs/nfsfs/{servers,volumes} if you are clever
  with pid namespaces.  I rebased and fixed the build of the
  !CONFIG_NFS_FS case yesterday when a build bot caught my typo.  Given
  that no one to my knowledge bases anything on my tree fixing the typo
  in place seems more responsible that requiring a typo-fix to be
  backported as well.

  The last change is a small semantic cleanup introducing
  /proc/thread-self and pointing /proc/mounts and /proc/net at it.  This
  prevents several kinds of problemantic corner cases.  It is a
  user-visible change so it has a minute chance of causing regressions
  so the change to /proc/mounts and /proc/net are individual one line
  commits that can be trivially reverted.  Unfortunately I lost and
  could not find the email of the original reporter so he is not
  credited.  From at least one perspective this change to /proc/net is a
  refgression fix to allow pthread /proc/net uses that were broken by
  the introduction of the network namespace"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace:
  proc: Point /proc/mounts at /proc/thread-self/mounts instead of /proc/self/mounts
  proc: Point /proc/net at /proc/thread-self/net instead of /proc/self/net
  proc: Implement /proc/thread-self to point at the directory of the current thread
  proc: Have net show up under /proc/<tgid>/task/<tid>
  NFS: Fix /proc/fs/nfsfs/servers and /proc/fs/nfsfs/volumes
  mnt: Add tests for unprivileged remount cases that have found to be faulty
  mnt: Change the default remount atime from relatime to the existing value
  mnt: Correct permission checks in do_remount
  mnt: Move the test for MNT_LOCK_READONLY from change_mount_flags into do_remount
  mnt: Only change user settable mount flags in remount
  namespaces: Use task_lock and not rcu to protect nsproxy

3 files changed, 260 insertions, 0 deletions

diff --git a/tools/testing/selftests/Makefile b/tools/testing/selftests/Makefile
index 6fd2a4402069..36ff2e4c7b6f 100644
--- a/tools/testing/selftests/Makefile
+++ b/tools/testing/selftests/Makefile
@@ -5,6 +5,7 @@ TARGETS += kcmp
 TARGETS += memfd
 TARGETS += memory-hotplug
 TARGETS += mqueue
+TARGETS += mount
 TARGETS += net
 TARGETS += ptrace
 TARGETS += timers
diff --git a/tools/testing/selftests/mount/Makefile b/tools/testing/selftests/mount/Makefile
new file mode 100644
index 000000000000..337d853c2b72
--- /dev/null
+++ b/tools/testing/selftests/mount/Makefile
@@ -0,0 +1,17 @@
+# Makefile for mount selftests.
+
+all: unprivileged-remount-test
+
+unprivileged-remount-test: unprivileged-remount-test.c
+        gcc -Wall -O2 unprivileged-remount-test.c -o unprivileged-remount-test
+
+# Allow specific tests to be selected.
+test_unprivileged_remount: unprivileged-remount-test
+        @if [ -f /proc/self/uid_map ] ; then ./unprivileged-remount-test ; fi
+
+run_tests: all test_unprivileged_remount
+
+clean:
+        rm -f unprivileged-remount-test
+
+.PHONY: all test_unprivileged_remount
diff --git a/tools/testing/selftests/mount/unprivileged-remount-test.c b/tools/testing/selftests/mount/unprivileged-remount-test.c
new file mode 100644
index 000000000000..1b3ff2fda4d0
--- /dev/null
+++ b/tools/testing/selftests/mount/unprivileged-remount-test.c
@@ -0,0 +1,242 @@
+#define _GNU_SOURCE
+#include <sched.h>
+#include <stdio.h>
+#include <errno.h>
+#include <string.h>
+#include <sys/types.h>
+#include <sys/mount.h>
+#include <sys/wait.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <fcntl.h>
+#include <grp.h>
+#include <stdbool.h>
+#include <stdarg.h>
+
+#ifndef CLONE_NEWNS
+# define CLONE_NEWNS 0x00020000
+#endif
+#ifndef CLONE_NEWUTS
+# define CLONE_NEWUTS 0x04000000
+#endif
+#ifndef CLONE_NEWIPC
+# define CLONE_NEWIPC 0x08000000
+#endif
+#ifndef CLONE_NEWNET
+# define CLONE_NEWNET 0x40000000
+#endif
+#ifndef CLONE_NEWUSER
+# define CLONE_NEWUSER 0x10000000
+#endif
+#ifndef CLONE_NEWPID
+# define CLONE_NEWPID 0x20000000
+#endif
+
+#ifndef MS_RELATIME
+#define MS_RELATIME (1 << 21)
+#endif
+#ifndef MS_STRICTATIME
+#define MS_STRICTATIME (1 << 24)
+#endif
+
+static void die(char *fmt, ...)
