Messages in this thread |  | | Date | Wed, 8 Dec 2021 09:03:43 -0500 | Subject | Re: [PATCH v4 11/16] securityfs: Only use simple_pin_fs/simple_release_fs for init_user_ns | From | Stefan Berger <> |
| |
On 12/8/21 06:58, Christian Brauner wrote: > On Tue, Dec 07, 2021 at 03:21:22PM -0500, Stefan Berger wrote: >> To prepare for virtualization of SecurityFS, use simple_pin_fs and >> simpe_release_fs only when init_user_ns is active. >> >> Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> >> Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com> >> --- >> security/inode.c | 30 +++++++++++++++++++++--------- >> 1 file changed, 21 insertions(+), 9 deletions(-) >> >> diff --git a/security/inode.c b/security/inode.c >> index 6c326939750d..1a720b2c566d 100644 >> --- a/security/inode.c >> +++ b/security/inode.c >> @@ -21,9 +21,10 @@ >> #include <linux/security.h> >> #include <linux/lsm_hooks.h> >> #include <linux/magic.h> >> +#include <linux/user_namespace.h> >> >> -static struct vfsmount *mount; >> -static int mount_count; >> +static struct vfsmount *securityfs_mount; >> +static int securityfs_mount_count; >> >> static void securityfs_free_inode(struct inode *inode) >> { >> @@ -109,6 +110,7 @@ static struct dentry *securityfs_create_dentry(const char *name, umode_t mode, >> const struct file_operations *fops, >> const struct inode_operations *iops) >> { >> + struct user_namespace *ns = current_user_ns(); >> struct dentry *dentry; >> struct inode *dir, *inode; >> int error; >> @@ -118,12 +120,17 @@ static struct dentry *securityfs_create_dentry(const char *name, umode_t mode, >> >> pr_debug("securityfs: creating file '%s'\n",name); >> >> - error = simple_pin_fs(&fs_type, &mount, &mount_count); >> - if (error) >> - return ERR_PTR(error); >> + if (ns == &init_user_ns) { >> + error = simple_pin_fs(&fs_type, &securityfs_mount, >> + &securityfs_mount_count); >> + if (error) >> + return ERR_PTR(error); >> + } >> >> - if (!parent) >> - parent = mount->mnt_root; >> + if (!parent) { >> + if (ns == &init_user_ns) >> + parent = securityfs_mount->mnt_root; > Wouldn't you want an > > else > return ERR_PTR(-EINVAL); > > in here already?
Fixed.
|  |