1 /* 2 * linux/fs/namespace.c 3 * 4 * (C) Copyright Al Viro 2000, 2001 5 * Released under GPL v2. 6 * 7 * Based on code from fs/super.c, copyright Linus Torvalds and others. 8 * Heavily rewritten. 9 */ 10 11 #include <linux/syscalls.h> 12 #include <linux/export.h> 13 #include <linux/capability.h> 14 #include <linux/mnt_namespace.h> 15 #include <linux/user_namespace.h> 16 #include <linux/namei.h> 17 #include <linux/security.h> 18 #include <linux/cred.h> 19 #include <linux/idr.h> 20 #include <linux/init.h> /* init_rootfs */ 21 #include <linux/fs_struct.h> /* get_fs_root et.al. */ 22 #include <linux/fsnotify.h> /* fsnotify_vfsmount_delete */ 23 #include <linux/uaccess.h> 24 #include <linux/proc_ns.h> 25 #include <linux/magic.h> 26 #include <linux/bootmem.h> 27 #include <linux/task_work.h> 28 #include <linux/sched/task.h> 29 30 #include "pnode.h" 31 #include "internal.h" 32 33 /* Maximum number of mounts in a mount namespace */ 34 unsigned int sysctl_mount_max __read_mostly = 100000; 35 36 static unsigned int m_hash_mask __read_mostly; 37 static unsigned int m_hash_shift __read_mostly; 38 static unsigned int mp_hash_mask __read_mostly; 39 static unsigned int mp_hash_shift __read_mostly; 40 41 static __initdata unsigned long mhash_entries; 42 static int __init set_mhash_entries(char *str) 43 { 44 if (!str) 45 return 0; 46 mhash_entries = simple_strtoul(str, &str, 0); 47 return 1; 48 } 49 __setup("mhash_entries=", set_mhash_entries); 50 51 static __initdata unsigned long mphash_entries; 52 static int __init set_mphash_entries(char *str) 53 { 54 if (!str) 55 return 0; 56 mphash_entries = simple_strtoul(str, &str, 0); 57 return 1; 58 } 59 __setup("mphash_entries=", set_mphash_entries); 60 61 static u64 event; 62 static DEFINE_IDA(mnt_id_ida); 63 static DEFINE_IDA(mnt_group_ida); 64 static DEFINE_SPINLOCK(mnt_id_lock); 65 static int mnt_id_start = 0; 66 static int mnt_group_start = 1; 67 68 static struct hlist_head *mount_hashtable __read_mostly; 69 static struct hlist_head *mountpoint_hashtable __read_mostly; 70 static struct kmem_cache *mnt_cache __read_mostly; 71 static DECLARE_RWSEM(namespace_sem); 72 73 /* /sys/fs */ 74 struct kobject *fs_kobj; 75 EXPORT_SYMBOL_GPL(fs_kobj); 76 77 /* 78 * vfsmount lock may be taken for read to prevent changes to the 79 * vfsmount hash, ie. during mountpoint lookups or walking back 80 * up the tree. 81 * 82 * It should be taken for write in all cases where the vfsmount 83 * tree or hash is modified or when a vfsmount structure is modified. 84 */ 85 __cacheline_aligned_in_smp DEFINE_SEQLOCK(mount_lock); 86 87 static inline struct hlist_head *m_hash(struct vfsmount *mnt, struct dentry *dentry) 88 { 89 unsigned long tmp = ((unsigned long)mnt / L1_CACHE_BYTES); 90 tmp += ((unsigned long)dentry / L1_CACHE_BYTES); 91 tmp = tmp + (tmp >> m_hash_shift); 92 return &mount_hashtable[tmp & m_hash_mask]; 93 } 94 95 static inline struct hlist_head *mp_hash(struct dentry *dentry) 96 { 97 unsigned long tmp = ((unsigned long)dentry / L1_CACHE_BYTES); 98 tmp = tmp + (tmp >> mp_hash_shift); 99 return &mountpoint_hashtable[tmp & mp_hash_mask]; 100 } 101 102 static int mnt_alloc_id(struct mount *mnt) 103 { 104 int res; 105 106 retry: 107 ida_pre_get(&mnt_id_ida, GFP_KERNEL); 108 spin_lock(&mnt_id_lock); 109 res = ida_get_new_above(&mnt_id_ida, mnt_id_start, &mnt->mnt_id); 110 if (!res) 111 mnt_id_start = mnt->mnt_id + 1; 112 spin_unlock(&mnt_id_lock); 113 if (res == -EAGAIN) 114 goto retry; 115 116 return res; 117 } 118 119 static void mnt_free_id(struct mount *mnt) 120 { 121 int id = mnt->mnt_id; 122 spin_lock(&mnt_id_lock); 123 ida_remove(&mnt_id_ida, id); 124 if (mnt_id_start > id) 125 mnt_id_start = id; 126 spin_unlock(&mnt_id_lock); 127 } 128 129 /* 130 * Allocate a new peer group ID 131 * 132 * mnt_group_ida is protected by namespace_sem 133 */ 134 static int mnt_alloc_group_id(struct mount *mnt) 135 { 136 int res; 137 138 if (!ida_pre_get(&mnt_group_ida, GFP_KERNEL)) 139 return -ENOMEM; 140 141 res = ida_get_new_above(&mnt_group_ida, 142 mnt_group_start, 143 &mnt->mnt_group_id); 144 if (!res) 145 mnt_group_start = mnt->mnt_group_id + 1; 146 147 return res; 148 } 149 150 /* 151 * Release a peer group ID 152 */ 153 void mnt_release_group_id(struct mount *mnt) 154 { 155 int id = mnt->mnt_group_id; 156 ida_remove(&mnt_group_ida, id); 157 if (mnt_group_start > id) 158 mnt_group_start = id; 159 mnt->mnt_group_id = 0; 160 } 161 162 /* 163 * vfsmount lock must be held for read 164 */ 165 static inline void mnt_add_count(struct mount *mnt, int n) 166 { 167 #ifdef CONFIG_SMP 168 this_cpu_add(mnt->mnt_pcp->mnt_count, n); 169 #else 170 preempt_disable(); 171 mnt->mnt_count += n; 172 preempt_enable(); 173 #endif 174 } 175 176 /* 177 * vfsmount lock must be held for write 178 */ 179 unsigned int mnt_get_count(struct mount *mnt) 180 { 181 #ifdef CONFIG_SMP 182 unsigned int count = 0; 183 int cpu; 184 185 for_each_possible_cpu(cpu) { 186 count += per_cpu_ptr(mnt->mnt_pcp, cpu)->mnt_count; 187 } 188 189 return count; 190 #else 191 return mnt->mnt_count; 192 #endif 193 } 194 195 static void drop_mountpoint(struct fs_pin *p) 196 { 197 struct mount *m = container_of(p, struct mount, mnt_umount); 198 dput(m->mnt_ex_mountpoint); 199 pin_remove(p); 200 mntput(&m->mnt); 201 } 202 203 static struct mount *alloc_vfsmnt(const char *name) 204 { 205 struct mount *mnt = kmem_cache_zalloc(mnt_cache, GFP_KERNEL); 206 if (mnt) { 207 int err; 208 209 err = mnt_alloc_id(mnt); 210 if (err) 211 goto out_free_cache; 212 213 if (name) { 214 mnt->mnt_devname = kstrdup_const(name, GFP_KERNEL); 215 if (!mnt->mnt_devname) 216 goto out_free_id; 217 } 218 219 #ifdef CONFIG_SMP 220 mnt->mnt_pcp = alloc_percpu(struct mnt_pcp); 221 if (!mnt->mnt_pcp) 222 goto out_free_devname; 223 224 this_cpu_add(mnt->mnt_pcp->mnt_count, 1); 225 #else 226 mnt->mnt_count = 1; 227 mnt->mnt_writers = 0; 228 #endif 229 230 INIT_HLIST_NODE(&mnt->mnt_hash); 231 INIT_LIST_HEAD(&mnt->mnt_child); 232 INIT_LIST_HEAD(&mnt->mnt_mounts); 233 INIT_LIST_HEAD(&mnt->mnt_list); 234 INIT_LIST_HEAD(&mnt->mnt_expire); 235 INIT_LIST_HEAD(&mnt->mnt_share); 236 INIT_LIST_HEAD(&mnt->mnt_slave_list); 237 INIT_LIST_HEAD(&mnt->mnt_slave); 238 INIT_HLIST_NODE(&mnt->mnt_mp_list); 239 init_fs_pin(&mnt->mnt_umount, drop_mountpoint); 240 } 241 return mnt; 242 243 #ifdef CONFIG_SMP 244 out_free_devname: 245 kfree_const(mnt->mnt_devname); 246 #endif 247 out_free_id: 248 mnt_free_id(mnt); 249 out_free_cache: 250 kmem_cache_free(mnt_cache, mnt); 251 return NULL; 252 } 253 254 /* 255 * Most r/o checks on a fs are for operations that take 256 * discrete amounts of time, like a write() or unlink(). 257 * We must keep track of when those operations start 258 * (for permission checks) and when they end, so that 259 * we can determine when writes are able to occur to 260 * a filesystem. 261 */ 262 /* 263 * __mnt_is_readonly: check whether a mount is read-only 264 * @mnt: the mount to check for its write status 265 * 266 * This shouldn't be used directly ouside of the VFS. 267 * It does not guarantee that the filesystem will stay 268 * r/w, just that it is right *now*. This can not and 269 * should not be used in place of IS_RDONLY(inode). 270 * mnt_want/drop_write() will _keep_ the filesystem 271 * r/w. 272 */ 273 int __mnt_is_readonly(struct vfsmount *mnt) 274 { 275 if (mnt->mnt_flags & MNT_READONLY) 276 return 1; 277 if (mnt->mnt_sb->s_flags & MS_RDONLY) 278 return 1; 279 return 0; 280 } 281 EXPORT_SYMBOL_GPL(__mnt_is_readonly); 282 283 static inline void mnt_inc_writers(struct mount *mnt) 284 { 285 #ifdef CONFIG_SMP 286 this_cpu_inc(mnt->mnt_pcp->mnt_writers); 287 #else 288 mnt->mnt_writers++; 289 #endif 290 } 291 292 static inline void mnt_dec_writers(struct mount *mnt) 293 { 294 #ifdef CONFIG_SMP 295 this_cpu_dec(mnt->mnt_pcp->mnt_writers); 296 #else 297 mnt->mnt_writers--; 298 #endif 299 } 300 301 static unsigned int mnt_get_writers(struct mount *mnt) 302 { 303 #ifdef CONFIG_SMP 304 unsigned int count = 0; 305 int cpu; 306 307 for_each_possible_cpu(cpu) { 308 count += per_cpu_ptr(mnt->mnt_pcp, cpu)->mnt_writers; 309 } 310 311 return count; 312 #else 313 return mnt->mnt_writers; 314 #endif 315 } 316 317 static int mnt_is_readonly(struct vfsmount *mnt) 318 { 319 if (mnt->mnt_sb->s_readonly_remount) 320 return 1; 321 /* Order wrt setting s_flags/s_readonly_remount in do_remount() */ 322 smp_rmb(); 323 return __mnt_is_readonly(mnt); 324 } 325 326 /* 327 * Most r/o & frozen checks on a fs are for operations that take discrete 328 * amounts of time, like a write() or unlink(). We must keep track of when 329 * those operations start (for permission checks) and when they end, so that we 330 * can determine when writes are able to occur to a filesystem. 331 */ 332 /** 333 * __mnt_want_write - get write access to a mount without freeze protection 334 * @m: the mount on which to take a write 335 * 336 * This tells the low-level filesystem that a write is about to be performed to 337 * it, and makes sure that writes are allowed (mnt it read-write) before 338 * returning success. This operation does not protect against filesystem being 339 * frozen. When the write operation is finished, __mnt_drop_write() must be 340 * called. This is effectively a refcount. 341 */ 342 int __mnt_want_write(struct vfsmount *m) 343 { 344 struct mount *mnt = real_mount(m); 345 int ret = 0; 346 347 preempt_disable(); 348 mnt_inc_writers(mnt); 349 /* 350 * The store to mnt_inc_writers must be visible before we pass 351 * MNT_WRITE_HOLD loop below, so that the slowpath can see our 352 * incremented count after it has set MNT_WRITE_HOLD. 353 */ 354 smp_mb(); 355 while (ACCESS_ONCE(mnt->mnt.mnt_flags) & MNT_WRITE_HOLD) 356 cpu_relax(); 357 /* 358 * After the slowpath clears MNT_WRITE_HOLD, mnt_is_readonly will 359 * be set to match its requirements. So we must not load that until 360 * MNT_WRITE_HOLD is cleared. 361 */ 362 smp_rmb(); 363 if (mnt_is_readonly(m)) { 364 mnt_dec_writers(mnt); 365 ret = -EROFS; 366 } 367 preempt_enable(); 368 369 return ret; 370 } 371 372 /** 373 * mnt_want_write - get write access to a mount 374 * @m: the mount on which to take a write 375 * 376 * This tells the low-level filesystem that a write is about to be performed to 377 * it, and makes sure that writes are allowed (mount is read-write, filesystem 378 * is not frozen) before returning success. When the write operation is 379 * finished, mnt_drop_write() must be called. This is effectively a refcount. 380 */ 381 int mnt_want_write(struct vfsmount *m) 382 { 383 int ret; 384 385 sb_start_write(m->mnt_sb); 386 ret = __mnt_want_write(m); 387 if (ret) 388 sb_end_write(m->mnt_sb); 389 return ret; 390 } 391 EXPORT_SYMBOL_GPL(mnt_want_write); 392 393 /** 394 * mnt_clone_write - get write access to a mount 395 * @mnt: the mount on which to take a write 396 * 397 * This is effectively like mnt_want_write, except 398 * it must only be used to take an extra write reference 399 * on a mountpoint that we already know has a write reference 400 * on it. This allows some optimisation. 401 * 402 * After finished, mnt_drop_write must be called as usual to 403 * drop the reference. 404 */ 405 int mnt_clone_write(struct vfsmount *mnt) 406 { 407 /* superblock may be r/o */ 408 if (__mnt_is_readonly(mnt)) 409 return -EROFS; 410 preempt_disable(); 411 mnt_inc_writers(real_mount(mnt)); 412 preempt_enable(); 413 return 0; 414 } 415 EXPORT_SYMBOL_GPL(mnt_clone_write); 416 417 /** 418 * __mnt_want_write_file - get write access to a file's mount 419 * @file: the file who's mount on which to take a write 420 * 421 * This is like __mnt_want_write, but it takes a file and can 422 * do some optimisations if the file is open for write already 423 */ 424 int __mnt_want_write_file(struct file *file) 425 { 426 if (!(file->f_mode & FMODE_WRITER)) 427 return __mnt_want_write(file->f_path.mnt); 428 else 429 return mnt_clone_write(file->f_path.mnt); 430 } 431 432 /** 433 * mnt_want_write_file - get write access to a file's mount 434 * @file: the file who's mount on which to take a write 435 * 436 * This is like mnt_want_write, but it takes a file and can 437 * do some optimisations if the file is open for write already 438 */ 439 int mnt_want_write_file(struct file *file) 440 { 441 int ret; 442 443 sb_start_write(file->f_path.mnt->mnt_sb); 444 ret = __mnt_want_write_file(file); 445 if (ret) 446 sb_end_write(file->f_path.mnt->mnt_sb); 447 return ret; 448 } 449 EXPORT_SYMBOL_GPL(mnt_want_write_file); 450 451 /** 452 * __mnt_drop_write - give up write access to a mount 453 * @mnt: the mount on which to give up write access 454 * 455 * Tells the low-level filesystem that we are done 456 * performing writes to it. Must be matched with 457 * __mnt_want_write() call above. 