-
- Downloads
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace
Pull namespace updates from Eric Biederman: "This is a bunch of small changes built against 3.16-rc6. The most significant change for users is the first patch which makes setns drmatically faster by removing unneded rcu handling. The next chunk of changes are so that "mount -o remount,.." will not allow the user namespace root to drop flags on a mount set by the system wide root. Aks this forces read-only mounts to stay read-only, no-dev mounts to stay no-dev, no-suid mounts to stay no-suid, no-exec mounts to stay no exec and it prevents unprivileged users from messing with a mounts atime settings. I have included my test case as the last patch in this series so people performing backports can verify this change works correctly. The next change fixes a bug in NFS that was discovered while auditing nsproxy users for the first optimization. Today you can oops the kernel by reading /proc/fs/nfsfs/{servers,volumes} if you are clever with pid namespaces. I rebased and fixed the build of the !CONFIG_NFS_FS case yesterday when a build bot caught my typo. Given that no one to my knowledge bases anything on my tree fixing the typo in place seems more responsible that requiring a typo-fix to be backported as well. The last change is a small semantic cleanup introducing /proc/thread-self and pointing /proc/mounts and /proc/net at it. This prevents several kinds of problemantic corner cases. It is a user-visible change so it has a minute chance of causing regressions so the change to /proc/mounts and /proc/net are individual one line commits that can be trivially reverted. Unfortunately I lost and could not find the email of the original reporter so he is not credited. From at least one perspective this change to /proc/net is a refgression fix to allow pthread /proc/net uses that were broken by the introduction of the network namespace" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace: proc: Point /proc/mounts at /proc/thread-self/mounts instead of /proc/self/mounts proc: Point /proc/net at /proc/thread-self/net instead of /proc/self/net proc: Implement /proc/thread-self to point at the directory of the current thread proc: Have net show up under /proc/<tgid>/task/<tid> NFS: Fix /proc/fs/nfsfs/servers and /proc/fs/nfsfs/volumes mnt: Add tests for unprivileged remount cases that have found to be faulty mnt: Change the default remount atime from relatime to the existing value mnt: Correct permission checks in do_remount mnt: Move the test for MNT_LOCK_READONLY from change_mount_flags into do_remount mnt: Only change user settable mount flags in remount namespaces: Use task_lock and not rcu to protect nsproxy
Showing
- fs/namespace.c 55 additions, 10 deletionsfs/namespace.c
- fs/nfs/client.c 55 additions, 40 deletionsfs/nfs/client.c
- fs/nfs/inode.c 2 additions, 1 deletionfs/nfs/inode.c
- fs/nfs/internal.h 9 additions, 0 deletionsfs/nfs/internal.h
- fs/nfs/netns.h 3 additions, 0 deletionsfs/nfs/netns.h
- fs/proc/Makefile 1 addition, 0 deletionsfs/proc/Makefile
- fs/proc/base.c 13 additions, 5 deletionsfs/proc/base.c
- fs/proc/inode.c 6 additions, 1 deletionfs/proc/inode.c
- fs/proc/internal.h 6 additions, 0 deletionsfs/proc/internal.h
- fs/proc/proc_net.c 4 additions, 2 deletionsfs/proc/proc_net.c
- fs/proc/root.c 4 additions, 1 deletionfs/proc/root.c
- fs/proc/thread_self.c 85 additions, 0 deletionsfs/proc/thread_self.c
- fs/proc_namespace.c 3 additions, 5 deletionsfs/proc_namespace.c
- include/linux/mount.h 8 additions, 1 deletioninclude/linux/mount.h
- include/linux/nsproxy.h 6 additions, 10 deletionsinclude/linux/nsproxy.h
- include/linux/pid_namespace.h 1 addition, 0 deletionsinclude/linux/pid_namespace.h
- ipc/namespace.c 3 additions, 3 deletionsipc/namespace.c
- kernel/nsproxy.c 4 additions, 11 deletionskernel/nsproxy.c
- kernel/utsname.c 3 additions, 3 deletionskernel/utsname.c
- net/core/net_namespace.c 6 additions, 4 deletionsnet/core/net_namespace.c
Loading
Please register or sign in to comment