[Devel] [PATCH vz10 v2 2/2] fs: enforce cgroup permissions for bdevs on mount

[Aleksei Oladko]

In mount operations, cgroup device access permissions are checked only
when a new super_block is created. If the device has already been mounted,
no permission check is performed since the super_block already exists.
As a result, a process belonging to a cgroup without access permissions
to the device can still perform a mount operation successfully.

To reproduce:
 # mount /dev/loop0 /mnt/test0
 # echo $$ > /sys/fs/cgroup/machine.slice/CTID/cgroup.procs
 # mount /dev/loop0 /mnt/test1
 #

If the device was not mounted before, the mount operation fails
as expected:
 # echo $$ > /sys/fs/cgroup/machine.slice/CTID/cgroup.procs
 # mount /dev/loop0 /mnt/test1
mount: /mnt/test1: permission denied.

This patch adds a cgroup permission check for the mounting process
before obtaining the device's super_block. As a result, even if the
device has already been mounted and the super_block exists, the mount
operation will be denied when the process lacks the appropriate cgroup
permissions.

v2: removed redundant cgroup permission check when creating a new
superblock in setup_dbev_super.

https://virtuozzo.atlassian.net/browse/VSTOR-105978

Signed-off-by: Aleksei Oladko <aleksey.oladko at virtuozzo.com>
---
 block/bdev.c           | 22 ++++++++++++++++------
 block/blk.h            |  1 -
 fs/super.c             | 20 ++++++++++++++++++--
 include/linux/blkdev.h |  4 ++++
 4 files changed, 38 insertions(+), 9 deletions(-)

diff --git a/block/bdev.c b/block/bdev.c
index 3ed6ea450554..b445ceeb18ac 100644
--- a/block/bdev.c
+++ b/block/bdev.c
@@ -992,18 +992,15 @@ static unsigned blk_to_file_flags(blk_mode_t mode)
 	return flags;
 }
 
-struct file *bdev_file_open_by_dev(dev_t dev, blk_mode_t mode, void *holder,
-				   const struct blk_holder_ops *hops)
+struct file *bdev_file_open_by_dev_nocheck(dev_t dev, blk_mode_t mode,
+					   void *holder,
+					   const struct blk_holder_ops *hops)
 {
 	struct file *bdev_file;
 	struct block_device *bdev;
 	unsigned int flags;
 	int ret;
 
-	ret = bdev_permission(dev, mode, holder);
-	if (ret)
-		return ERR_PTR(ret);
-
 	bdev = blkdev_get_no_open(dev);
 	if (!bdev)
 		return ERR_PTR(-ENXIO);
@@ -1026,6 +1023,19 @@ struct file *bdev_file_open_by_dev(dev_t dev, blk_mode_t mode, void *holder,
 	}
 	return bdev_file;
 }
+EXPORT_SYMBOL(bdev_file_open_by_dev_nocheck);
+
+struct file *bdev_file_open_by_dev(dev_t dev, blk_mode_t mode, void *holder,
+				   const struct blk_holder_ops *hops)
+{
+	int ret;
+
+	ret = bdev_permission(dev, mode, holder);
+	if (ret)
+		return ERR_PTR(ret);
+
+	return bdev_file_open_by_dev_nocheck(dev, mode, holder, hops);
+}
 EXPORT_SYMBOL(bdev_file_open_by_dev);
 
 struct file *bdev_file_open_by_path(const char *path, blk_mode_t mode,
diff --git a/block/blk.h b/block/blk.h
index c718e4291db0..8610d87e5050 100644
--- a/block/blk.h
+++ b/block/blk.h
@@ -727,7 +727,6 @@ static inline void bio_issue_init(struct bio_issue *issue,
 void bdev_release(struct file *bdev_file);
 int bdev_open(struct block_device *bdev, blk_mode_t mode, void *holder,
 	      const struct blk_holder_ops *hops, struct file *bdev_file);
-int bdev_permission(dev_t dev, blk_mode_t mode, void *holder);
 
 void blk_integrity_generate(struct bio *bio);
 void blk_integrity_verify(struct bio *bio);
diff --git a/fs/super.c b/fs/super.c
index 5cdd1b28ac9f..b922fc978b6f 100644
--- a/fs/super.c
+++ b/fs/super.c
@@ -1408,6 +1408,17 @@ struct super_block *sget_dev(struct fs_context *fc, dev_t dev)
 }
 EXPORT_SYMBOL(sget_dev);
 
+static struct super_block *sget_dev_check(struct fs_context *fc, dev_t dev)
+{
+	int ret;
+
+	blk_mode_t mode = sb_open_mode(fc->sb_flags) | BLK_OPEN_MOUNT;
+	ret = bdev_permission(dev, mode, fc);
+	if (ret)
+		return ERR_PTR(ret);
+	return sget_dev(fc, dev);
+}
+
 #ifdef CONFIG_BLOCK
 /*
  * Lock the superblock that is holder of the bdev. Returns the superblock
@@ -1597,7 +1608,8 @@ int setup_bdev_super(struct super_block *sb, int sb_flags,
 	struct file *bdev_file;
 	struct block_device *bdev;
 
-	bdev_file = bdev_file_open_by_dev(sb->s_dev, mode | BLK_OPEN_MOUNT, sb, &fs_holder_ops);
+	bdev_file = bdev_file_open_by_dev_nocheck(sb->s_dev,
+			mode, sb, &fs_holder_ops);
 	if (IS_ERR(bdev_file)) {
 		if (fc)
 			errorf(fc, "%s: Can't open blockdev", fc->source);
@@ -1665,7 +1677,7 @@ int get_tree_bdev_flags(struct fs_context *fc,
 		return error;
 	}
 	fc->sb_flags |= SB_NOSEC;
-	s = sget_dev(fc, dev);
+	s = sget_dev_check(fc, dev);
 	if (IS_ERR(s))
 		return PTR_ERR(s);
 
@@ -1723,6 +1735,10 @@ struct dentry *mount_bdev(struct file_system_type *fs_type,
 	if (error)
 		return ERR_PTR(error);
 
+	error = bdev_permission(dev, sb_open_mode(flags) | BLK_OPEN_MOUNT, data);
+	if (error)
+		return ERR_PTR(error);
+
 	flags |= SB_NOSEC;
 	s = sget(fs_type, test_bdev_super, set_bdev_super, flags, &dev);
 	if (IS_ERR(s))
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index 64c28dbb44b4..0dee6b60b62d 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -1661,11 +1661,15 @@ extern const struct blk_holder_ops fs_holder_ops;
 
 struct file *bdev_file_open_by_dev(dev_t dev, blk_mode_t mode, void *holder,
 		const struct blk_holder_ops *hops);
+struct file *bdev_file_open_by_dev_nocheck(dev_t dev, blk_mode_t mode,
+					   void *holder,
+					   const struct blk_holder_ops *hops);
 struct file *bdev_file_open_by_path(const char *path, blk_mode_t mode,
 		void *holder, const struct blk_holder_ops *hops);
 int bd_prepare_to_claim(struct block_device *bdev, void *holder,
 		const struct blk_holder_ops *hops);
 void bd_abort_claiming(struct block_device *bdev, void *holder);
+int bdev_permission(dev_t dev, blk_mode_t mode, void *holder);
 
 /* just for blk-cgroup, don't use elsewhere */
 struct block_device *blkdev_get_no_open(dev_t dev);
-- 
2.43.0