458 */ 459 void __mnt_drop_write(struct vfsmount *mnt) 460 { 461 preempt_disable(); 462 mnt_dec_writers(real_mount(mnt)); 463 preempt_enable(); 464 } 465 466 /** 467 * mnt_drop_write - give up write access to a mount 468 * @mnt: the mount on which to give up write access 469 * 470 * Tells the low-level filesystem that we are done performing writes to it and 471 * also allows filesystem to be frozen again. Must be matched with 472 * mnt_want_write() call above. 473 */ 474 void mnt_drop_write(struct vfsmount *mnt) 475 { 476 __mnt_drop_write(mnt); 477 sb_end_write(mnt->mnt_sb); 478 } 479 EXPORT_SYMBOL_GPL(mnt_drop_write); 480 481 void __mnt_drop_write_file(struct file *file) 482 { 483 __mnt_drop_write(file->f_path.mnt); 484 } 485 486 void mnt_drop_write_file(struct file *file) 487 { 488 mnt_drop_write(file->f_path.mnt); 489 } 490 EXPORT_SYMBOL(mnt_drop_write_file); 491 492 static int mnt_make_readonly(struct mount *mnt) 493 { 494 int ret = 0; 495 496 lock_mount_hash(); 497 mnt->mnt.mnt_flags |= MNT_WRITE_HOLD; 498 /* 499 * After storing MNT_WRITE_HOLD, we'll read the counters. This store 500 * should be visible before we do. 501 */ 502 smp_mb(); 503 504 /* 505 * With writers on hold, if this value is zero, then there are 506 * definitely no active writers (although held writers may subsequently 507 * increment the count, they'll have to wait, and decrement it after 508 * seeing MNT_READONLY). 509 * 510 * It is OK to have counter incremented on one CPU and decremented on 511 * another: the sum will add up correctly. The danger would be when we 512 * sum up each counter, if we read a counter before it is incremented, 513 * but then read another CPU's count which it has been subsequently 514 * decremented from -- we would see more decrements than we should. 515 * MNT_WRITE_HOLD protects against this scenario, because 516 * mnt_want_write first increments count, then smp_mb, then spins on 517 * MNT_WRITE_HOLD, so it can't be decremented by another CPU while 518 * we're counting up here. 519 */ 520 if (mnt_get_writers(mnt) > 0) 521 ret = -EBUSY; 522 else 523 mnt->mnt.mnt_flags |= MNT_READONLY; 524 /* 525 * MNT_READONLY must become visible before ~MNT_WRITE_HOLD, so writers 526 * that become unheld will see MNT_READONLY. 527 */ 528 smp_wmb(); 529 mnt->mnt.mnt_flags &= ~MNT_WRITE_HOLD; 530 unlock_mount_hash(); 531 return ret; 532 } 533 534 static void __mnt_unmake_readonly(struct mount *mnt) 535 { 536 lock_mount_hash(); 537 mnt->mnt.mnt_flags &= ~MNT_READONLY; 538 unlock_mount_hash(); 539 } 540 541 int sb_prepare_remount_readonly(struct super_block *sb) 542 { 543 struct mount *mnt; 544 int err = 0; 545 546 /* Racy optimization. Recheck the counter under MNT_WRITE_HOLD */ 547 if (atomic_long_read(&sb->s_remove_count)) 548 return -EBUSY; 549 550 lock_mount_hash(); 551 list_for_each_entry(mnt, &sb->s_mounts, mnt_instance) { 552 if (!(mnt->mnt.mnt_flags & MNT_READONLY)) { 553 mnt->mnt.mnt_flags |= MNT_WRITE_HOLD; 554 smp_mb(); 555 if (mnt_get_writers(mnt) > 0) { 556 err = -EBUSY; 557 break; 558 } 559 } 560 } 561 if (!err && atomic_long_read(&sb->s_remove_count)) 562 err = -EBUSY; 563 564 if (!err) { 565 sb->s_readonly_remount = 1; 566 smp_wmb(); 567 } 568 list_for_each_entry(mnt, &sb->s_mounts, mnt_instance) { 569 if (mnt->mnt.mnt_flags & MNT_WRITE_HOLD) 570 mnt->mnt.mnt_flags &= ~MNT_WRITE_HOLD; 571 } 572 unlock_mount_hash(); 573 574 return err; 575 } 576 577 static void free_vfsmnt(struct mount *mnt) 578 { 579 kfree_const(mnt->mnt_devname); 580 #ifdef CONFIG_SMP 581 free_percpu(mnt->mnt_pcp); 582 #endif 583 kmem_cache_free(mnt_cache, mnt); 584 } 585 586 static void delayed_free_vfsmnt(struct rcu_head *head) 587 { 588 free_vfsmnt(container_of(head, struct mount, mnt_rcu)); 589 } 590 591 /* call under rcu_read_lock */ 592 int __legitimize_mnt(struct vfsmount *bastard, unsigned seq) 593 { 594 struct mount *mnt; 595 if (read_seqretry(&mount_lock, seq)) 596 return 1; 597 if (bastard == NULL) 598 return 0; 599 mnt = real_mount(bastard); 600 mnt_add_count(mnt, 1); 601 if (likely(!read_seqretry(&mount_lock, seq))) 602 return 0; 603 if (bastard->mnt_flags & MNT_SYNC_UMOUNT) { 604 mnt_add_count(mnt, -1); 605 return 1; 606 } 607 return -1; 608 } 609 610 /* call under rcu_read_lock */ 611 bool legitimize_mnt(struct vfsmount *bastard, unsigned seq) 612 { 613 int res = __legitimize_mnt(bastard, seq); 614 if (likely(!res)) 615 return true; 616 if (unlikely(res < 0)) { 617 rcu_read_unlock(); 618 mntput(bastard); 619 rcu_read_lock(); 620 } 621 return false; 622 } 623 624 /* 625 * find the first mount at @dentry on vfsmount @mnt. 626 * call under rcu_read_lock() 627 */ 628 struct mount *__lookup_mnt(struct vfsmount *mnt, struct dentry *dentry) 629 { 630 struct hlist_head *head = m_hash(mnt, dentry); 631 struct mount *p; 632 633 hlist_for_each_entry_rcu(p, head, mnt_hash) 634 if (&p->mnt_parent->mnt == mnt && p->mnt_mountpoint == dentry) 635 return p; 636 return NULL; 637 } 638 639 /* 640 * lookup_mnt - Return the first child mount mounted at path 641 * 642 * "First" means first mounted chronologically. If you create the 643 * following mounts: 644 * 645 * mount /dev/sda1 /mnt 646 * mount /dev/sda2 /mnt 647 * mount /dev/sda3 /mnt 648 * 649 * Then lookup_mnt() on the base /mnt dentry in the root mount will 650 * return successively the root dentry and vfsmount of /dev/sda1, then 651 * /dev/sda2, then /dev/sda3, then NULL. 652 * 653 * lookup_mnt takes a reference to the found vfsmount. 654 */ 655 struct vfsmount *lookup_mnt(const struct path *path) 656 { 657 struct mount *child_mnt; 658 struct vfsmount *m; 659 unsigned seq; 660 661 rcu_read_lock(); 662 do { 663 seq = read_seqbegin(&mount_lock); 664 child_mnt = __lookup_mnt(path->mnt, path->dentry); 665 m = child_mnt ? &child_mnt->mnt : NULL; 666 } while (!legitimize_mnt(m, seq)); 667 rcu_read_unlock(); 668 return m; 669 } 670 671 /* 672 * __is_local_mountpoint - Test to see if dentry is a mountpoint in the 673 * current mount namespace. 674 * 675 * The common case is dentries are not mountpoints at all and that 676 * test is handled inline. For the slow case when we are actually 677 * dealing with a mountpoint of some kind, walk through all of the 678 * mounts in the current mount namespace and test to see if the dentry 679 * is a mountpoint. 680 * 681 * The mount_hashtable is not usable in the context because we 682 * need to identify all mounts that may be in the current mount 683 * namespace not just a mount that happens to have some specified 684 * parent mount. 685 */ 686 bool __is_local_mountpoint(struct dentry *dentry) 687 { 688 struct mnt_namespace *ns = current->nsproxy->mnt_ns; 689 struct mount *mnt; 690 bool is_covered = false; 691 692 if (!d_mountpoint(dentry)) 693 goto out; 694 695 down_read(&namespace_sem); 696 list_for_each_entry(mnt, &ns->list, mnt_list) { 697 is_covered = (mnt->mnt_mountpoint == dentry); 698 if (is_covered) 699 break; 700 } 701 up_read(&namespace_sem); 702 out: 703 return is_covered; 704 } 705 706 static struct mountpoint *lookup_mountpoint(struct dentry *dentry) 707 { 708 struct hlist_head *chain = mp_hash(dentry); 709 struct mountpoint *mp; 710 711 hlist_for_each_entry(mp, chain, m_hash) { 712 if (mp->m_dentry == dentry) { 713 /* might be worth a WARN_ON() */ 714 if (d_unlinked(dentry)) 715 return ERR_PTR(-ENOENT); 716 mp->m_count++; 717 return mp; 718 } 719 } 720 return NULL; 721 } 722 723 static struct mountpoint *get_mountpoint(struct dentry *dentry) 724 { 725 struct mountpoint *mp, *new = NULL; 726 int ret; 727 728 if (d_mountpoint(dentry)) { 729 mountpoint: 730 read_seqlock_excl(&mount_lock); 731 mp = lookup_mountpoint(dentry); 732 read_sequnlock_excl(&mount_lock); 733 if (mp) 734 goto done; 735 } 736 737 if (!new) 738 new = kmalloc(sizeof(struct mountpoint), GFP_KERNEL); 739 if (!new) 740 return ERR_PTR(-ENOMEM); 741 742 743 /* Exactly one processes may set d_mounted */ 744 ret = d_set_mounted(dentry); 745 746 /* Someone else set d_mounted? */ 747 if (ret == -EBUSY) 748 goto mountpoint; 749 750 /* The dentry is not available as a mountpoint? */ 751 mp = ERR_PTR(ret); 752 if (ret) 753 goto done; 754 755 /* Add the new mountpoint to the hash table */ 756 read_seqlock_excl(&mount_lock); 757 new->m_dentry = dentry; 758 new->m_count = 1; 759 hlist_add_head(&new->m_hash, mp_hash(dentry)); 760 INIT_HLIST_HEAD(&new->m_list); 761 read_sequnlock_excl(&mount_lock); 762 763 mp = new; 764 new = NULL; 765 done: 766 kfree(new); 767 return mp; 768 } 769 770 static void put_mountpoint(struct mountpoint *mp) 771 { 772 if (!--mp->m_count) { 773 struct dentry *dentry = mp->m_dentry; 774 BUG_ON(!hlist_empty(&mp->m_list)); 775 spin_lock(&dentry->d_lock); 776 dentry->d_flags &= ~DCACHE_MOUNTED; 777 spin_unlock(&dentry->d_lock); 778 hlist_del(&mp->m_hash); 779 kfree(mp); 780 } 781 } 782 783 static inline int check_mnt(struct mount *mnt) 784 { 785 return mnt->mnt_ns == current->nsproxy->mnt_ns; 786 } 787 788 /* 789 * vfsmount lock must be held for write 790 */ 791 static void touch_mnt_namespace(struct mnt_namespace *ns) 792 { 793 if (ns) { 794 ns->event = ++event; 795 wake_up_interruptible(&ns->poll); 796 } 797 } 798 799 /* 800 * vfsmount lock must be held for write 801 */ 802 static void __touch_mnt_namespace(struct mnt_namespace *ns) 803 { 804 if (ns && ns->event != event) { 805 ns->event = event; 806 wake_up_interruptible(&ns->poll); 807 } 808 } 809 810 /* 811 * vfsmount lock must be held for write 812 */ 813 static void unhash_mnt(struct mount *mnt) 814 { 815 mnt->mnt_parent = mnt; 816 mnt->mnt_mountpoint = mnt->mnt.mnt_root; 817 list_del_init(&mnt->mnt_child); 818 hlist_del_init_rcu(&mnt->mnt_hash); 819 hlist_del_init(&mnt->mnt_mp_list); 820 put_mountpoint(mnt->mnt_mp); 821 mnt->mnt_mp = NULL; 822 } 823 824 /* 825 * vfsmount lock must be held for write 826 */ 827 static void detach_mnt(struct mount *mnt, struct path *old_path) 828 { 829 old_path->dentry = mnt->mnt_mountpoint; 830 old_path->mnt = &mnt->mnt_parent->mnt; 831 unhash_mnt(mnt); 832 } 833 834 /* 835 * vfsmount lock must be held for write 836 */ 837 static void umount_mnt(struct mount *mnt) 838 { 839 /* old mountpoint will be dropped when we can do that */ 840 mnt->mnt_ex_mountpoint = mnt->mnt_mountpoint; 841 unhash_mnt(mnt); 842 } 843 844 /* 845 * vfsmount lock must be held for write 846 */ 847 void mnt_set_mountpoint(struct mount *mnt, 848 struct mountpoint *mp, 849 struct mount *child_mnt) 850 { 851 mp->m_count++; 852 mnt_add_count(mnt, 1); /* essentially, that's mntget */ 853 child_mnt->mnt_mountpoint = dget(mp->m_dentry); 854 child_mnt->mnt_parent = mnt; 855 child_mnt->mnt_mp = mp; 856 hlist_add_head(&child_mnt->mnt_mp_list, &mp->m_list); 857 } 858 859 static void __attach_mnt(struct mount *mnt, struct mount *parent) 860 { 861 hlist_add_head_rcu(&mnt->mnt_hash, 862 m_hash(&parent->mnt, mnt->mnt_mountpoint)); 863 list_add_tail(&mnt->mnt_child, &parent->mnt_mounts); 864 } 865 866 /* 867 * vfsmount lock must be held for write 868 */ 869 static void attach_mnt(struct mount *mnt, 870 struct mount *parent, 871 struct mountpoint *mp) 872 { 873 mnt_set_mountpoint(parent, mp, mnt); 874 __attach_mnt(mnt, parent); 875 } 876 877 void mnt_change_mountpoint(struct mount *parent, struct mountpoint *mp, struct mount *mnt) 878 { 879 struct mountpoint *old_mp = mnt->mnt_mp; 880 struct dentry *old_mountpoint = mnt->mnt_mountpoint; 881 struct mount *old_parent = mnt->mnt_parent; 882 883 list_del_init(&mnt->mnt_child); 884 hlist_del_init(&mnt->mnt_mp_list); 885 hlist_del_init_rcu(&mnt->mnt_hash); 886 887 attach_mnt(mnt, parent, mp); 888 889 put_mountpoint(old_mp); 890 891 /* 892 * Safely avoid even the suggestion this code might sleep or 893 * lock the mount hash by taking advantage of the knowledge that 894 * mnt_change_mountpoint will not release the final reference 895 * to a mountpoint. 896 * 897 * During mounting, the mount passed in as the parent mount will 898 * continue to use the old mountpoint and during unmounting, the 899 * old mountpoint will continue to exist until namespace_unlock, 900 * which happens well after mnt_change_mountpoint. 