+{
+        va_list ap;
+        va_start(ap, fmt);
+        vfprintf(stderr, fmt, ap);
+        va_end(ap);
+        exit(EXIT_FAILURE);
+}
+
+static void write_file(char *filename, char *fmt, ...)
+{
+        char buf[4096];
+        int fd;
+        ssize_t written;
+        int buf_len;
+        va_list ap;
+
+        va_start(ap, fmt);
+        buf_len = vsnprintf(buf, sizeof(buf), fmt, ap);
+        va_end(ap);
+        if (buf_len < 0) {
+                die("vsnprintf failed: %s\n",
+                    strerror(errno));
+        }
+        if (buf_len >= sizeof(buf)) {
+                die("vsnprintf output truncated\n");
+        }
+
+        fd = open(filename, O_WRONLY);
+        if (fd < 0) {
+                die("open of %s failed: %s\n",
+                    filename, strerror(errno));
+        }
+        written = write(fd, buf, buf_len);
+        if (written != buf_len) {
+                if (written >= 0) {
+                        die("short write to %s\n", filename);
+                } else {
+                        die("write to %s failed: %s\n",
+                                filename, strerror(errno));
+                }
+        }
+        if (close(fd) != 0) {
+                die("close of %s failed: %s\n",
+                        filename, strerror(errno));
+        }
+}
+
+static void create_and_enter_userns(void)
+{
+        uid_t uid;
+        gid_t gid;
+
+        uid = getuid();
+        gid = getgid();
+
+        if (unshare(CLONE_NEWUSER) !=0) {
+                die("unshare(CLONE_NEWUSER) failed: %s\n",
+                        strerror(errno));
+        }
+
+        write_file("/proc/self/uid_map", "0 %d 1", uid);
+        write_file("/proc/self/gid_map", "0 %d 1", gid);
+
+        if (setgroups(0, NULL) != 0) {
+                die("setgroups failed: %s\n",
+                        strerror(errno));
+        }
+        if (setgid(0) != 0) {
+                die ("setgid(0) failed %s\n",
+                        strerror(errno));
+        }
+        if (setuid(0) != 0) {
+                die("setuid(0) failed %s\n",
+                        strerror(errno));
+        }
+}
+
+static
+bool test_unpriv_remount(int mount_flags, int remount_flags, int invalid_flags)
+{
+        pid_t child;
+
+        child = fork();
+        if (child == -1) {
+                die("fork failed: %s\n",
+                        strerror(errno));
+        }
+        if (child != 0) { /* parent */
+                pid_t pid;
+                int status;
+                pid = waitpid(child, &status, 0);
+                if (pid == -1) {
+                        die("waitpid failed: %s\n",
+                                strerror(errno));
+                }
+                if (pid != child) {
+                        die("waited for %d got %d\n",
+                                child, pid);
+                }
+                if (!WIFEXITED(status)) {
+                        die("child did not terminate cleanly\n");
+                }
+                return WEXITSTATUS(status) == EXIT_SUCCESS ? true : false;
+        }
+
+        create_and_enter_userns();
+        if (unshare(CLONE_NEWNS) != 0) {
+                die("unshare(CLONE_NEWNS) failed: %s\n",
+                        strerror(errno));
