Commit 90563b19 authored by Eric W. Biederman's avatar Eric W. Biederman

vfs: Add a mount flag to lock read only bind mounts

When a read-only bind mount is copied from mount namespace in a higher
privileged user namespace to a mount namespace in a lesser privileged
user namespace, it should not be possible to remove the the read-only
restriction.

Add a MNT_LOCK_READONLY mount flag to indicate that a mount must
remain read-only.

CC: stable@vger.kernel.org
Acked-by: default avatarSerge Hallyn <serge.hallyn@canonical.com>
Signed-off-by: default avatar"Eric W. Biederman" <ebiederm@xmission.com>
parent 3151527e
...@@ -1713,6 +1713,9 @@ static int change_mount_flags(struct vfsmount *mnt, int ms_flags) ...@@ -1713,6 +1713,9 @@ static int change_mount_flags(struct vfsmount *mnt, int ms_flags)
if (readonly_request == __mnt_is_readonly(mnt)) if (readonly_request == __mnt_is_readonly(mnt))
return 0; return 0;
if (mnt->mnt_flags & MNT_LOCK_READONLY)
return -EPERM;
if (readonly_request) if (readonly_request)
error = mnt_make_readonly(real_mount(mnt)); error = mnt_make_readonly(real_mount(mnt));
else else
......
...@@ -47,6 +47,8 @@ struct mnt_namespace; ...@@ -47,6 +47,8 @@ struct mnt_namespace;
#define MNT_INTERNAL 0x4000 #define MNT_INTERNAL 0x4000
#define MNT_LOCK_READONLY 0x400000
struct vfsmount { struct vfsmount {
struct dentry *mnt_root; /* root of the mounted tree */ struct dentry *mnt_root; /* root of the mounted tree */
struct super_block *mnt_sb; /* pointer to superblock */ struct super_block *mnt_sb; /* pointer to superblock */
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment