| From | "Eric W. Biederman" <> | Date | Wed, 13 Feb 2013 09:50:50 -0800 | Subject | [PATCH review 01/85] ceph: Only allow mounts in the initial network namespace |
| |
From: "Eric W. Biederman" <ebiederm@xmission.com>
Today ceph opens tcp sockets from a delayed work callback. Delayed work happens from kernel threads which are always in the initial network namespace. Therefore fail early if someone attempts to mount a ceph filesystem from something other than the initial network namespace.
Cc: Sage Weil <sage@inktank.com> Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com> --- net/ceph/ceph_common.c | 5 +++++ 1 files changed, 5 insertions(+), 0 deletions(-)
diff --git a/net/ceph/ceph_common.c b/net/ceph/ceph_common.c index ee71ea2..1deb29a 100644 --- a/net/ceph/ceph_common.c +++ b/net/ceph/ceph_common.c @@ -15,6 +15,8 @@ #include <linux/slab.h> #include <linux/statfs.h> #include <linux/string.h> +#include <linux/nsproxy.h> +#include <net/net_namespace.h> #include <linux/ceph/ceph_features.h> @@ -292,6 +294,9 @@ ceph_parse_options(char *options, const char *dev_name, int err = -ENOMEM; substring_t argstr[MAX_OPT_ARGS]; + if (current->nsproxy->net_ns != &init_net) + return ERR_PTR(-EINVAL); + opt = kzalloc(sizeof(*opt), GFP_KERNEL); if (!opt) return ERR_PTR(-ENOMEM); -- 1.7.5.4
|