901 */ 902 spin_lock(&old_mountpoint->d_lock); 903 old_mountpoint->d_lockref.count--; 904 spin_unlock(&old_mountpoint->d_lock); 905 906 mnt_add_count(old_parent, -1); 907 } 908 909 /* 910 * vfsmount lock must be held for write 911 */ 912 static void commit_tree(struct mount *mnt) 913 { 914 struct mount *parent = mnt->mnt_parent; 915 struct mount *m; 916 LIST_HEAD(head); 917 struct mnt_namespace *n = parent->mnt_ns; 918 919 BUG_ON(parent == mnt); 920 921 list_add_tail(&head, &mnt->mnt_list); 922 list_for_each_entry(m, &head, mnt_list) 923 m->mnt_ns = n; 924 925 list_splice(&head, n->list.prev); 926 927 n->mounts += n->pending_mounts; 928 n->pending_mounts = 0; 929 930 __attach_mnt(mnt, parent); 931 touch_mnt_namespace(n); 932 } 933 934 static struct mount *next_mnt(struct mount *p, struct mount *root) 935 { 936 struct list_head *next = p->mnt_mounts.next; 937 if (next == &p->mnt_mounts) { 938 while (1) { 939 if (p == root) 940 return NULL; 941 next = p->mnt_child.next; 942 if (next != &p->mnt_parent->mnt_mounts) 943 break; 944 p = p->mnt_parent; 945 } 946 } 947 return list_entry(next, struct mount, mnt_child); 948 } 949 950 static struct mount *skip_mnt_tree(struct mount *p) 951 { 952 struct list_head *prev = p->mnt_mounts.prev; 953 while (prev != &p->mnt_mounts) { 954 p = list_entry(prev, struct mount, mnt_child); 955 prev = p->mnt_mounts.prev; 956 } 957 return p; 958 } 959 960 struct vfsmount * 961 vfs_kern_mount(struct file_system_type *type, int flags, const char *name, void *data) 962 { 963 struct mount *mnt; 964 struct dentry *root; 965 966 if (!type) 967 return ERR_PTR(-ENODEV); 968 969 mnt = alloc_vfsmnt(name); 970 if (!mnt) 971 return ERR_PTR(-ENOMEM); 972 973 if (flags & MS_KERNMOUNT) 974 mnt->mnt.mnt_flags = MNT_INTERNAL; 975 976 root = mount_fs(type, flags, name, data); 977 if (IS_ERR(root)) { 978 mnt_free_id(mnt); 979 free_vfsmnt(mnt); 980 return ERR_CAST(root); 981 } 982 983 mnt->mnt.mnt_root = root; 984 mnt->mnt.mnt_sb = root->d_sb; 985 mnt->mnt_mountpoint = mnt->mnt.mnt_root; 986 mnt->mnt_parent = mnt; 987 lock_mount_hash(); 988 list_add_tail(&mnt->mnt_instance, &root->d_sb->s_mounts); 989 unlock_mount_hash(); 990 return &mnt->mnt; 991 } 992 EXPORT_SYMBOL_GPL(vfs_kern_mount); 993 994 struct vfsmount * 995 vfs_submount(const struct dentry *mountpoint, struct file_system_type *type, 996 const char *name, void *data) 997 { 998 /* Until it is worked out how to pass the user namespace 999 * through from the parent mount to the submount don't support 1000 * unprivileged mounts with submounts. 1001 */ 1002 if (mountpoint->d_sb->s_user_ns != &init_user_ns) 1003 return ERR_PTR(-EPERM); 1004 1005 return vfs_kern_mount(type, MS_SUBMOUNT, name, data); 1006 } 1007 EXPORT_SYMBOL_GPL(vfs_submount); 1008 1009 static struct mount *clone_mnt(struct mount *old, struct dentry *root, 1010 int flag) 1011 { 1012 struct super_block *sb = old->mnt.mnt_sb; 1013 struct mount *mnt; 1014 int err; 1015 1016 mnt = alloc_vfsmnt(old->mnt_devname); 1017 if (!mnt) 1018 return ERR_PTR(-ENOMEM); 1019 1020 if (flag & (CL_SLAVE | CL_PRIVATE | CL_SHARED_TO_SLAVE)) 1021 mnt->mnt_group_id = 0; /* not a peer of original */ 1022 else 1023 mnt->mnt_group_id = old->mnt_group_id; 1024 1025 if ((flag & CL_MAKE_SHARED) && !mnt->mnt_group_id) { 1026 err = mnt_alloc_group_id(mnt); 1027 if (err) 1028 goto out_free; 1029 } 1030 1031 mnt->mnt.mnt_flags = old->mnt.mnt_flags & ~(MNT_WRITE_HOLD|MNT_MARKED); 1032 /* Don't allow unprivileged users to change mount flags */ 1033 if (flag & CL_UNPRIVILEGED) { 1034 mnt->mnt.mnt_flags |= MNT_LOCK_ATIME; 1035 1036 if (mnt->mnt.mnt_flags & MNT_READONLY) 1037 mnt->mnt.mnt_flags |= MNT_LOCK_READONLY; 1038 1039 if (mnt->mnt.mnt_flags & MNT_NODEV) 1040 mnt->mnt.mnt_flags |= MNT_LOCK_NODEV; 1041 1042 if (mnt->mnt.mnt_flags & MNT_NOSUID) 1043 mnt->mnt.mnt_flags |= MNT_LOCK_NOSUID; 1044 1045 if (mnt->mnt.mnt_flags & MNT_NOEXEC) 1046 mnt->mnt.mnt_flags |= MNT_LOCK_NOEXEC; 1047 } 1048 1049 /* Don't allow unprivileged users to reveal what is under a mount */ 1050 if ((flag & CL_UNPRIVILEGED) && 1051 (!(flag & CL_EXPIRE) || list_empty(&old->mnt_expire))) 1052 mnt->mnt.mnt_flags |= MNT_LOCKED; 1053 1054 atomic_inc(&sb->s_active); 1055 mnt->mnt.mnt_sb = sb; 1056 mnt->mnt.mnt_root = dget(root); 1057 mnt->mnt_mountpoint = mnt->mnt.mnt_root; 1058 mnt->mnt_parent = mnt; 1059 lock_mount_hash(); 1060 list_add_tail(&mnt->mnt_instance, &sb->s_mounts); 1061 unlock_mount_hash(); 1062 1063 if ((flag & CL_SLAVE) || 1064 ((flag & CL_SHARED_TO_SLAVE) && IS_MNT_SHARED(old))) { 1065 list_add(&mnt->mnt_slave, &old->mnt_slave_list); 1066 mnt->mnt_master = old; 1067 CLEAR_MNT_SHARED(mnt); 1068 } else if (!(flag & CL_PRIVATE)) { 1069 if ((flag & CL_MAKE_SHARED) || IS_MNT_SHARED(old)) 1070 list_add(&mnt->mnt_share, &old->mnt_share); 1071 if (IS_MNT_SLAVE(old)) 1072 list_add(&mnt->mnt_slave, &old->mnt_slave); 1073 mnt->mnt_master = old->mnt_master; 1074 } else { 1075 CLEAR_MNT_SHARED(mnt); 1076 } 1077 if (flag & CL_MAKE_SHARED) 1078 set_mnt_shared(mnt); 1079 1080 /* stick the duplicate mount on the same expiry list 1081 * as the original if that was on one */ 1082 if (flag & CL_EXPIRE) { 1083 if (!list_empty(&old->mnt_expire)) 1084 list_add(&mnt->mnt_expire, &old->mnt_expire); 1085 } 1086 1087 return mnt; 1088 1089 out_free: 1090 mnt_free_id(mnt); 1091 free_vfsmnt(mnt); 1092 return ERR_PTR(err); 1093 } 1094 1095 static void cleanup_mnt(struct mount *mnt) 1096 { 1097 /* 1098 * This probably indicates that somebody messed 1099 * up a mnt_want/drop_write() pair. If this 1100 * happens, the filesystem was probably unable 1101 * to make r/w->r/o transitions. 1102 */ 1103 /* 1104 * The locking used to deal with mnt_count decrement provides barriers, 1105 * so mnt_get_writers() below is safe. 1106 */ 1107 WARN_ON(mnt_get_writers(mnt)); 1108 if (unlikely(mnt->mnt_pins.first)) 1109 mnt_pin_kill(mnt); 1110 fsnotify_vfsmount_delete(&mnt->mnt); 1111 dput(mnt->mnt.mnt_root); 1112 deactivate_super(mnt->mnt.mnt_sb); 1113 mnt_free_id(mnt); 1114 call_rcu(&mnt->mnt_rcu, delayed_free_vfsmnt); 1115 } 1116 1117 static void __cleanup_mnt(struct rcu_head *head) 1118 { 1119 cleanup_mnt(container_of(head, struct mount, mnt_rcu)); 1120 } 1121 1122 static LLIST_HEAD(delayed_mntput_list); 1123 static void delayed_mntput(struct work_struct *unused) 1124 { 1125 struct llist_node *node = llist_del_all(&delayed_mntput_list); 1126 struct llist_node *next; 1127 1128 for (; node; node = next) { 1129 next = llist_next(node); 1130 cleanup_mnt(llist_entry(node, struct mount, mnt_llist)); 1131 } 1132 } 1133 static DECLARE_DELAYED_WORK(delayed_mntput_work, delayed_mntput); 1134 1135 static void mntput_no_expire(struct mount *mnt) 1136 { 1137 rcu_read_lock(); 1138 mnt_add_count(mnt, -1); 1139 if (likely(mnt->mnt_ns)) { /* shouldn't be the last one */ 1140 rcu_read_unlock(); 1141 return; 1142 } 1143 lock_mount_hash(); 1144 if (mnt_get_count(mnt)) { 1145 rcu_read_unlock(); 1146 unlock_mount_hash(); 1147 return; 1148 } 1149 if (unlikely(mnt->mnt.mnt_flags & MNT_DOOMED)) { 1150 rcu_read_unlock(); 1151 unlock_mount_hash(); 1152 return; 1153 } 1154 mnt->mnt.mnt_flags |= MNT_DOOMED; 1155 rcu_read_unlock(); 1156 1157 list_del(&mnt->mnt_instance); 1158 1159 if (unlikely(!list_empty(&mnt->mnt_mounts))) { 1160 struct mount *p, *tmp; 1161 list_for_each_entry_safe(p, tmp, &mnt->mnt_mounts, mnt_child) { 1162 umount_mnt(p); 1163 } 1164 } 1165 unlock_mount_hash(); 1166 1167 if (likely(!(mnt->mnt.mnt_flags & MNT_INTERNAL))) { 1168 struct task_struct *task = current; 1169 if (likely(!(task->flags & PF_KTHREAD))) { 1170 init_task_work(&mnt->mnt_rcu, __cleanup_mnt); 1171 if (!task_work_add(task, &mnt->mnt_rcu, true)) 1172 return; 1173 } 1174 if (llist_add(&mnt->mnt_llist, &delayed_mntput_list)) 1175 schedule_delayed_work(&delayed_mntput_work, 1); 1176 return; 1177 } 1178 cleanup_mnt(mnt); 1179 } 1180 1181 void mntput(struct vfsmount *mnt) 1182 { 1183 if (mnt) { 1184 struct mount *m = real_mount(mnt); 1185 /* avoid cacheline pingpong, hope gcc doesn't get "smart" */ 1186 if (unlikely(m->mnt_expiry_mark)) 1187 m->mnt_expiry_mark = 0; 1188 mntput_no_expire(m); 1189 } 1190 } 1191 EXPORT_SYMBOL(mntput); 1192 1193 struct vfsmount *mntget(struct vfsmount *mnt) 1194 { 1195 if (mnt) 1196 mnt_add_count(real_mount(mnt), 1); 1197 return mnt; 1198 } 1199 EXPORT_SYMBOL(mntget); 1200 1201 /* path_is_mountpoint() - Check if path is a mount in the current 1202 * namespace. 1203 * 1204 * d_mountpoint() can only be used reliably to establish if a dentry is 1205 * not mounted in any namespace and that common case is handled inline. 1206 * d_mountpoint() isn't aware of the possibility there may be multiple 1207 * mounts using a given dentry in a different namespace. This function 1208 * checks if the passed in path is a mountpoint rather than the dentry 1209 * alone. 1210 */ 1211 bool path_is_mountpoint(const struct path *path) 1212 { 1213 unsigned seq; 1214 bool res; 1215 1216 if (!d_mountpoint(path->dentry)) 1217 return false; 1218 1219 rcu_read_lock(); 1220 do { 1221 seq = read_seqbegin(&mount_lock); 1222 res = __path_is_mountpoint(path); 1223 } while (read_seqretry(&mount_lock, seq)); 1224 rcu_read_unlock(); 1225 1226 return res; 1227 } 1228 EXPORT_SYMBOL(path_is_mountpoint); 1229 1230 struct vfsmount *mnt_clone_internal(const struct path *path) 1231 { 1232 struct mount *p; 1233 p = clone_mnt(real_mount(path->mnt), path->dentry, CL_PRIVATE); 1234 if (IS_ERR(p)) 1235 return ERR_CAST(p); 1236 p->mnt.mnt_flags |= MNT_INTERNAL; 1237 return &p->mnt; 1238 } 1239 1240 static inline void mangle(struct seq_file *m, const char *s) 1241 { 1242 seq_escape(m, s, " \t\n\\"); 1243 } 1244 1245 /* 1246 * Simple .show_options callback for filesystems which don't want to 1247 * implement more complex mount option showing. 1248 * 1249 * See also save_mount_options(). 1250 */ 1251 int generic_show_options(struct seq_file *m, struct dentry *root) 1252 { 1253 const char *options; 1254 1255 rcu_read_lock(); 1256 options = rcu_dereference(root->d_sb->s_options); 1257 1258 if (options != NULL && options[0]) { 1259 seq_putc(m, ','); 1260 mangle(m, options); 1261 } 1262 rcu_read_unlock(); 1263 1264 return 0; 1265 } 1266 EXPORT_SYMBOL(generic_show_options); 1267 1268 /* 1269 * If filesystem uses generic_show_options(), this function should be 1270 * called from the fill_super() callback. 1271 * 1272 * The .remount_fs callback usually needs to be handled in a special 1273 * way, to make sure, that previous options are not overwritten if the 1274 * remount fails. 