[Devel] [PATCH rh8 3/4] ve/fs/namespace: allow submounts in non-init userns
Konstantin Khorenko
khorenko at virtuozzo.com
Thu Mar 18 20:04:08 MSK 2021
Simple NFS mount inside a Container brings us to vfs_submount(), so if
we want to enable NFS inside a Container (read - in CT root userns), we
have to soften the check for init userns.
SyS_mount
do_mount
vfs_kern_mount
mount_fs
nfs_fs_mount
nfs4_try_mount
nfs_follow_remote_path
mount_subtree
vfs_path_lookup
do_path_lookup
filename_lookup
path_lookupat
lookup_slow
follow_managed
nfs_d_automount
nfs4_submount
nfs_do_submount
vfs_submount
https://jira.sw.ru/browse/PSBM-86277
Signed-off-by: Konstantin Khorenko <khorenko at virtuozzo.com>
https://jira.sw.ru/browse/PSBM-127234
(cherry picked from vz7 commit bc060d46276144f91a139b7d0acf384dcd0a4dde)
vz7->vz8 port note: in vz7 the check has been dropped at allm
in vz8 we leave the check, but allow submounts only for root CT userns.
Signed-off-by: Konstantin Khorenko <khorenko at virtuozzo.com>
---
fs/namespace.c | 25 ++++++++++++++++++++++++-
1 file changed, 24 insertions(+), 1 deletion(-)
diff --git a/fs/namespace.c b/fs/namespace.c
index ecd4a56e21ad..ecf2909a8cd0 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -987,7 +987,30 @@ vfs_submount(const struct dentry *mountpoint, struct file_system_type *type,
* through from the parent mount to the submount don't support
* unprivileged mounts with submounts.
*/
- if (mountpoint->d_sb->s_user_ns != &init_user_ns)
+ /* Simple NFS mount inside a Container brings us here, so if we want to
+ * enable NFS inside a Container (read - in CT root userns), we have
+ * to soften the check.
+ *
+ * SyS_mount
+ * do_mount
+ * vfs_kern_mount
+ * mount_fs
+ * nfs_fs_mount
+ * nfs4_try_mount
+ * nfs_follow_remote_path
+ * mount_subtree
+ * vfs_path_lookup
+ * do_path_lookup
+ * filename_lookup
+ * path_lookupat
+ * lookup_slow
+ * follow_managed
+ * nfs_d_automount
+ * nfs4_submount
+ * nfs_do_submount
+ * vfs_submount
+ */
+ if (mountpoint->d_sb->s_user_ns != ve_init_user_ns())
return ERR_PTR(-EPERM);
return vfs_kern_mount(type, SB_SUBMOUNT, name, data);
--
2.28.0
More information about the Devel
mailing list