+        }
+
+        if (mount("testing", "/tmp", "ramfs", mount_flags, NULL) != 0) {
+                die("mount of /tmp failed: %s\n",
+                        strerror(errno));
+        }
+
+        create_and_enter_userns();
+
+        if (unshare(CLONE_NEWNS) != 0) {
+                die("unshare(CLONE_NEWNS) failed: %s\n",
+                        strerror(errno));
+        }
+
+        if (mount("/tmp", "/tmp", "none",
+                  MS_REMOUNT | MS_BIND | remount_flags, NULL) != 0) {
+                /* system("cat /proc/self/mounts"); */
+                die("remount of /tmp failed: %s\n",
+                    strerror(errno));
+        }
+
+        if (mount("/tmp", "/tmp", "none",
+                  MS_REMOUNT | MS_BIND | invalid_flags, NULL) == 0) {
+                /* system("cat /proc/self/mounts"); */
+                die("remount of /tmp with invalid flags "
+                    "succeeded unexpectedly\n");
+        }
+        exit(EXIT_SUCCESS);
+}
+
+static bool test_unpriv_remount_simple(int mount_flags)
+{
+        return test_unpriv_remount(mount_flags, mount_flags, 0);
+}
+
+static bool test_unpriv_remount_atime(int mount_flags, int invalid_flags)
+{
+        return test_unpriv_remount(mount_flags, mount_flags, invalid_flags);
+}
+
+int main(int argc, char **argv)
+{
+        if (!test_unpriv_remount_simple(MS_RDONLY|MS_NODEV)) {
+                die("MS_RDONLY malfunctions\n");
+        }
+        if (!test_unpriv_remount_simple(MS_NODEV)) {
+                die("MS_NODEV malfunctions\n");
+        }
+        if (!test_unpriv_remount_simple(MS_NOSUID|MS_NODEV)) {
+                die("MS_NOSUID malfunctions\n");
+        }
+        if (!test_unpriv_remount_simple(MS_NOEXEC|MS_NODEV)) {
+                die("MS_NOEXEC malfunctions\n");
+        }
+        if (!test_unpriv_remount_atime(MS_RELATIME|MS_NODEV,
+                                       MS_NOATIME|MS_NODEV))
+        {
+                die("MS_RELATIME malfunctions\n");
+        }
+        if (!test_unpriv_remount_atime(MS_STRICTATIME|MS_NODEV,
+                                       MS_NOATIME|MS_NODEV))
+        {
+                die("MS_STRICTATIME malfunctions\n");
+        }
+        if (!test_unpriv_remount_atime(MS_NOATIME|MS_NODEV,
+                                       MS_STRICTATIME|MS_NODEV))
+        {
+                die("MS_RELATIME malfunctions\n");
+        }
+        if (!test_unpriv_remount_atime(MS_RELATIME|MS_NODIRATIME|MS_NODEV,
+                                       MS_NOATIME|MS_NODEV))
+        {
+                die("MS_RELATIME malfunctions\n");
+        }
+        if (!test_unpriv_remount_atime(MS_STRICTATIME|MS_NODIRATIME|MS_NODEV,
+                                       MS_NOATIME|MS_NODEV))
+        {
+                die("MS_RELATIME malfunctions\n");
+        }
+        if (!test_unpriv_remount_atime(MS_NOATIME|MS_NODIRATIME|MS_NODEV,
+                                       MS_STRICTATIME|MS_NODEV))
+        {
+                die("MS_RELATIME malfunctions\n");
+        }
+        if (!test_unpriv_remount(MS_STRICTATIME|MS_NODEV, MS_NODEV,
+                                 MS_NOATIME|MS_NODEV))
+        {
+                die("Default atime malfunctions\n");
+        }
+        return EXIT_SUCCESS;
+}