1275 * 1276 * Also note, that if the filesystem's .remount_fs function doesn't 1277 * reset all options to their default value, but changes only newly 1278 * given options, then the displayed options will not reflect reality 1279 * any more. 1280 */ 1281 void save_mount_options(struct super_block *sb, char *options) 1282 { 1283 BUG_ON(sb->s_options); 1284 rcu_assign_pointer(sb->s_options, kstrdup(options, GFP_KERNEL)); 1285 } 1286 EXPORT_SYMBOL(save_mount_options); 1287 1288 void replace_mount_options(struct super_block *sb, char *options) 1289 { 1290 char *old = sb->s_options; 1291 rcu_assign_pointer(sb->s_options, options); 1292 if (old) { 1293 synchronize_rcu(); 1294 kfree(old); 1295 } 1296 } 1297 EXPORT_SYMBOL(replace_mount_options); 1298 1299 #ifdef CONFIG_PROC_FS 1300 /* iterator; we want it to have access to namespace_sem, thus here... */ 1301 static void *m_start(struct seq_file *m, loff_t *pos) 1302 { 1303 struct proc_mounts *p = m->private; 1304 1305 down_read(&namespace_sem); 1306 if (p->cached_event == p->ns->event) { 1307 void *v = p->cached_mount; 1308 if (*pos == p->cached_index) 1309 return v; 1310 if (*pos == p->cached_index + 1) { 1311 v = seq_list_next(v, &p->ns->list, &p->cached_index); 1312 return p->cached_mount = v; 1313 } 1314 } 1315 1316 p->cached_event = p->ns->event; 1317 p->cached_mount = seq_list_start(&p->ns->list, *pos); 1318 p->cached_index = *pos; 1319 return p->cached_mount; 1320 } 1321 1322 static void *m_next(struct seq_file *m, void *v, loff_t *pos) 1323 { 1324 struct proc_mounts *p = m->private; 1325 1326 p->cached_mount = seq_list_next(v, &p->ns->list, pos); 1327 p->cached_index = *pos; 1328 return p->cached_mount; 1329 } 1330 1331 static void m_stop(struct seq_file *m, void *v) 1332 { 1333 up_read(&namespace_sem); 1334 } 1335 1336 static int m_show(struct seq_file *m, void *v) 1337 { 1338 struct proc_mounts *p = m->private; 1339 struct mount *r = list_entry(v, struct mount, mnt_list); 1340 return p->show(m, &r->mnt); 1341 } 1342 1343 const struct seq_operations mounts_op = { 1344 .start = m_start, 1345 .next = m_next, 1346 .stop = m_stop, 1347 .show = m_show, 1348 }; 1349 #endif /* CONFIG_PROC_FS */ 1350 1351 /** 1352 * may_umount_tree - check if a mount tree is busy 1353 * @mnt: root of mount tree 1354 * 1355 * This is called to check if a tree of mounts has any 1356 * open files, pwds, chroots or sub mounts that are 1357 * busy. 1358 */ 1359 int may_umount_tree(struct vfsmount *m) 1360 { 1361 struct mount *mnt = real_mount(m); 1362 int actual_refs = 0; 1363 int minimum_refs = 0; 1364 struct mount *p; 1365 BUG_ON(!m); 1366 1367 /* write lock needed for mnt_get_count */ 1368 lock_mount_hash(); 1369 for (p = mnt; p; p = next_mnt(p, mnt)) { 1370 actual_refs += mnt_get_count(p); 1371 minimum_refs += 2; 1372 } 1373 unlock_mount_hash(); 1374 1375 if (actual_refs > minimum_refs) 1376 return 0; 1377 1378 return 1; 1379 } 1380 1381 EXPORT_SYMBOL(may_umount_tree); 1382 1383 /** 1384 * may_umount - check if a mount point is busy 1385 * @mnt: root of mount 1386 * 1387 * This is called to check if a mount point has any 1388 * open files, pwds, chroots or sub mounts. If the 1389 * mount has sub mounts this will return busy 1390 * regardless of whether the sub mounts are busy. 1391 * 1392 * Doesn't take quota and stuff into account. IOW, in some cases it will 1393 * give false negatives. The main reason why it's here is that we need 1394 * a non-destructive way to look for easily umountable filesystems. 1395 */ 1396 int may_umount(struct vfsmount *mnt) 1397 { 1398 int ret = 1; 1399 down_read(&namespace_sem); 1400 lock_mount_hash(); 1401 if (propagate_mount_busy(real_mount(mnt), 2)) 1402 ret = 0; 1403 unlock_mount_hash(); 1404 up_read(&namespace_sem); 1405 return ret; 1406 } 1407 1408 EXPORT_SYMBOL(may_umount); 1409 1410 static HLIST_HEAD(unmounted); /* protected by namespace_sem */ 1411 1412 static void namespace_unlock(void) 1413 { 1414 struct hlist_head head; 1415 1416 hlist_move_list(&unmounted, &head); 1417 1418 up_write(&namespace_sem); 1419 1420 if (likely(hlist_empty(&head))) 1421 return; 1422 1423 synchronize_rcu(); 1424 1425 group_pin_kill(&head); 1426 } 1427 1428 static inline void namespace_lock(void) 1429 { 1430 down_write(&namespace_sem); 1431 } 1432 1433 enum umount_tree_flags { 1434 UMOUNT_SYNC = 1, 1435 UMOUNT_PROPAGATE = 2, 1436 UMOUNT_CONNECTED = 4, 1437 }; 1438 1439 static bool disconnect_mount(struct mount *mnt, enum umount_tree_flags how) 1440 { 1441 /* Leaving mounts connected is only valid for lazy umounts */ 1442 if (how & UMOUNT_SYNC) 1443 return true; 1444 1445 /* A mount without a parent has nothing to be connected to */ 1446 if (!mnt_has_parent(mnt)) 1447 return true; 1448 1449 /* Because the reference counting rules change when mounts are 1450 * unmounted and connected, umounted mounts may not be 1451 * connected to mounted mounts. 1452 */ 1453 if (!(mnt->mnt_parent->mnt.mnt_flags & MNT_UMOUNT)) 1454 return true; 1455 1456 /* Has it been requested that the mount remain connected? */ 1457 if (how & UMOUNT_CONNECTED) 1458 return false; 1459 1460 /* Is the mount locked such that it needs to remain connected? */ 1461 if (IS_MNT_LOCKED(mnt)) 1462 return false; 1463 1464 /* By default disconnect the mount */ 1465 return true; 1466 } 1467 1468 /* 1469 * mount_lock must be held 1470 * namespace_sem must be held for write 1471 */ 1472 static void umount_tree(struct mount *mnt, enum umount_tree_flags how) 1473 { 1474 LIST_HEAD(tmp_list); 1475 struct mount *p; 1476 1477 if (how & UMOUNT_PROPAGATE) 1478 propagate_mount_unlock(mnt); 1479 1480 /* Gather the mounts to umount */ 1481 for (p = mnt; p; p = next_mnt(p, mnt)) { 1482 p->mnt.mnt_flags |= MNT_UMOUNT; 1483 list_move(&p->mnt_list, &tmp_list); 1484 } 1485 1486 /* Hide the mounts from mnt_mounts */ 1487 list_for_each_entry(p, &tmp_list, mnt_list) { 1488 list_del_init(&p->mnt_child); 1489 } 1490 1491 /* Add propogated mounts to the tmp_list */ 1492 if (how & UMOUNT_PROPAGATE) 1493 propagate_umount(&tmp_list); 1494 1495 while (!list_empty(&tmp_list)) { 1496 struct mnt_namespace *ns; 1497 bool disconnect; 1498 p = list_first_entry(&tmp_list, struct mount, mnt_list); 1499 list_del_init(&p->mnt_expire); 1500 list_del_init(&p->mnt_list); 1501 ns = p->mnt_ns; 1502 if (ns) { 1503 ns->mounts--; 1504 __touch_mnt_namespace(ns); 1505 } 1506 p->mnt_ns = NULL; 1507 if (how & UMOUNT_SYNC) 1508 p->mnt.mnt_flags |= MNT_SYNC_UMOUNT; 1509 1510 disconnect = disconnect_mount(p, how); 1511 1512 pin_insert_group(&p->mnt_umount, &p->mnt_parent->mnt, 1513 disconnect ? &unmounted : NULL); 1514 if (mnt_has_parent(p)) { 1515 mnt_add_count(p->mnt_parent, -1); 1516 if (!disconnect) { 1517 /* Don't forget about p */ 1518 list_add_tail(&p->mnt_child, &p->mnt_parent->mnt_mounts); 1519 } else { 1520 umount_mnt(p); 1521 } 1522 } 1523 change_mnt_propagation(p, MS_PRIVATE); 1524 } 1525 } 1526 1527 static void shrink_submounts(struct mount *mnt); 1528 1529 static int do_umount(struct mount *mnt, int flags) 1530 { 1531 struct super_block *sb = mnt->mnt.mnt_sb; 1532 int retval; 1533 1534 retval = security_sb_umount(&mnt->mnt, flags); 1535 if (retval) 1536 return retval; 1537 1538 /* 1539 * Allow userspace to request a mountpoint be expired rather than 1540 * unmounting unconditionally. Unmount only happens if: 1541 * (1) the mark is already set (the mark is cleared by mntput()) 1542 * (2) the usage count == 1 [parent vfsmount] + 1 [sys_umount] 1543 */ 1544 if (flags & MNT_EXPIRE) { 1545 if (&mnt->mnt == current->fs->root.mnt || 1546 flags & (MNT_FORCE | MNT_DETACH)) 1547 return -EINVAL; 1548 1549 /* 1550 * probably don't strictly need the lock here if we examined 1551 * all race cases, but it's a slowpath. 1552 */ 1553 lock_mount_hash(); 1554 if (mnt_get_count(mnt) != 2) { 1555 unlock_mount_hash(); 1556 return -EBUSY; 1557 } 1558 unlock_mount_hash(); 1559 1560 if (!xchg(&mnt->mnt_expiry_mark, 1)) 1561 return -EAGAIN; 1562 } 1563 1564 /* 1565 * If we may have to abort operations to get out of this 1566 * mount, and they will themselves hold resources we must 1567 * allow the fs to do things. In the Unix tradition of 1568 * 'Gee thats tricky lets do it in userspace' the umount_begin 1569 * might fail to complete on the first run through as other tasks 1570 * must return, and the like. Thats for the mount program to worry 1571 * about for the moment. 1572 */ 1573 1574 if (flags & MNT_FORCE && sb->s_op->umount_begin) { 1575 sb->s_op->umount_begin(sb); 1576 } 1577 1578 /* 1579 * No sense to grab the lock for this test, but test itself looks 1580 * somewhat bogus. Suggestions for better replacement? 1581 * Ho-hum... In principle, we might treat that as umount + switch 1582 * to rootfs. GC would eventually take care of the old vfsmount. 1583 * Actually it makes sense, especially if rootfs would contain a 1584 * /reboot - static binary that would close all descriptors and 1585 * call reboot(9). Then init(8) could umount root and exec /reboot. 1586 */ 1587 if (&mnt->mnt == current->fs->root.mnt && !(flags & MNT_DETACH)) { 1588 /* 1589 * Special case for "unmounting" root ... 1590 * we just try to remount it readonly. 1591 */ 1592 if (!capable(CAP_SYS_ADMIN)) 1593 return -EPERM; 1594 down_write(&sb->s_umount); 1595 if (!(sb->s_flags & MS_RDONLY)) 1596 retval = do_remount_sb(sb, MS_RDONLY, NULL, 0); 1597 up_write(&sb->s_umount); 1598 return retval; 1599 } 1600 1601 namespace_lock(); 1602 lock_mount_hash(); 1603 event++; 1604 1605 if (flags & MNT_DETACH) { 1606 if (!list_empty(&mnt->mnt_list)) 1607 umount_tree(mnt, UMOUNT_PROPAGATE); 1608 retval = 0; 1609 } else { 1610 shrink_submounts(mnt); 1611 retval = -EBUSY; 1612 if (!propagate_mount_busy(mnt, 2)) { 1613 if (!list_empty(&mnt->mnt_list)) 1614 umount_tree(mnt, UMOUNT_PROPAGATE|UMOUNT_SYNC); 1615 retval = 0; 1616 } 1617 } 1618 unlock_mount_hash(); 1619 namespace_unlock(); 1620 return retval; 1621 } 1622 1623 /* 1624 * __detach_mounts - lazily unmount all mounts on the specified dentry 1625 * 1626 * During unlink, rmdir, and d_drop it is possible to loose the path 1627 * to an existing mountpoint, and wind up leaking the mount. 1628 * detach_mounts allows lazily unmounting those mounts instead of 1629 * leaking them. 1630 * 1631 * The caller may hold dentry->d_inode->i_mutex. 1632 */ 1633 void __detach_mounts(struct dentry *dentry) 1634 { 1635 struct mountpoint *mp; 1636 struct mount *mnt; 1637 1638 namespace_lock(); 1639 lock_mount_hash(); 1640 mp = lookup_mountpoint(dentry); 1641 if (IS_ERR_OR_NULL(mp)) 1642 goto out_unlock; 1643 1644 event++; 1645 while (!hlist_empty(&mp->m_list)) { 1646 mnt = hlist_entry(mp->m_list.first, struct mount, mnt_mp_list); 1647 if (mnt->mnt.mnt_flags & MNT_UMOUNT) { 1648 hlist_add_head(&mnt->mnt_umount.s_list, &unmounted); 1649 umount_mnt(mnt); 1650 } 1651 else umount_tree(mnt, UMOUNT_CONNECTED); 1652 } 1653 put_mountpoint(mp); 1654 out_unlock: 1655 unlock_mount_hash(); 1656 namespace_unlock(); 1657 } 1658 1659 /* 1660 * Is the caller allowed to modify his namespace? 1661 */ 1662 static inline bool may_mount(void) 1663 { 1664 return ns_capable(current->nsproxy->mnt_ns->user_ns, CAP_SYS_ADMIN); 1665 } 1666 1667 static inline bool may_mandlock(void) 1668 { 1669 #ifndef CONFIG_MANDATORY_FILE_LOCKING 1670 return false; 1671 #endif 1672 return capable(CAP_SYS_ADMIN); 1673 } 1674 1675 /* 1676 * Now umount can handle mount points as well as block devices. 1677 * This is important for filesystems which use unnamed block devices. 1678 * 1679 * We now support a flag for forced unmount like the other 'big iron' 1680 * unixes. Our API is identical to OSF/1 to avoid making a mess of AMD 1681 */ 1682 1683 SYSCALL_DEFINE2(umount, char __user *, name, int, flags) 1684 { 1685 struct path path; 1686 struct mount *mnt; 1687 int retval; 1688 int lookup_flags = 0; 1689 1690 if (flags & ~(MNT_FORCE | MNT_DETACH | MNT_EXPIRE | UMOUNT_NOFOLLOW)) 1691 return -EINVAL; 1692 1693 if (!may_mount()) 1694 return -EPERM; 1695 1696 if (!(flags & UMOUNT_NOFOLLOW)) 1697 lookup_flags |= LOOKUP_FOLLOW; 1698 1699 retval = user_path_mountpoint_at(AT_FDCWD, name, lookup_flags, &path); 1700 if (retval) 1701 goto out; 1702 mnt = real_mount(path.mnt); 1703 retval = -EINVAL; 1704 if (path.dentry != path.mnt->mnt_root) 1705 goto dput_and_out; 1706 if (!check_mnt(mnt)) 1707 goto dput_and_out; 1708 if (mnt->mnt.mnt_flags & MNT_LOCKED) 1709 goto dput_and_out; 1710 retval = -EPERM; 1711 if (flags & MNT_FORCE && !capable(CAP_SYS_ADMIN)) 1712 goto dput_and_out; 1713 1714 retval = do_umount(mnt, flags); 1715 dput_and_out: 1716 /* we mustn't call path_put() as that would clear mnt_expiry_mark */ 1717 dput(path.dentry); 1718 mntput_no_expire(mnt); 1719 out: 1720 return retval; 1721 } 1722 1723 #ifdef __ARCH_WANT_SYS_OLDUMOUNT 1724 1725 /* 1726 * The 2.0 compatible umount. No flags. 1727 */ 1728 SYSCALL_DEFINE1(oldumount, char __user *, name) 1729 { 1730 return sys_umount(name, 0); 1731 } 1732 1733 #endif 1734 1735 static bool is_mnt_ns_file(struct dentry *dentry) 1736 { 1737 /* Is this a proxy for a mount namespace? */ 1738 return dentry->d_op == &ns_dentry_operations && 1739 dentry->d_fsdata == &mntns_operations; 1740 } 1741 1742 struct mnt_namespace *to_mnt_ns(struct ns_common *ns) 1743 { 1744 return container_of(ns, struct mnt_namespace, ns); 1745 } 1746 1747 static bool mnt_ns_loop(struct dentry *dentry) 1748 { 1749 /* Could bind mounting the mount namespace inode cause a 1750 * mount namespace loop? 1751 */ 1752 struct mnt_namespace *mnt_ns; 1753 if (!is_mnt_ns_file(dentry)) 1754 return false; 1755 1756 mnt_ns = to_mnt_ns(get_proc_ns(dentry->d_inode)); 1757 return current->nsproxy->mnt_ns->seq >= mnt_ns->seq; 1758 } 1759 1760 struct mount *copy_tree(struct mount *mnt, struct dentry *dentry, 1761 int flag) 1762 { 1763 struct mount *res, *p, *q, *r, *parent; 1764 1765 if (!(flag & CL_COPY_UNBINDABLE) && IS_MNT_UNBINDABLE(mnt)) 1766 return ERR_PTR(-EINVAL); 1767 1768 if (!