move the capability checks from sget_userns() to legacy_get_tree()

1) all call chains leading to sget_userns() pass through ->mount()
instances.
2) none of ->mount() instances is ever called directly - the only
call site is legacy_get_tree()
3) all remaining ->mount() instances end up calling sget_userns()

IOW, we might as well do the capability checks just before calling
->mount().  As for the arguments passed to mount_capable(),
in case of call chains to sget_userns() going through sget(),
we either don't call mount_capable() at all, or pass current_user_ns()
to it.  The call chains going through mount_pseudo_xattr() don't
call mount_capable() at all (SB_KERNMOUNT in flags on those).

That could've been split into smaller steps (lifting the checks
into sget(), then callers of sget(), then all the way to the
entries of every ->mount() out there, then to the sole caller),
but that would be too much churn for little benefit...

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

diff --git a/fs/fs_context.c b/fs/fs_context.c
index a47ccd5a4a78081b5e41409549c53c45a5cb47cd..746a5871959cb0d9246fe4c2ad9a6dc336317d9b 100644 (file)
--- a/fs/fs_context.c
+++ b/fs/fs_context.c
@@ -662,6 +662,11 @@ static int legacy_get_tree(struct fs_context *fc)
        struct super_block *sb;
        struct dentry *root;
 
+       if (!(fc->sb_flags & (SB_KERNMOUNT|SB_SUBMOUNT))) {
+               if (!mount_capable(fc->fs_type, current_user_ns()))
+                       return -EPERM;
+       }
+
        root = fc->fs_type->mount(fc->fs_type, fc->sb_flags,
                                      fc->source, ctx->legacy_data);
        if (IS_ERR(root))

diff --git a/fs/internal.h b/fs/internal.h
index 1ac2b8f6c621a6c9d04c961147811451ec25f547..65db901420afbe04ee3b04f472e9b29308e95ab2 100644 (file)
--- a/fs/internal.h
+++ b/fs/internal.h
@@ -18,6 +18,7 @@ struct path;
 struct mount;
 struct shrink_control;
 struct fs_context;
+struct user_namespace;
 
 /*
  * block_dev.c
@@ -113,6 +114,7 @@ extern struct file *alloc_empty_file_noaccount(int, const struct cred *);
 extern int reconfigure_super(struct fs_context *);
 extern bool trylock_super(struct super_block *sb);
 extern struct super_block *user_get_super(dev_t);
+extern bool mount_capable(struct file_system_type *, struct user_namespace *);
 
 /*
  * open.c

diff --git a/fs/super.c b/fs/super.c
index 6919f5c728f0544def7694d4da1f1b33ff96820c..bdb03255c7ea988e2f1b53996812bf5869f8bd2f 100644 (file)
--- a/fs/super.c
+++ b/fs/super.c
@@ -583,10 +583,6 @@ struct super_block *sget_userns(struct file_system_type *type,
        struct super_block *old;
        int err;
 
-       if (!(flags & (SB_KERNMOUNT|SB_SUBMOUNT))) {
-               if (!mount_capable(type, user_ns))
-                       return ERR_PTR(-EPERM);
-       }
 retry:
        spin_lock(&sb_lock);
        if (test) {