If only the dynamic part of procfs is mounted (subset=pid), then there is no
need to check if procfs is fully visible to the user in the new user namespace.
Changelog
---------
v4:
* Set SB_I_DYNAMIC only if pidonly is set.
* Add an error message if subset=pid is canceled during remount.
v3:
* Add 'const' to struct cred *mounter_cred (fix kernel test robot warning).
v2:
* cache the mounters credentials and make access to the net directories
contingent of the permissions of the mounter of procfs.
--
Alexey Gladkov (3):
proc: Relax check of mount visibility
proc: Show /proc/self/net only for CAP_NET_ADMIN
proc: Disable cancellation of subset=pid option
fs/namespace.c | 27 ++++++++++++++++-----------
fs/proc/proc_net.c | 8 ++++++++
fs/proc/root.c | 29 ++++++++++++++++++++++-------
include/linux/fs.h | 1 +
include/linux/proc_fs.h | 1 +
5 files changed, 48 insertions(+), 18 deletions(-)
--
2.29.2
Alexey Gladkov <[email protected]> writes:
> If only the dynamic part of procfs is mounted (subset=pid), then there is no
> need to check if procfs is fully visible to the user in the new user
> namespace.
A couple of things.
1) Allowing the mount should come in the last patch. So we don't have a
bisect hazard.
2) We should document that we still require a mount of proc to match on
atime and readonly mount attributes.
3) If we can find a way to safely not require a previous mount of proc
this will be much more valuable.
Eric
On Mon, Feb 22, 2021 at 09:44:40AM -0600, Eric W. Biederman wrote:
> Alexey Gladkov <[email protected]> writes:
>
> > If only the dynamic part of procfs is mounted (subset=pid), then there is no
> > need to check if procfs is fully visible to the user in the new user
> > namespace.
>
>
> A couple of things.
>
> 1) Allowing the mount should come in the last patch. So we don't have a
> bisect hazard.
>
> 2) We should document that we still require a mount of proc to match on
> atime and readonly mount attributes.
Ok. I will try to do it in v5.
> 3) If we can find a way to safely not require a previous mount of proc
> this will be much more valuable.
True, but for now I have no idea how to do it. I would prefer to move in
small steps.
--
Rgrds, legion