(flag & CL_COPY_MNT_NS_FILE) && is_mnt_ns_file(dentry)) 1769 return ERR_PTR(-EINVAL); 1770 1771 res = q = clone_mnt(mnt, dentry, flag); 1772 if (IS_ERR(q)) 1773 return q; 1774 1775 q->mnt_mountpoint = mnt->mnt_mountpoint; 1776 1777 p = mnt; 1778 list_for_each_entry(r, &mnt->mnt_mounts, mnt_child) { 1779 struct mount *s; 1780 if (!is_subdir(r->mnt_mountpoint, dentry)) 1781 continue; 1782 1783 for (s = r; s; s = next_mnt(s, r)) { 1784 if (!(flag & CL_COPY_UNBINDABLE) && 1785 IS_MNT_UNBINDABLE(s)) { 1786 s = skip_mnt_tree(s); 1787 continue; 1788 } 1789 if (!(flag & CL_COPY_MNT_NS_FILE) && 1790 is_mnt_ns_file(s->mnt.mnt_root)) { 1791 s = skip_mnt_tree(s); 1792 continue; 1793 } 1794 while (p != s->mnt_parent) { 1795 p = p->mnt_parent; 1796 q = q->mnt_parent; 1797 } 1798 p = s; 1799 parent = q; 1800 q = clone_mnt(p, p->mnt.mnt_root, flag); 1801 if (IS_ERR(q)) 1802 goto out; 1803 lock_mount_hash(); 1804 list_add_tail(&q->mnt_list, &res->mnt_list); 1805 attach_mnt(q, parent, p->mnt_mp); 1806 unlock_mount_hash(); 1807 } 1808 } 1809 return res; 1810 out: 1811 if (res) { 1812 lock_mount_hash(); 1813 umount_tree(res, UMOUNT_SYNC); 1814 unlock_mount_hash(); 1815 } 1816 return q; 1817 } 1818 1819 /* Caller should check returned pointer for errors */ 1820 1821 struct vfsmount *collect_mounts(const struct path *path) 1822 { 1823 struct mount *tree; 1824 namespace_lock(); 1825 if (!check_mnt(real_mount(path->mnt))) 1826 tree = ERR_PTR(-EINVAL); 1827 else 1828 tree = copy_tree(real_mount(path->mnt), path->dentry, 1829 CL_COPY_ALL | CL_PRIVATE); 1830 namespace_unlock(); 1831 if (IS_ERR(tree)) 1832 return ERR_CAST(tree); 1833 return &tree->mnt; 1834 } 1835 1836 void drop_collected_mounts(struct vfsmount *mnt) 1837 { 1838 namespace_lock(); 1839 lock_mount_hash(); 1840 umount_tree(real_mount(mnt), UMOUNT_SYNC); 1841 unlock_mount_hash(); 1842 namespace_unlock(); 1843 } 1844 1845 /** 1846 * clone_private_mount - create a private clone of a path 1847 * 1848 * This creates a new vfsmount, which will be the clone of @path. The new will 1849 * not be attached anywhere in the namespace and will be private (i.e. changes 1850 * to the originating mount won't be propagated into this). 1851 * 1852 * Release with mntput(). 1853 */ 1854 struct vfsmount *clone_private_mount(const struct path *path) 1855 { 1856 struct mount *old_mnt = real_mount(path->mnt); 1857 struct mount *new_mnt; 1858 1859 if (IS_MNT_UNBINDABLE(old_mnt)) 1860 return ERR_PTR(-EINVAL); 1861 1862 new_mnt = clone_mnt(old_mnt, path->dentry, CL_PRIVATE); 1863 if (IS_ERR(new_mnt)) 1864 return ERR_CAST(new_mnt); 1865 1866 return &new_mnt->mnt; 1867 } 1868 EXPORT_SYMBOL_GPL(clone_private_mount); 1869 1870 int iterate_mounts(int (*f)(struct vfsmount *, void *), void *arg, 1871 struct vfsmount *root) 1872 { 1873 struct mount *mnt; 1874 int res = f(root, arg); 1875 if (res) 1876 return res; 1877 list_for_each_entry(mnt, &real_mount(root)->mnt_list, mnt_list) { 1878 res = f(&mnt->mnt, arg); 1879 if (res) 1880 return res; 1881 } 1882 return 0; 1883 } 1884 1885 static void cleanup_group_ids(struct mount *mnt, struct mount *end) 1886 { 1887 struct mount *p; 1888 1889 for (p = mnt; p != end; p = next_mnt(p, mnt)) { 1890 if (p->mnt_group_id && !IS_MNT_SHARED(p)) 1891 mnt_release_group_id(p); 1892 } 1893 } 1894 1895 static int invent_group_ids(struct mount *mnt, bool recurse) 1896 { 1897 struct mount *p; 1898 1899 for (p = mnt; p; p = recurse ? next_mnt(p, mnt) : NULL) { 1900 if (!p->mnt_group_id && !IS_MNT_SHARED(p)) { 1901 int err = mnt_alloc_group_id(p); 1902 if (err) { 1903 cleanup_group_ids(mnt, p); 1904 return err; 1905 } 1906 } 1907 } 1908 1909 return 0; 1910 } 1911 1912 int count_mounts(struct mnt_namespace *ns, struct mount *mnt) 1913 { 1914 unsigned int max = READ_ONCE(sysctl_mount_max); 1915 unsigned int mounts = 0, old, pending, sum; 1916 struct mount *p; 1917 1918 for (p = mnt; p; p = next_mnt(p, mnt)) 1919 mounts++; 1920 1921 old = ns->mounts; 1922 pending = ns->pending_mounts; 1923 sum = old + pending; 1924 if ((old > sum) || 1925 (pending > sum) || 1926 (max < sum) || 1927 (mounts > (max - sum))) 1928 return -ENOSPC; 1929 1930 ns->pending_mounts = pending + mounts; 1931 return 0; 1932 } 1933 1934 /* 1935 * @source_mnt : mount tree to be attached 1936 * @nd : place the mount tree @source_mnt is attached 1937 * @parent_nd : if non-null, detach the source_mnt from its parent and 1938 * store the parent mount and mountpoint dentry. 1939 * (done when source_mnt is moved) 1940 * 1941 * NOTE: in the table below explains the semantics when a source mount 1942 * of a given type is attached to a destination mount of a given type. 1943 * --------------------------------------------------------------------------- 1944 * | BIND MOUNT OPERATION | 1945 * |************************************************************************** 1946 * | source-->| shared | private | slave | unbindable | 1947 * | dest | | | | | 1948 * | | | | | | | 1949 * | v | | | | | 1950 * |************************************************************************** 1951 * | shared | shared (++) | shared (+) | shared(+++)| invalid | 1952 * | | | | | | 1953 * |non-shared| shared (+) | private | slave (*) | invalid | 1954 * *************************************************************************** 1955 * A bind operation clones the source mount and mounts the clone on the 1956 * destination mount. 1957 * 1958 * (++) the cloned mount is propagated to all the mounts in the propagation 1959 * tree of the destination mount and the cloned mount is added to 1960 * the peer group of the source mount. 1961 * (+) the cloned mount is created under the destination mount and is marked 1962 * as shared. The cloned mount is added to the peer group of the source 1963 * mount. 1964 * (+++) the mount is propagated to all the mounts in the propagation tree 1965 * of the destination mount and the cloned mount is made slave 1966 * of the same master as that of the source mount. The cloned mount 1967 * is marked as 'shared and slave'. 1968 * (*) the cloned mount is made a slave of the same master as that of the 1969 * source mount. 1970 * 1971 * --------------------------------------------------------------------------- 1972 * | MOVE MOUNT OPERATION | 1973 * |************************************************************************** 1974 * | source-->| shared | private | slave | unbindable | 1975 * | dest | | | | | 1976 * | | | | | | | 1977 * | v | | | | | 1978 * |************************************************************************** 1979 * | shared | shared (+) | shared (+) | shared(+++) | invalid | 1980 * | | | | | | 1981 * |non-shared| shared (+*) | private | slave (*) | unbindable | 1982 * *************************************************************************** 1983 * 1984 * (+) the mount is moved to the destination. And is then propagated to 1985 * all the mounts in the propagation tree of the destination mount. 1986 * (+*) the mount is moved to the destination. 1987 * (+++) the mount is moved to the destination and is then propagated to 1988 * all the mounts belonging to the destination mount's propagation tree. 1989 * the mount is marked as 'shared and slave'. 1990 * (*) the mount continues to be a slave at the new location. 1991 * 1992 * if the source mount is a tree, the operations explained above is 1993 * applied to each mount in the tree. 1994 * Must be called without spinlocks held, since this function can sleep 1995 * in allocations. 1996 */ 1997 static int attach_recursive_mnt(struct mount *source_mnt, 1998 struct mount *dest_mnt, 1999 struct mountpoint *dest_mp, 2000 struct path *parent_path) 2001 { 2002 HLIST_HEAD(tree_list); 2003 struct mnt_namespace *ns = dest_mnt->mnt_ns; 2004 struct mountpoint *smp; 2005 struct mount *child, *p; 2006 struct hlist_node *n; 2007 int err; 2008 2009 /* Preallocate a mountpoint in case the new mounts need 2010 * to be tucked under other mounts. 2011 */ 2012 smp = get_mountpoint(source_mnt->mnt.mnt_root); 2013 if (IS_ERR(smp)) 2014 return PTR_ERR(smp); 2015 2016 /* Is there space to add these mounts to the mount namespace? */ 2017 if (!parent_path) { 2018 err = count_mounts(ns, source_mnt); 2019 if (err) 2020 goto out; 2021 } 2022 2023 if (IS_MNT_SHARED(dest_mnt)) { 2024 err = invent_group_ids(source_mnt, true); 2025 if (err) 2026 goto out; 2027 err = propagate_mnt(dest_mnt, dest_mp, source_mnt, &tree_list); 2028 lock_mount_hash(); 2029 if (err) 2030 goto out_cleanup_ids; 2031 for (p = source_mnt; p; p = next_mnt(p, source_mnt)) 2032 set_mnt_shared(p); 2033 } else { 2034 lock_mount_hash(); 2035 } 2036 if (parent_path) { 2037 detach_mnt(source_mnt, parent_path); 2038 attach_mnt(source_mnt, dest_mnt, dest_mp); 2039 touch_mnt_namespace(source_mnt->mnt_ns); 2040 } else { 2041 mnt_set_mountpoint(dest_mnt, dest_mp, source_mnt); 2042 commit_tree(source_mnt); 2043 } 2044 2045 hlist_for_each_entry_safe(child, n, &tree_list, mnt_hash) { 2046 struct mount *q; 2047 hlist_del_init(&child->mnt_hash); 2048 q = __lookup_mnt(&child->mnt_parent->mnt, 2049 child->mnt_mountpoint); 2050 if (q) 2051 mnt_change_mountpoint(child, smp, q); 2052 commit_tree(child); 2053 } 2054 put_mountpoint(smp); 2055 unlock_mount_hash(); 2056 2057 return 0; 2058 2059 out_cleanup_ids: 2060 while (!hlist_empty(&tree_list)) { 2061 child = hlist_entry(tree_list.first, struct mount, mnt_hash); 2062 child->mnt_parent->mnt_ns->pending_mounts = 0; 2063 umount_tree(child, UMOUNT_SYNC); 2064 } 2065 unlock_mount_hash(); 2066 cleanup_group_ids(source_mnt, NULL); 2067 out: 2068 ns->pending_mounts = 0; 2069 2070 read_seqlock_excl(&mount_lock); 2071 put_mountpoint(smp); 2072 read_sequnlock_excl(&mount_lock); 2073 2074 return err; 2075 } 2076 2077 static struct mountpoint *lock_mount(struct path *path) 2078 { 2079 struct vfsmount *mnt; 2080 struct dentry *dentry = path->dentry; 2081 retry: 2082 inode_lock(dentry->d_inode); 2083 if (unlikely(cant_mount(dentry))) { 2084 inode_unlock(dentry->d_inode); 2085 return ERR_PTR(-ENOENT); 2086 } 2087 namespace_lock(); 2088 mnt = lookup_mnt(path); 2089 if (likely(!mnt)) { 2090 struct mountpoint *mp = get_mountpoint(dentry); 2091 if (IS_ERR(mp)) { 2092 namespace_unlock(); 2093 inode_unlock(dentry->d_inode); 2094 return mp; 2095 } 2096 return mp; 2097 } 2098 namespace_unlock(); 2099 inode_unlock(path->dentry->d_inode); 2100 path_put(path); 2101 path->mnt = mnt; 2102 dentry = path->dentry = dget(mnt->mnt_root); 2103 goto retry; 2104 } 2105 2106 static void unlock_mount(struct mountpoint *where) 2107 { 2108 struct dentry *dentry = where->m_dentry; 2109 2110 read_seqlock_excl(&mount_lock); 2111 put_mountpoint(where); 2112 read_sequnlock_excl(&mount_lock); 2113 2114 namespace_unlock(); 2115 inode_unlock(dentry->d_inode); 2116 } 2117 2118 static int graft_tree(struct mount *mnt, struct mount *p, struct mountpoint *mp) 2119 { 2120 if (mnt->mnt.mnt_sb->s_flags & MS_NOUSER) 2121 return -EINVAL; 2122 2123 if (d_is_dir(mp->m_dentry) != 2124 d_is_dir(mnt->mnt.mnt_root)) 2125 return -ENOTDIR; 2126 2127 return attach_recursive_mnt(mnt, p, mp, NULL); 2128 } 2129 2130 /* 2131 * Sanity check the flags to change_mnt_propagation. 2132 */ 2133 2134 static int flags_to_propagation_type(int flags) 2135 { 2136 int type = flags & ~(MS_REC | MS_SILENT); 2137 2138 /* Fail if any non-propagation flags are set */ 2139 if (type & ~(MS_SHARED | MS_PRIVATE | MS_SLAVE | MS_UNBINDABLE)) 2140 return 0; 2141 /* Only one propagation flag should be set */ 2142 if (!is_power_of_2(type)) 2143 return 0; 2144 return type; 2145 } 2146 2147 /* 2148 * recursively change the type of the mountpoint. 2149 */ 2150 static int do_change_type(struct path *path, int flag) 2151 { 2152 struct mount *m; 2153 struct mount *mnt = real_mount(path->mnt); 2154 int recurse = flag & MS_REC; 2155 int type; 2156 int err = 0; 2157 2158 if (path->dentry != path->mnt->mnt_root) 2159 return -EINVAL; 2160 2161 type = flags_to_propagation_type(flag); 2162 if (!type) 2163 return -EINVAL; 2164 2165 namespace_lock(); 2166 if (type == MS_SHARED) { 2167 err = invent_group_ids(mnt, recurse); 2168 if (err) 2169 goto out_unlock; 2170 } 2171 2172 lock_mount_hash(); 2173 for (m = mnt; m; m = (recurse ? next_mnt(m, mnt) : NULL)) 2174 change_mnt_propagation(m, type); 2175 unlock_mount_hash(); 2176 2177 out_unlock: 2178 namespace_unlock(); 2179 return err; 2180 } 2181 2182 static bool has_locked_children(struct mount *mnt, struct dentry *dentry) 2183 { 2184 struct mount *child; 2185 list_for_each_entry(child, &mnt->mnt_mounts, mnt_child) { 2186 if (!is_subdir(child->mnt_mountpoint, dentry)) 2187 continue; 2188 2189 if (child->mnt.mnt_flags & MNT_LOCKED) 2190 return true; 2191 } 2192 return false; 2193 } 2194 2195 /* 2196 * do loopback mount. 