• Eric W. Biederman's avatar
    sysfs: Allow mounting without CONFIG_NET · 667b4102
    Eric W. Biederman authored
    In kobj_ns_current_may_mount the default should be to allow the
    mount.  The test is only for a single kobj_ns_type at a time, and unless
    there is a reason to prevent it the mounting sysfs should be allowed.
    Subsystems that are not registered can't have are not involved so can't
    have a reason to prevent mounting sysfs.
    
    This is a bug-fix to:
        commit 7dc5dbc8
        Author: Eric W. Biederman <ebiederm@xmission.com>
        Date:   Mon Mar 25 20:07:01 2013 -0700
    
            sysfs: Restrict mounting sysfs
    
            Don't allow mounting sysfs unless the caller has CAP_SYS_ADMIN rights
            over the net namespace.  The principle here is if you create or have
            capabilities over it you can mount it, otherwise you get to live with
            what other people have mounted.
    
            Instead of testing this with a straight forward ns_capable call,
            perform this check the long and torturous way with kobject helpers,
            this keeps direct knowledge of namespaces out of sysfs, and preserves
            the existing sysfs abstractions.
    Acked-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: default avatar"Eric W. Biederman" <ebiederm@xmission.com>
    
    That came in via the userns tree during the 3.12 merge window.
    Reported-by: default avatarJames Hogan <james.hogan@imgtec.com>
    Signed-off-by: default avatar"Eric W. Biederman" <ebiederm@xmission.com>
    Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    667b4102
kobject.c 24.2 KB