2197 */ 2198 static int do_loopback(struct path *path, const char *old_name, 2199 int recurse) 2200 { 2201 struct path old_path; 2202 struct mount *mnt = NULL, *old, *parent; 2203 struct mountpoint *mp; 2204 int err; 2205 if (!old_name || !*old_name) 2206 return -EINVAL; 2207 err = kern_path(old_name, LOOKUP_FOLLOW|LOOKUP_AUTOMOUNT, &old_path); 2208 if (err) 2209 return err; 2210 2211 err = -EINVAL; 2212 if (mnt_ns_loop(old_path.dentry)) 2213 goto out; 2214 2215 mp = lock_mount(path); 2216 err = PTR_ERR(mp); 2217 if (IS_ERR(mp)) 2218 goto out; 2219 2220 old = real_mount(old_path.mnt); 2221 parent = real_mount(path->mnt); 2222 2223 err = -EINVAL; 2224 if (IS_MNT_UNBINDABLE(old)) 2225 goto out2; 2226 2227 if (!check_mnt(parent)) 2228 goto out2; 2229 2230 if (!check_mnt(old) && old_path.dentry->d_op != &ns_dentry_operations) 2231 goto out2; 2232 2233 if (!recurse && has_locked_children(old, old_path.dentry)) 2234 goto out2; 2235 2236 if (recurse) 2237 mnt = copy_tree(old, old_path.dentry, CL_COPY_MNT_NS_FILE); 2238 else 2239 mnt = clone_mnt(old, old_path.dentry, 0); 2240 2241 if (IS_ERR(mnt)) { 2242 err = PTR_ERR(mnt); 2243 goto out2; 2244 } 2245 2246 mnt->mnt.mnt_flags &= ~MNT_LOCKED; 2247 2248 err = graft_tree(mnt, parent, mp); 2249 if (err) { 2250 lock_mount_hash(); 2251 umount_tree(mnt, UMOUNT_SYNC); 2252 unlock_mount_hash(); 2253 } 2254 out2: 2255 unlock_mount(mp); 2256 out: 2257 path_put(&old_path); 2258 return err; 2259 } 2260 2261 static int change_mount_flags(struct vfsmount *mnt, int ms_flags) 2262 { 2263 int error = 0; 2264 int readonly_request = 0; 2265 2266 if (ms_flags & MS_RDONLY) 2267 readonly_request = 1; 2268 if (readonly_request == __mnt_is_readonly(mnt)) 2269 return 0; 2270 2271 if (readonly_request) 2272 error = mnt_make_readonly(real_mount(mnt)); 2273 else 2274 __mnt_unmake_readonly(real_mount(mnt)); 2275 return error; 2276 } 2277 2278 /* 2279 * change filesystem flags. dir should be a physical root of filesystem. 2280 * If you've mounted a non-root directory somewhere and want to do remount 2281 * on it - tough luck. 2282 */ 2283 static int do_remount(struct path *path, int flags, int mnt_flags, 2284 void *data) 2285 { 2286 int err; 2287 struct super_block *sb = path->mnt->mnt_sb; 2288 struct mount *mnt = real_mount(path->mnt); 2289 2290 if (!check_mnt(mnt)) 2291 return -EINVAL; 2292 2293 if (path->dentry != path->mnt->mnt_root) 2294 return -EINVAL; 2295 2296 /* Don't allow changing of locked mnt flags. 2297 * 2298 * No locks need to be held here while testing the various 2299 * MNT_LOCK flags because those flags can never be cleared 2300 * once they are set. 2301 */ 2302 if ((mnt->mnt.mnt_flags & MNT_LOCK_READONLY) && 2303 !(mnt_flags & MNT_READONLY)) { 2304 return -EPERM; 2305 } 2306 if ((mnt->mnt.mnt_flags & MNT_LOCK_NODEV) && 2307 !(mnt_flags & MNT_NODEV)) { 2308 return -EPERM; 2309 } 2310 if ((mnt->mnt.mnt_flags & MNT_LOCK_NOSUID) && 2311 !(mnt_flags & MNT_NOSUID)) { 2312 return -EPERM; 2313 } 2314 if ((mnt->mnt.mnt_flags & MNT_LOCK_NOEXEC) && 2315 !(mnt_flags & MNT_NOEXEC)) { 2316 return -EPERM; 2317 } 2318 if ((mnt->mnt.mnt_flags & MNT_LOCK_ATIME) && 2319 ((mnt->mnt.mnt_flags & MNT_ATIME_MASK) != (mnt_flags & MNT_ATIME_MASK))) { 2320 return -EPERM; 2321 } 2322 2323 err = security_sb_remount(sb, data); 2324 if (err) 2325 return err; 2326 2327 down_write(&sb->s_umount); 2328 if (flags & MS_BIND) 2329 err = change_mount_flags(path->mnt, flags); 2330 else if (!capable(CAP_SYS_ADMIN)) 2331 err = -EPERM; 2332 else 2333 err = do_remount_sb(sb, flags, data, 0); 2334 if (!err) { 2335 lock_mount_hash(); 2336 mnt_flags |= mnt->mnt.mnt_flags & ~MNT_USER_SETTABLE_MASK; 2337 mnt->mnt.mnt_flags = mnt_flags; 2338 touch_mnt_namespace(mnt->mnt_ns); 2339 unlock_mount_hash(); 2340 } 2341 up_write(&sb->s_umount); 2342 return err; 2343 } 2344 2345 static inline int tree_contains_unbindable(struct mount *mnt) 2346 { 2347 struct mount *p; 2348 for (p = mnt; p; p = next_mnt(p, mnt)) { 2349 if (IS_MNT_UNBINDABLE(p)) 2350 return 1; 2351 } 2352 return 0; 2353 } 2354 2355 static int do_move_mount(struct path *path, const char *old_name) 2356 { 2357 struct path old_path, parent_path; 2358 struct mount *p; 2359 struct mount *old; 2360 struct mountpoint *mp; 2361 int err; 2362 if (!old_name || !*old_name) 2363 return -EINVAL; 2364 err = kern_path(old_name, LOOKUP_FOLLOW, &old_path); 2365 if (err) 2366 return err; 2367 2368 mp = lock_mount(path); 2369 err = PTR_ERR(mp); 2370 if (IS_ERR(mp)) 2371 goto out; 2372 2373 old = real_mount(old_path.mnt); 2374 p = real_mount(path->mnt); 2375 2376 err = -EINVAL; 2377 if (!check_mnt(p) || !check_mnt(old)) 2378 goto out1; 2379 2380 if (old->mnt.mnt_flags & MNT_LOCKED) 2381 goto out1; 2382 2383 err = -EINVAL; 2384 if (old_path.dentry != old_path.mnt->mnt_root) 2385 goto out1; 2386 2387 if (!mnt_has_parent(old)) 2388 goto out1; 2389 2390 if (d_is_dir(path->dentry) != 2391 d_is_dir(old_path.dentry)) 2392 goto out1; 2393 /* 2394 * Don't move a mount residing in a shared parent. 2395 */ 2396 if (IS_MNT_SHARED(old->mnt_parent)) 2397 goto out1; 2398 /* 2399 * Don't move a mount tree containing unbindable mounts to a destination 2400 * mount which is shared. 2401 */ 2402 if (IS_MNT_SHARED(p) && tree_contains_unbindable(old)) 2403 goto out1; 2404 err = -ELOOP; 2405 for (; mnt_has_parent(p); p = p->mnt_parent) 2406 if (p == old) 2407 goto out1; 2408 2409 err = attach_recursive_mnt(old, real_mount(path->mnt), mp, &parent_path); 2410 if (err) 2411 goto out1; 2412 2413 /* if the mount is moved, it should no longer be expire 2414 * automatically */ 2415 list_del_init(&old->mnt_expire); 2416 out1: 2417 unlock_mount(mp); 2418 out: 2419 if (!err) 2420 path_put(&parent_path); 2421 path_put(&old_path); 2422 return err; 2423 } 2424 2425 static struct vfsmount *fs_set_subtype(struct vfsmount *mnt, const char *fstype) 2426 { 2427 int err; 2428 const char *subtype = strchr(fstype, '.'); 2429 if (subtype) { 2430 subtype++; 2431 err = -EINVAL; 2432 if (!subtype[0]) 2433 goto err; 2434 } else 2435 subtype = ""; 2436 2437 mnt->mnt_sb->s_subtype = kstrdup(subtype, GFP_KERNEL); 2438 err = -ENOMEM; 2439 if (!mnt->mnt_sb->s_subtype) 2440 goto err; 2441 return mnt; 2442 2443 err: 2444 mntput(mnt); 2445 return ERR_PTR(err); 2446 } 2447 2448 /* 2449 * add a mount into a namespace's mount tree 2450 */ 2451 static int do_add_mount(struct mount *newmnt, struct path *path, int mnt_flags) 2452 { 2453 struct mountpoint *mp; 2454 struct mount *parent; 2455 int err; 2456 2457 mnt_flags &= ~MNT_INTERNAL_FLAGS; 2458 2459 mp = lock_mount(path); 2460 if (IS_ERR(mp)) 2461 return PTR_ERR(mp); 2462 2463 parent = real_mount(path->mnt); 2464 err = -EINVAL; 2465 if (unlikely(!check_mnt(parent))) { 2466 /* that's acceptable only for automounts done in private ns */ 2467 if (!(mnt_flags & MNT_SHRINKABLE)) 2468 goto unlock; 2469 /* ... and for those we'd better have mountpoint still alive */ 2470 if (!parent->mnt_ns) 2471 goto unlock; 2472 } 2473 2474 /* Refuse the same filesystem on the same mount point */ 2475 err = -EBUSY; 2476 if (path->mnt->mnt_sb == newmnt->mnt.mnt_sb && 2477 path->mnt->mnt_root == path->dentry) 2478 goto unlock; 2479 2480 err = -EINVAL; 2481 if (d_is_symlink(newmnt->mnt.mnt_root)) 2482 goto unlock; 2483 2484 newmnt->mnt.mnt_flags = mnt_flags; 2485 err = graft_tree(newmnt, parent, mp); 2486 2487 unlock: 2488 unlock_mount(mp); 2489 return err; 2490 } 2491 2492 static bool mount_too_revealing(struct vfsmount *mnt, int *new_mnt_flags); 2493 2494 /* 2495 * create a new mount for userspace and request it to be added into the 2496 * namespace's tree 2497 */ 2498 static int do_new_mount(struct path *path, const char *fstype, int flags, 2499 int mnt_flags, const char *name, void *data) 2500 { 2501 struct file_system_type *type; 2502 struct vfsmount *mnt; 2503 int err; 2504 2505 if (!fstype) 2506 return -EINVAL; 2507 2508 type = get_fs_type(fstype); 2509 if (!type) 2510 return -ENODEV; 2511 2512 mnt = vfs_kern_mount(type, flags, name, data); 2513 if (!IS_ERR(mnt) && (type->fs_flags & FS_HAS_SUBTYPE) && 2514 !mnt->mnt_sb->s_subtype) 2515 mnt = fs_set_subtype(mnt, fstype); 2516 2517 put_filesystem(type); 2518 if (IS_ERR(mnt)) 2519 return PTR_ERR(mnt); 2520 2521 if (mount_too_revealing(mnt, &mnt_flags)) { 2522 mntput(mnt); 2523 return -EPERM; 2524 } 2525 2526 err = do_add_mount(real_mount(mnt), path, mnt_flags); 2527 if (err) 2528 mntput(mnt); 2529 return err; 2530 } 2531 2532 int finish_automount(struct vfsmount *m, struct path *path) 2533 { 2534 struct mount *mnt = real_mount(m); 2535 int err; 2536 /* The new mount record should have at least 2 refs to prevent it being 2537 * expired before we get a chance to add it 2538 */ 2539 BUG_ON(mnt_get_count(mnt) < 2); 2540 2541 if (m->mnt_sb == path->mnt->mnt_sb && 2542 m->mnt_root == path->dentry) { 2543 err = -ELOOP; 2544 goto fail; 2545 } 2546 2547 err = do_add_mount(mnt, path, path->mnt->mnt_flags | MNT_SHRINKABLE); 2548 if (!err) 2549 return 0; 2550 fail: 2551 /* remove m from any expiration list it may be on */ 2552 if (!list_empty(&mnt->mnt_expire)) { 2553 namespace_lock(); 2554 list_del_init(&mnt->mnt_expire); 2555 namespace_unlock(); 2556 } 2557 mntput(m); 2558 mntput(m); 2559 return err; 2560 } 2561 2562 /** 2563 * mnt_set_expiry - Put a mount on an expiration list 2564 * @mnt: The mount to list. 2565 * @expiry_list: The list to add the mount to. 2566 */ 2567 void mnt_set_expiry(struct vfsmount *mnt, struct list_head *expiry_list) 2568 { 2569 namespace_lock(); 2570 2571 list_add_tail(&real_mount(mnt)->mnt_expire, expiry_list); 2572 2573 namespace_unlock(); 2574 } 2575 EXPORT_SYMBOL(mnt_set_expiry); 2576 2577 /* 2578 * process a list of expirable mountpoints with the intent of discarding any 2579 * mountpoints that aren't in use and haven't been touched since last we came 2580 * here 2581 */ 2582 void mark_mounts_for_expiry(struct list_head *mounts) 2583 { 2584 struct mount *mnt, *next; 2585 LIST_HEAD(graveyard); 2586 2587 if (list_empty(mounts)) 2588 return; 2589 2590 namespace_lock(); 2591 lock_mount_hash(); 2592 2593 /* extract from the expiration list every vfsmount that matches the 2594 * following criteria: 2595 * - only referenced by its parent vfsmount 2596 * - still marked for expiry (marked on the last call here; marks are 2597 * cleared by mntput()) 2598 */ 2599 list_for_each_entry_safe(mnt, next, mounts, mnt_expire) { 2600 if (!xchg(&mnt->mnt_expiry_mark, 1) || 2601 propagate_mount_busy(mnt, 1)) 2602 continue; 2603 list_move(&mnt->mnt_expire, &graveyard); 2604 } 2605 while (!list_empty(&graveyard)) { 2606 mnt = list_first_entry(&graveyard, struct mount, mnt_expire); 2607 touch_mnt_namespace(mnt->mnt_ns); 2608 umount_tree(mnt, UMOUNT_PROPAGATE|UMOUNT_SYNC); 2609 } 2610 unlock_mount_hash(); 2611 namespace_unlock(); 2612 } 2613 2614 EXPORT_SYMBOL_GPL(mark_mounts_for_expiry); 2615 2616 /* 2617 * Ripoff of 'select_parent()' 2618 * 2619 * search the list of submounts for a given mountpoint, and move any 2620 * shrinkable submounts to the 'graveyard' list. 2621 */ 2622 static int select_submounts(struct mount *parent, struct list_head *graveyard) 2623 { 2624 struct mount *this_parent = parent; 2625 struct list_head *next; 2626 int found = 0; 2627 2628 repeat: 2629 next = this_parent->mnt_mounts.next; 2630 resume: 2631 while (next != &this_parent->mnt_mounts) { 2632 struct list_head *tmp = next; 2633 struct mount *mnt = list_entry(tmp, struct mount, mnt_child); 2634 2635 next = tmp->next; 2636 if (!(mnt->mnt.mnt_flags & MNT_SHRINKABLE)) 2637 continue; 2638 /* 2639 * Descend a level if the d_mounts list is non-empty. 2640 */ 2641 if (!list_empty(&mnt->mnt_mounts)) { 2642 this_parent = mnt; 2643 goto repeat; 2644 } 2645 2646 if (!propagate_mount_busy(mnt, 1)) { 2647 list_move_tail(&mnt->mnt_expire, graveyard); 2648 found++; 2649 } 2650 } 2651 /* 2652 * All done at this level ... ascend and resume the search 2653 */ 2654 if (this_parent != parent) { 2655 next = this_parent->mnt_child.next; 2656 this_parent = this_parent->mnt_parent; 2657 goto resume; 2658 } 2659 return found; 2660 } 2661 2662 /* 2663 * process a list of expirable mountpoints with the intent of discarding any 2664 * submounts of a specific parent mountpoint 2665 * 2666 * mount_lock must be held for write 2667 */ 2668 static void shrink_submounts(struct mount *mnt) 2669 { 2670 LIST_HEAD(graveyard); 2671 struct mount *m; 2672 2673 /* extract submounts of 'mountpoint' from the expiration list */ 2674 while (select_submounts(mnt, &graveyard)) { 2675 while (!list_empty(&graveyard)) { 2676 m = list_first_entry(&graveyard, struct mount, 2677 mnt_expire); 2678 touch_mnt_namespace(m->mnt_ns); 2679 umount_tree(m, UMOUNT_PROPAGATE|UMOUNT_SYNC); 2680 } 2681 } 2682 } 2683 2684 /* 2685 * Some copy_from_user() implementations do not return the exact number of 2686 * bytes remaining to copy on a fault. But copy_mount_options() requires that. 2687 * Note that this function differs from copy_from_user() in that it will oops 2688 * on bad values of `to', rather than returning a short copy. 2689 */ 2690 static long exact_copy_from_user(void *to, const void __user * from, 2691 unsigned long n) 2692 { 2693 char *t = to; 2694 const char __user *f = from; 2695 char c; 2696 2697 if (!access_ok(VERIFY_READ, from, n)) 2698 return n; 2699 2700 while (n) { 2701 if (__get_user(c, f)) { 2702 memset(t, 0, n); 2703 break; 2704 } 2705 *t++ = c; 2706 f++; 2707 n--; 2708 } 2709 return n; 2710 } 2711 2712 void *copy_mount_options(const void __user * data) 2713 { 2714 int i; 2715 unsigned long size; 2716 char *copy; 2717 2718 if (!data) 2719 return NULL; 2720 2721 copy = kmalloc(PAGE_SIZE, GFP_KERNEL); 2722 if (!copy) 2723 return ERR_PTR(-ENOMEM); 2724 2725 /* We only care that *some* data at the address the user 2726 * gave us is valid. Just in case, we'll zero 2727 * the remainder of the page. 2728 */ 2729 /* copy_from_user cannot cross TASK_SIZE ! */ 2730 size = TASK_SIZE - (unsigned long)data; 2731 if (size > PAGE_SIZE) 2732 size = PAGE_SIZE; 2733 2734 i = size - exact_copy_from_user(copy, data, size); 2735 if (!i) { 2736 kfree(copy); 2737 return ERR_PTR(-EFAULT); 2738 } 2739 if (i != PAGE_SIZE) 2740 memset(copy + i, 0, PAGE_SIZE - i); 2741 return copy; 2742 } 2743 2744 char *copy_mount_string(const void __user *data) 2745 { 2746 return data ? strndup_user(data, PAGE_SIZE) : NULL; 2747 } 2748 2749 /* 2750 * Flags is a 32-bit value that allows up to 31 non-fs dependent flags to 2751 * be given to the mount() call (ie: read-only, no-dev, no-suid etc). 2752 * 2753 * data is a (void *) that can point to any structure up to 2754 * PAGE_SIZE-1 bytes, which can contain arbitrary fs-dependent 2755 * information (or be NULL). 2756 * 2757 * Pre-0.97 versions of mount() didn't have a flags word. 2758 * When the flags word was introduced its top half was required 2759 * to have the magic value 0xC0ED, and this remained so until 2.4.0-test9. 2760 * Therefore, if this magic number is present, it carries no information 2761 * and must be discarded. 2762 */ 2763 long do_mount(const char *dev_name, const char __user *dir_name, 2764 const char *type_page, unsigned long flags, void *data_page) 2765 { 2766 struct path path; 2767 int retval = 0; 2768 int mnt_flags = 0; 2769 2770 /* Discard magic */ 2771 if ((flags & MS_MGC_MSK) == MS_MGC_VAL) 2772 flags &= ~MS_MGC_MSK; 2773 2774 /* Basic sanity checks */ 2775 if (data_page) 2776 ((char *)data_page)[PAGE_SIZE - 1] = 0; 2777 2778 /* ... and get the mountpoint */ 2779 retval = user_path(dir_name, &path); 2780 if (retval) 2781 return retval; 2782 2783 retval = security_sb_mount(dev_name, &path, 2784 type_page, flags, data_page); 2785 if (!retval && !may_mount()) 2786 retval = -EPERM; 2787 if (!retval && (flags & MS_MANDLOCK) && !may_mandlock()) 2788 retval = -EPERM; 2789 if (retval) 2790 goto dput_out; 2791 2792 /* Default to relatime unless overriden */ 2793 if (!(flags & MS_NOATIME)) 2794 mnt_flags |= MNT_RELATIME; 2795 2796 /* Separate the per-mountpoint flags */ 2797 if (flags & MS_NOSUID) 2798 mnt_flags |= MNT_NOSUID; 2799 if (flags & MS_NODEV) 2800 mnt_flags |= MNT_NODEV; 2801 if (flags & MS_NOEXEC) 2802 mnt_flags |= MNT_NOEXEC; 2803 if (flags & MS_NOATIME) 2804 mnt_flags |= MNT_NOATIME; 2805 if (flags & MS_NODIRATIME) 2806 mnt_flags |= MNT_NODIRATIME; 2807 if (flags & MS_STRICTATIME) 2808 mnt_flags &= ~(MNT_RELATIME | MNT_NOATIME); 2809 if (flags & MS_RDONLY) 2810 mnt_flags |= MNT_READONLY; 2811 2812 /* The default atime for remount is preservation */ 2813 if ((flags & MS_REMOUNT) && 2814 ((flags & (MS_NOATIME | MS_NODIRATIME | MS_RELATIME | 2815 MS_STRICTATIME)) == 0)) { 2816 mnt_flags &= ~MNT_ATIME_MASK; 2817 mnt_flags |= path.mnt->mnt_flags & MNT_ATIME_MASK; 2818 } 2819 2820 flags &= ~(MS_NOSUID | MS_NOEXEC | MS_NODEV | MS_ACTIVE | MS_BORN | 2821 MS_NOATIME | MS_NODIRATIME | MS_RELATIME| MS_KERNMOUNT | 2822 MS_STRICTATIME | MS_NOREMOTELOCK | MS_SUBMOUNT); 2823 2824 if (flags & MS_REMOUNT) 2825 retval = do_remount(&path, flags & ~MS_REMOUNT, mnt_flags, 2826 data_page); 2827 else if (flags & MS_BIND) 2828 retval = do_loopback(&path, dev_name, flags & MS_REC); 2829 else if (flags & (MS_SHARED | MS_PRIVATE | MS_SLAVE | MS_UNBINDABLE)) 2830 retval = do_change_type(&path, flags); 2831 else if (flags & MS_MOVE) 2832 retval = do_move_mount(&path, dev_name); 2833 else 2834 retval = do_new_mount(&path, type_page, flags, mnt_flags, 2835 dev_name, data_page); 2836 dput_out: 2837 path_put(&path); 2838 return retval; 2839 } 2840 2841 static struct ucounts *inc_mnt_namespaces(struct user_namespace *ns) 2842 { 2843 return inc_ucount(ns, current_euid(), UCOUNT_MNT_NAMESPACES); 2844 } 2845 2846 static void dec_mnt_namespaces(struct ucounts *ucounts) 2847 { 2848 dec_ucount(ucounts, UCOUNT_MNT_NAMESPACES); 2849 } 2850 2851 static void free_mnt_ns(struct mnt_namespace *ns) 2852 { 2853 ns_free_inum(&ns->ns); 2854 dec_mnt_namespaces(ns->ucounts); 2855 put_user_ns(ns->user_ns); 2856 kfree(ns); 2857 } 2858 2859 /* 2860 * Assign a sequence number so we can detect when we attempt to bind 2861 * mount a reference to an older mount namespace into the current 2862 * mount namespace, preventing reference counting loops. A 64bit 2863 * number incrementing at 10Ghz will take 12,427 years to wrap which 2864 * is effectively never, so we can ignore the possibility. 2865 */ 2866 static atomic64_t mnt_ns_seq = ATOMIC64_INIT(1); 2867 2868 static struct mnt_namespace *alloc_mnt_ns(struct user_namespace *user_ns) 2869 { 2870 struct mnt_namespace *new_ns; 2871 struct ucounts *ucounts; 2872 int ret; 2873 2874 ucounts = inc_mnt_namespaces(user_ns); 2875 if (!ucounts) 2876 return ERR_PTR(-ENOSPC); 2877 2878 new_ns = kmalloc(sizeof(struct mnt_namespace), GFP_KERNEL); 2879 if (!new_ns) { 2880 dec_mnt_namespaces(ucounts); 2881 return ERR_PTR(-ENOMEM); 2882 } 2883 ret = ns_alloc_inum(&new_ns->ns); 2884 if (ret) { 2885 kfree(new_ns); 2886 dec_mnt_namespaces(ucounts); 2887 return ERR_PTR(ret); 2888 } 2889 new_ns->ns.ops = &mntns_operations; 2890 new_ns->seq = atomic64_add_return(1, &mnt_ns_seq); 2891 atomic_set(&new_ns->count, 1); 2892 new_ns->root = NULL; 2893 INIT_LIST_HEAD(&new_ns->list); 2894 init_waitqueue_head(&new_ns->poll); 2895 new_ns->event = 0; 2896 new_ns->user_ns = get_user_ns(user_ns); 2897 new_ns->ucounts = ucounts; 2898 new_ns->mounts = 0; 2899 new_ns->pending_mounts = 0; 2900 return new_ns; 2901 } 2902 2903 __latent_entropy 2904 struct mnt_namespace *copy_mnt_ns(unsigned long flags, struct mnt_namespace *ns, 2905 struct user_namespace *user_ns, struct fs_struct *new_fs) 2906 { 2907 struct mnt_namespace *new_ns; 2908 struct vfsmount *rootmnt = NULL, *pwdmnt = NULL; 2909 struct mount *p, *q; 2910 struct mount *old; 2911 struct mount *new; 2912 int copy_flags; 2913 2914 BUG_ON(!ns); 2915 2916 if (likely(!(flags & CLONE_NEWNS))) { 2917 get_mnt_ns(ns); 2918 return ns; 2919 } 2920 2921 old = ns->root; 2922 2923 new_ns = alloc_mnt_ns(user_ns); 2924 if (IS_ERR(new_ns)) 2925 return new_ns; 2926 2927 namespace_lock(); 2928 /* First pass: copy the tree topology */ 2929 copy_flags = CL_COPY_UNBINDABLE | CL_EXPIRE; 2930 if (user_ns != ns->user_ns) 2931 copy_flags |= CL_SHARED_TO_SLAVE | CL_UNPRIVILEGED; 2932 new = copy_tree(old, old->mnt.mnt_root, copy_flags); 2933 if (IS_ERR(new)) { 2934 namespace_unlock(); 2935 free_mnt_ns(new_ns); 2936 return ERR_CAST(new); 2937 } 2938 new_ns->root = new; 2939 list_add_tail(&new_ns->list, &new->mnt_list); 2940 2941 /* 2942 * Second pass: switch the tsk->fs->* elements and mark new vfsmounts 2943 * as belonging to new namespace. We have already acquired a private 2944 * fs_struct, so tsk->fs->lock is not needed. 2945 */ 2946 p = old; 2947 q = new; 2948 while (p) { 2949 q->mnt_ns = new_ns; 2950 new_ns->mounts++; 2951 if (new_fs) { 2952 if (&p->mnt == new_fs->root.mnt) { 2953 new_fs->root.mnt = mntget(&q->mnt); 2954 rootmnt = &p->mnt; 2955 } 2956 if (&p->mnt == new_fs->pwd.mnt) { 2957 new_fs->pwd.mnt = mntget(&q->mnt); 2958 pwdmnt = &p->mnt; 2959 } 2960 } 2961 p = next_mnt(p, old); 2962 q = next_mnt(q, new); 2963 if (!q) 2964 break; 2965 while (p->mnt.mnt_root != q->mnt.mnt_root) 2966 p = next_mnt(p, old); 2967 } 2968 namespace_unlock(); 2969 2970 if (rootmnt) 2971 mntput(rootmnt); 2972 if (pwdmnt) 2973 mntput(pwdmnt); 2974 2975 return new_ns; 2976 } 2977 2978 /** 2979 * create_mnt_ns - creates a private namespace and adds a root filesystem 2980 * @mnt: pointer to the new root filesystem mountpoint 2981 */ 2982 static struct mnt_namespace *create_mnt_ns(struct vfsmount *m) 2983 { 2984 struct mnt_namespace *new_ns = alloc_mnt_ns(&init_user_ns); 2985 if (!IS_ERR(new_ns)) { 2986 struct mount *mnt = real_mount(m); 2987 mnt->mnt_ns = new_ns; 2988 new_ns->root = mnt; 2989 new_ns->mounts++; 2990 list_add(&mnt->mnt_list, &new_ns->list); 2991 } else { 2992 mntput(m); 2993 } 2994 return new_ns; 2995 } 2996 2997 struct dentry *mount_subtree(struct vfsmount *mnt, const char *name) 2998 { 2999 struct mnt_namespace *ns; 3000 struct super_block *s; 3001 struct path path; 3002 int err; 3003 3004 ns = create_mnt_ns(mnt); 3005 if (IS_ERR(ns)) 3006 return ERR_CAST(ns); 3007 3008 err = vfs_path_lookup(mnt->mnt_root, mnt, 3009 name, LOOKUP_FOLLOW|LOOKUP_AUTOMOUNT, &path); 3010 3011 put_mnt_ns(ns); 3012 3013 if (err) 3014 return ERR_PTR(err); 3015 3016 /* trade a vfsmount reference for active sb one */ 3017 s = path.mnt->mnt_sb; 3018 atomic_inc(&s->s_active); 3019 mntput(path.mnt); 3020 /* lock the sucker */ 3021 down_write(&s->s_umount); 3022 /* ... and return the root of (sub)tree on it */ 3023 return path.dentry; 3024 } 3025 EXPORT_SYMBOL(mount_subtree); 3026 3027 SYSCALL_DEFINE5(mount, char __user *, dev_name, char __user *, dir_name, 3028 char __user *, type, unsigned long, flags, void __user *, data) 3029 { 3030 int ret; 3031 char *kernel_type; 3032 char *kernel_dev; 3033 void *options; 3034 3035 kernel_type = copy_mount_string(type); 3036 ret = PTR_ERR(kernel_type); 3037 if (IS_ERR(kernel_type)) 3038 goto out_type; 3039 3040 kernel_dev = copy_mount_string(dev_name); 3041 ret = PTR_ERR(kernel_dev); 3042 if (IS_ERR(kernel_dev)) 3043 goto out_dev; 3044 3045 options = copy_mount_options(data); 3046 ret = PTR_ERR(options); 3047 if (IS_ERR(options)) 3048 goto out_data; 3049 3050 ret = do_mount(kernel_dev, dir_name, kernel_type, flags, options); 3051 3052 kfree(options); 3053 out_data: 3054 kfree(kernel_dev); 3055 out_dev: 3056 kfree(kernel_type); 3057 out_type: 3058 return ret; 3059 } 3060 3061 /* 3062 * Return true if path is reachable from root 3063 * 3064 * namespace_sem or mount_lock is held 3065 */ 3066 bool is_path_reachable(struct mount *mnt, struct dentry *dentry, 3067 const struct path *root) 3068 { 3069 while (&mnt->mnt != root->mnt && mnt_has_parent(mnt)) { 3070 dentry = mnt->mnt_mountpoint; 3071 mnt = mnt->mnt_parent; 3072 } 3073 return &mnt->mnt == root->mnt && is_subdir(dentry, root->dentry); 3074 } 3075 3076 bool path_is_under(const struct path *path1, const struct path *path2) 3077 { 3078 bool res; 3079 read_seqlock_excl(&mount_lock); 3080 res = is_path_reachable(real_mount(path1->mnt), path1->dentry, path2); 3081 read_sequnlock_excl(&mount_lock); 3082 return res; 3083 } 3084 EXPORT_SYMBOL(path_is_under); 3085 3086 /* 3087 * pivot_root Semantics: 3088 * Moves the root file system of the current process to the directory put_old, 3089 * makes new_root as the new root file system of the current process, and sets 3090 * root/cwd of all processes which had them on the current root to new_root. 3091 * 3092 * Restrictions: 3093 * The new_root and put_old must be directories, and must not be on the 3094 * same file system as the current process root. The put_old must be 3095 * underneath new_root, i.e. adding a non-zero number of /.. to the string 3096 * pointed to by put_old must yield the same directory as new_root. No other 3097 * file system may be mounted on put_old. After all, new_root is a mountpoint. 3098 * 3099 * Also, the current root cannot be on the 'rootfs' (initial ramfs) filesystem. 3100 * See Documentation/filesystems/ramfs-rootfs-initramfs.txt for alternatives 3101 * in this situation. 3102 * 3103 * Notes: 3104 * - we don't move root/cwd if they are not at the root (reason: if something 3105 * cared enough to change them, it's probably wrong to force them elsewhere) 3106 * - it's okay to pick a root that isn't the root of a file system, e.g. 3107 * /nfs/my_root where /nfs is the mount point. It must be a mountpoint, 3108 * though, so you may need to say mount --bind /nfs/my_root /nfs/my_root 3109 * first. 3110 */ 3111 SYSCALL_DEFINE2(pivot_root, const char __user *, new_root, 3112 const char __user *, put_old) 3113 { 3114 struct path new, old, parent_path, root_parent, root; 3115 struct mount *new_mnt, *root_mnt, *old_mnt; 3116 struct mountpoint *old_mp, *root_mp; 3117 int error; 3118 3119 if (!may_mount()) 3120 return -EPERM; 3121 3122 error = user_path_dir(new_root, &new); 3123 if (error) 3124 goto out0; 3125 3126 error = user_path_dir(put_old, &old); 3127 if (error) 3128 goto out1; 3129 3130 error = security_sb_pivotroot(&old, &new); 3131 if (error) 3132 goto out2; 3133 3134 get_fs_root(current->fs, &root); 3135 old_mp = lock_mount(&old); 3136 error = PTR_ERR(old_mp); 3137 if (IS_ERR(old_mp)) 3138 goto out3; 3139 3140 error = -EINVAL; 3141 new_mnt = real_mount(new.mnt); 3142 root_mnt = real_mount(root.mnt); 3143 old_mnt = real_mount(old.mnt); 3144 if (IS_MNT_SHARED(old_mnt) || 3145 IS_MNT_SHARED(new_mnt->mnt_parent) || 3146 IS_MNT_SHARED(root_mnt->mnt_parent)) 3147 goto out4; 3148 if (!check_mnt(root_mnt) || !check_mnt(new_mnt)) 3149 goto out4; 3150 if (new_mnt->mnt.mnt_flags & MNT_LOCKED) 3151 goto out4; 3152 error = -ENOENT; 3153 if (d_unlinked(new.dentry)) 3154 goto out4; 3155 error = -EBUSY; 3156 if (new_mnt == root_mnt || old_mnt == root_mnt) 3157 goto out4; /* loop, on the same file system */ 3158 error = -EINVAL; 3159 if (root.mnt->mnt_root != root.dentry) 3160 goto out4; /* not a mountpoint */ 3161 if (!mnt_has_parent(root_mnt)) 3162 goto out4; /* not attached */ 3163 root_mp = root_mnt->mnt_mp; 3164 if (new.mnt->mnt_root != new.dentry) 3165 goto out4; /* not a mountpoint */ 3166 if (!mnt_has_parent(new_mnt)) 3167 goto out4; /* not attached */ 3168 /* make sure we can reach put_old from new_root */ 3169 if (!is_path_reachable(old_mnt, old.dentry, &new)) 3170 goto out4; 3171 /* make certain new is below the root */ 3172 if (!is_path_reachable(new_mnt, new.dentry, &root)) 3173 goto out4; 3174 root_mp->m_count++; /* pin it so it won't go away */ 3175 lock_mount_hash(); 3176 detach_mnt(new_mnt, &parent_path); 3177 detach_mnt(root_mnt, &root_parent); 3178 if (root_mnt->mnt.mnt_flags & MNT_LOCKED) { 3179 new_mnt->mnt.mnt_flags |= MNT_LOCKED; 3180 root_mnt->mnt.mnt_flags &= ~MNT_LOCKED; 3181 } 3182 /* mount old root on put_old */ 3183 attach_mnt(root_mnt, old_mnt, old_mp); 3184 /* mount new_root on / */ 3185 attach_mnt(new_mnt, real_mount(root_parent.mnt), root_mp); 3186 touch_mnt_namespace(current->nsproxy->mnt_ns); 3187 /* A moved mount should not expire automatically */ 3188 list_del_init(&new_mnt->mnt_expire); 3189 put_mountpoint(root_mp); 3190 unlock_mount_hash(); 3191 chroot_fs_refs(&root, &new); 3192 error = 0; 3193 out4: 3194 unlock_mount(old_mp); 3195 if (!error) { 3196 path_put(&root_parent); 3197 path_put(&parent_path); 3198 } 3199 out3: 3200 path_put(&root); 3201 out2: 3202 path_put(&old); 3203 out1: 3204 path_put(&new); 3205 out0: 3206 return error; 3207 } 3208 3209 static void __init init_mount_tree(void) 3210 { 3211 struct vfsmount *mnt; 3212 struct mnt_namespace *ns; 3213 struct path root; 3214 struct file_system_type *type; 3215 3216 type = get_fs_type("rootfs"); 3217 if (!type) 3218 panic("Can't find rootfs type"); 3219 mnt = vfs_kern_mount(type, 0, "rootfs", NULL); 3220 put_filesystem(type); 3221 if (IS_ERR(mnt)) 3222 panic("Can't create rootfs"); 3223 3224 ns = create_mnt_ns(mnt); 3225 if (IS_ERR(ns)) 3226 panic("Can't allocate initial namespace"); 3227 3228 init_task.nsproxy->mnt_ns = ns; 3229 get_mnt_ns(ns); 3230 3231 root.mnt = mnt; 3232 root.dentry = mnt->mnt_root; 3233 mnt->mnt_flags |= MNT_LOCKED; 3234 3235 set_fs_pwd(current->fs, &root); 3236 set_fs_root(current->fs, &root); 3237 } 3238 3239 void __init mnt_init(void) 3240 { 3241 unsigned u; 3242 int err; 3243 3244 mnt_cache = kmem_cache_create("mnt_cache", sizeof(struct mount), 3245 0, SLAB_HWCACHE_ALIGN | SLAB_PANIC, NULL); 3246 3247 mount_hashtable = alloc_large_system_hash("Mount-cache", 3248 sizeof(struct hlist_head), 3249 mhash_entries, 19, 3250 0, 3251 &m_hash_shift, &m_hash_mask, 0, 0); 3252 mountpoint_hashtable = alloc_large_system_hash("Mountpoint-cache", 3253 sizeof(struct hlist_head), 3254 mphash_entries, 19, 3255 0, 3256 &mp_hash_shift, &mp_hash_mask, 0, 0); 3257 3258 if (!mount_hashtable || !mountpoint_hashtable) 3259 panic("Failed to allocate mount hash table\n"); 3260 3261 for (u = 0; u <= m_hash_mask; u++) 3262 INIT_HLIST_HEAD(&mount_hashtable[u]); 3263 for (u = 0; u <= mp_hash_mask; u++) 3264 INIT_HLIST_HEAD(&mountpoint_hashtable[u]); 3265 3266 kernfs_init(); 3267 3268 err = sysfs_init(); 3269 if (err) 3270 printk(KERN_WARNING "%s: sysfs_init error: %d\n", 3271 __func__, err); 3272 fs_kobj = kobject_create_and_add("fs", NULL); 3273 if (!fs_kobj) 3274 printk(KERN_WARNING "%s: kobj create error\n", __func__); 3275 init_rootfs(); 3276 init_mount_tree(); 3277 } 3278 3279 void put_mnt_ns(struct mnt_namespace *ns) 3280 { 3281 if (!atomic_dec_and_test(&ns->count)) 3282 return; 3283 drop_collected_mounts(&ns->root->mnt); 3284 free_mnt_ns(ns); 3285 } 3286 3287 struct vfsmount *kern_mount_data(struct file_system_type *type, void *data) 3288 { 3289 struct vfsmount *mnt; 3290 mnt = vfs_kern_mount(type, MS_KERNMOUNT, type->name, data); 3291 if (!IS_ERR(mnt)) { 3292 /* 3293 * it is a longterm mount, don't release mnt until 3294 * we unmount before file sys is unregistered 3295 */ 3296 real_mount(mnt)->mnt_ns = MNT_NS_INTERNAL; 3297 } 3298 return mnt; 3299 } 3300 EXPORT_SYMBOL_GPL(kern_mount_data); 3301 3302 void kern_unmount(struct vfsmount *mnt) 3303 { 3304 /* release long term mount so mount point can be released */ 3305 if (!IS_ERR_OR_NULL(mnt)) { 3306 real_mount(mnt)->mnt_ns = NULL; 3307 synchronize_rcu(); /* yecchhh... */ 3308 mntput(mnt); 3309 } 3310 } 3311 EXPORT_SYMBOL(kern_unmount); 3312 3313 bool our_mnt(struct vfsmount *mnt) 3314 { 3315 return check_mnt(real_mount(mnt)); 3316 } 3317 3318 bool current_chrooted(void) 3319 { 3320 /* Does the current process have a non-standard root */ 3321 struct path ns_root; 3322 struct path fs_root; 3323 bool chrooted; 3324 3325 /* Find the namespace root */ 3326 ns_root.mnt = ¤t->nsproxy->mnt_ns->root->mnt; 3327 ns_root.dentry = ns_root.mnt->mnt_root; 3328 path_get(&ns_root); 3329 while (d_mountpoint(ns_root.dentry) && follow_down_one(&ns_root)) 3330 ; 3331 3332 get_fs_root(current->fs, &fs_root); 3333 3334 chrooted = !path_equal(&fs_root, &ns_root); 3335 3336 path_put(&fs_root); 3337 path_put(&ns_root); 3338 3339 return chrooted; 3340 } 3341 3342 static bool mnt_already_visible(struct mnt_namespace *ns, struct vfsmount *new, 3343 int *new_mnt_flags) 3344 { 3345 int new_flags = *new_mnt_flags; 3346 struct mount *mnt; 3347 bool visible = false; 3348 3349 down_read(&namespace_sem); 3350 list_for_each_entry(mnt, &ns->list, mnt_list) { 3351 struct mount *child; 3352 int mnt_flags; 3353 3354 if (mnt->mnt.mnt_sb->s_type != new->mnt_sb->s_type) 3355 continue; 3356 3357 /* This mount is not fully visible if it's root directory 3358 * is not the root directory of the filesystem. 3359 */ 3360 if (mnt->mnt.mnt_root != mnt->mnt.mnt_sb->s_root) 3361 continue; 3362 3363 /* A local view of the mount flags */ 3364 mnt_flags = mnt->mnt.mnt_flags; 3365 3366 /* Don't miss readonly hidden in the superblock flags */ 3367 if (mnt->mnt.mnt_sb->s_flags & MS_RDONLY) 3368 mnt_flags |= MNT_LOCK_READONLY; 3369 3370 /* Verify the mount flags are equal to or more permissive 3371 * than the proposed new mount. 3372 */ 3373 if ((mnt_flags & MNT_LOCK_READONLY) && 3374 !(new_flags & MNT_READONLY)) 3375 continue; 3376 if ((mnt_flags & MNT_LOCK_ATIME) && 3377 ((mnt_flags & MNT_ATIME_MASK) != (new_flags & MNT_ATIME_MASK))) 3378 continue; 3379 3380 /* This mount is not fully visible if there are any 3381 * locked child mounts that cover anything except for 3382 * empty directories. 3383 */ 3384 list_for_each_entry(child, &mnt->mnt_mounts, mnt_child) { 3385 struct inode *inode = child->mnt_mountpoint->d_inode; 3386 /* Only worry about locked mounts */ 3387 if (!(child->mnt.mnt_flags & MNT_LOCKED)) 3388 continue; 3389 /* Is the directory permanetly empty? */ 3390 if (!is_empty_dir_inode(inode)) 3391 goto next; 3392 } 3393 /* Preserve the locked attributes */ 3394 *new_mnt_flags |= mnt_flags & (MNT_LOCK_READONLY | \ 3395 MNT_LOCK_ATIME); 3396 visible = true; 3397 goto found; 3398 next: ; 3399 } 3400 found: 3401 up_read(&namespace_sem); 3402 return visible; 3403 } 3404 3405 static bool mount_too_revealing(struct vfsmount *mnt, int *new_mnt_flags) 3406 { 3407 const unsigned long required_iflags = SB_I_NOEXEC | SB_I_NODEV; 3408 struct mnt_namespace *ns = current->nsproxy->mnt_ns; 3409 unsigned long s_iflags; 3410 3411 if (ns->user_ns == &init_user_ns) 3412 return false; 3413 3414 /* Can this filesystem be too revealing? */ 3415 s_iflags = mnt->mnt_sb->s_iflags; 3416 if (!(s_iflags & SB_I_USERNS_VISIBLE)) 3417 return false; 3418 3419 if ((s_iflags & required_iflags) != required_iflags) { 3420 WARN_ONCE(1, "Expected s_iflags to contain 0x%lx\n", 3421 required_iflags); 3422 return true; 3423 } 3424 3425 return !mnt_already_visible(ns, mnt, new_mnt_flags); 3426 } 3427 3428 bool mnt_may_suid(struct vfsmount *mnt) 3429 { 3430 /* 3431 * Foreign mounts (accessed via fchdir or through /proc 3432 * symlinks) are always treated as if they are nosuid. This 3433 * prevents namespaces from trusting potentially unsafe 3434 * suid/sgid bits, file caps, or security labels that originate 3435 * in other namespaces. 3436 */ 3437 return !(mnt->mnt_flags & MNT_NOSUID) && check_mnt(real_mount(mnt)) && 3438 current_in_userns(mnt->mnt_sb->s_user_ns); 3439 } 3440 3441 static struct ns_common *mntns_get(struct task_struct *task) 3442 { 3443 struct ns_common *ns = NULL; 3444 struct nsproxy *nsproxy; 3445 3446 task_lock(task); 3447 nsproxy = task->nsproxy; 3448 if (nsproxy) { 3449 ns = &nsproxy->mnt_ns->ns; 3450 get_mnt_ns(to_mnt_ns(ns)); 3451 } 3452 task_unlock(task); 3453 3454 return ns; 3455 } 3456 3457 static void mntns_put(struct ns_common *ns) 3458 { 3459 put_mnt_ns(to_mnt_ns(ns)); 3460 } 3461 3462 static int mntns_install(struct nsproxy *nsproxy, struct ns_common *ns) 3463 { 3464 struct fs_struct *fs = current->fs; 3465 struct mnt_namespace *mnt_ns = to_mnt_ns(ns), *old_mnt_ns; 3466 struct path root; 3467 int err; 3468 3469 if (!ns_capable(mnt_ns->user_ns, CAP_SYS_ADMIN) || 3470 !ns_capable(current_user_ns(), CAP_SYS_CHROOT) || 3471 !ns_capable(current_user_ns(), CAP_SYS_ADMIN)) 3472 return -EPERM; 3473 3474 if (fs->users != 1) 3475 return -EINVAL; 3476 3477 get_mnt_ns(mnt_ns); 3478 old_mnt_ns = nsproxy->mnt_ns; 3479 nsproxy->mnt_ns = mnt_ns; 3480 3481 /* Find the root */ 3482 err = vfs_path_lookup(mnt_ns->root->mnt.mnt_root, &mnt_ns->root->mnt, 3483 "/", LOOKUP_DOWN, &root); 3484 if (err) { 3485 /* revert to old namespace */ 3486 nsproxy->mnt_ns = old_mnt_ns; 3487 put_mnt_ns(mnt_ns); 3488 return err; 3489 } 3490 3491 /* Update the pwd and root */ 3492 set_fs_pwd(fs, &root); 3493 set_fs_root(fs, &root); 3494 3495 path_put(&root); 3496 return 0; 3497 } 3498 3499 static struct user_namespace *mntns_owner(struct ns_common *ns) 3500 { 3501 return to_mnt_ns(ns)->user_ns; 3502 } 3503 3504 const struct proc_ns_operations mntns_operations = { 3505 .name = "mnt", 3506 .type = CLONE_NEWNS, 3507 .get = mntns_get, 3508 .put = mntns_put, 3509 .install = mntns_install, 3510 .owner = mntns_owner, 3511 }; 3512