1 /* 2 * linux/fs/namespace.c 3 * 4 * (C) Copyright Al Viro 2000, 2001 5 * Released under GPL v2. 6 * 7 * Based on code from fs/super.c, copyright Linus Torvalds and others. 8 * Heavily rewritten. 9 */ 10 11 #include <linux/syscalls.h> 12 #include <linux/export.h> 13 #include <linux/capability.h> 14 #include <linux/mnt_namespace.h> 15 #include <linux/user_namespace.h> 16 #include <linux/namei.h> 17 #include <linux/security.h> 18 #include <linux/cred.h> 19 #include <linux/idr.h> 20 #include <linux/init.h> /* init_rootfs */ 21 #include <linux/fs_struct.h> /* get_fs_root et.al. */ 22 #include <linux/fsnotify.h> /* fsnotify_vfsmount_delete */ 23 #include <linux/uaccess.h> 24 #include <linux/proc_ns.h> 25 #include <linux/magic.h> 26 #include <linux/bootmem.h> 27 #include <linux/task_work.h> 28 #include <linux/sched/task.h> 29 30 #include "pnode.h" 31 #include "internal.h" 32 33 /* Maximum number of mounts in a mount namespace */ 34 unsigned int sysctl_mount_max __read_mostly = 100000; 35 36 static unsigned int m_hash_mask __read_mostly; 37 static unsigned int m_hash_shift __read_mostly; 38 static unsigned int mp_hash_mask __read_mostly; 39 static unsigned int mp_hash_shift __read_mostly; 40 41 static __initdata unsigned long mhash_entries; 42 static int __init set_mhash_entries(char *str) 43 { 44 if (!str) 45 return 0; 46 mhash_entries = simple_strtoul(str, &str, 0); 47 return 1; 48 } 49 __setup("mhash_entries=", set_mhash_entries); 50 51 static __initdata unsigned long mphash_entries; 52 static int __init set_mphash_entries(char *str) 53 { 54 if (!str) 55 return 0; 56 mphash_entries = simple_strtoul(str, &str, 0); 57 return 1; 58 } 59 __setup("mphash_entries=", set_mphash_entries); 60 61 static u64 event; 62 static DEFINE_IDA(mnt_id_ida); 63 static DEFINE_IDA(mnt_group_ida); 64 static DEFINE_SPINLOCK(mnt_id_lock); 65 static int mnt_id_start = 0; 66 static int mnt_group_start = 1; 67 68 static struct hlist_head *mount_hashtable __read_mostly; 69 static struct hlist_head *mountpoint_hashtable __read_mostly; 70 static struct kmem_cache *mnt_cache __read_mostly; 71 static DECLARE_RWSEM(namespace_sem); 72 73 /* /sys/fs */ 74 struct kobject *fs_kobj; 75 EXPORT_SYMBOL_GPL(fs_kobj); 76 77 /* 78 * vfsmount lock may be taken for read to prevent changes to the 79 * vfsmount hash, ie. during mountpoint lookups or walking back 80 * up the tree. 81 * 82 * It should be taken for write in all cases where the vfsmount 83 * tree or hash is modified or when a vfsmount structure is modified. 84 */ 85 __cacheline_aligned_in_smp DEFINE_SEQLOCK(mount_lock); 86 87 static inline struct hlist_head *m_hash(struct vfsmount *mnt, struct dentry *dentry) 88 { 89 unsigned long tmp = ((unsigned long)mnt / L1_CACHE_BYTES); 90 tmp += ((unsigned long)dentry / L1_CACHE_BYTES); 91 tmp = tmp + (tmp >> m_hash_shift); 92 return &mount_hashtable[tmp & m_hash_mask]; 93 } 94 95 static inline struct hlist_head *mp_hash(struct dentry *dentry) 96 { 97 unsigned long tmp = ((unsigned long)dentry / L1_CACHE_BYTES); 98 tmp = tmp + (tmp >> mp_hash_shift); 99 return &mountpoint_hashtable[tmp & mp_hash_mask]; 100 } 101 102 static int mnt_alloc_id(struct mount *mnt) 103 { 104 int res; 105 106 retry: 107 ida_pre_get(&mnt_id_ida, GFP_KERNEL); 108 spin_lock(&mnt_id_lock); 109 res = ida_get_new_above(&mnt_id_ida, mnt_id_start, &mnt->mnt_id); 110 if (!res) 111 mnt_id_start = mnt->mnt_id + 1; 112 spin_unlock(&mnt_id_lock); 113 if (res == -EAGAIN) 114 goto retry; 115 116 return res; 117 } 118 119 static void mnt_free_id(struct mount *mnt) 120 { 121 int id = mnt->mnt_id; 122 spin_lock(&mnt_id_lock); 123 ida_remove(&mnt_id_ida, id); 124 if (mnt_id_start > id) 125 mnt_id_start = id; 126 spin_unlock(&mnt_id_lock); 127 } 128 129 /* 130 * Allocate a new peer group ID 131 * 132 * mnt_group_ida is protected by namespace_sem 133 */ 134 static int mnt_alloc_group_id(struct mount *mnt) 135 { 136 int res; 137 138 if (!ida_pre_get(&mnt_group_ida, GFP_KERNEL)) 139 return -ENOMEM; 140 141 res = ida_get_new_above(&mnt_group_ida, 142 mnt_group_start, 143 &mnt->mnt_group_id); 144 if (!res) 145 mnt_group_start = mnt->mnt_group_id + 1; 146 147 return res; 148 } 149 150 /* 151 * Release a peer group ID 152 */ 153 void mnt_release_group_id(struct mount *mnt) 154 { 155 int id = mnt->mnt_group_id; 156 ida_remove(&mnt_group_ida, id); 157 if (mnt_group_start > id) 158 mnt_group_start = id; 159 mnt->mnt_group_id = 0; 160 } 161 162 /* 163 * vfsmount lock must be held for read 164 */ 165 static inline void mnt_add_count(struct mount *mnt, int n) 166 { 167 #ifdef CONFIG_SMP 168 this_cpu_add(mnt->mnt_pcp->mnt_count, n); 169 #else 170 preempt_disable(); 171 mnt->mnt_count += n; 172 preempt_enable(); 173 #endif 174 } 175 176 /* 177 * vfsmount lock must be held for write 178 */ 179 unsigned int mnt_get_count(struct mount *mnt) 180 { 181 #ifdef CONFIG_SMP 182 unsigned int count = 0; 183 int cpu; 184 185 for_each_possible_cpu(cpu) { 186 count += per_cpu_ptr(mnt->mnt_pcp, cpu)->mnt_count; 187 } 188 189 return count; 190 #else 191 return mnt->mnt_count; 192 #endif 193 } 194 195 static void drop_mountpoint(struct fs_pin *p) 196 { 197 struct mount *m = container_of(p, struct mount, mnt_umount); 198 dput(m->mnt_ex_mountpoint); 199 pin_remove(p); 200 mntput(&m->mnt); 201 } 202 203 static struct mount *alloc_vfsmnt(const char *name) 204 { 205 struct mount *mnt = kmem_cache_zalloc(mnt_cache, GFP_KERNEL); 206 if (mnt) { 207 int err; 208 209 err = mnt_alloc_id(mnt); 210 if (err) 211 goto out_free_cache; 212 213 if (name) { 214 mnt->mnt_devname = kstrdup_const(name, GFP_KERNEL); 215 if (!mnt->mnt_devname) 216 goto out_free_id; 217 } 218 219 #ifdef CONFIG_SMP 220 mnt->mnt_pcp = alloc_percpu(struct mnt_pcp); 221 if (!mnt->mnt_pcp) 222 goto out_free_devname; 223 224 this_cpu_add(mnt->mnt_pcp->mnt_count, 1); 225 #else 226 mnt->mnt_count = 1; 227 mnt->mnt_writers = 0; 228 #endif 229 230 INIT_HLIST_NODE(&mnt->mnt_hash); 231 INIT_LIST_HEAD(&mnt->mnt_child); 232 INIT_LIST_HEAD(&mnt->mnt_mounts); 233 INIT_LIST_HEAD(&mnt->mnt_list); 234 INIT_LIST_HEAD(&mnt->mnt_expire); 235 INIT_LIST_HEAD(&mnt->mnt_share); 236 INIT_LIST_HEAD(&mnt->mnt_slave_list); 237 INIT_LIST_HEAD(&mnt->mnt_slave); 238 INIT_HLIST_NODE(&mnt->mnt_mp_list); 239 INIT_LIST_HEAD(&mnt->mnt_umounting); 240 init_fs_pin(&mnt->mnt_umount, drop_mountpoint); 241 } 242 return mnt; 243 244 #ifdef CONFIG_SMP 245 out_free_devname: 246 kfree_const(mnt->mnt_devname); 247 #endif 248 out_free_id: 249 mnt_free_id(mnt); 250 out_free_cache: 251 kmem_cache_free(mnt_cache, mnt); 252 return NULL; 253 } 254 255 /* 256 * Most r/o checks on a fs are for operations that take 257 * discrete amounts of time, like a write() or unlink(). 258 * We must keep track of when those operations start 259 * (for permission checks) and when they end, so that 260 * we can determine when writes are able to occur to 261 * a filesystem. 262 */ 263 /* 264 * __mnt_is_readonly: check whether a mount is read-only 265 * @mnt: the mount to check for its write status 266 * 267 * This shouldn't be used directly ouside of the VFS. 268 * It does not guarantee that the filesystem will stay 269 * r/w, just that it is right *now*. This can not and 270 * should not be used in place of IS_RDONLY(inode). 271 * mnt_want/drop_write() will _keep_ the filesystem 272 * r/w. 273 */ 274 int __mnt_is_readonly(struct vfsmount *mnt) 275 { 276 if (mnt->mnt_flags & MNT_READONLY) 277 return 1; 278 if (sb_rdonly(mnt->mnt_sb)) 279 return 1; 280 return 0; 281 } 282 EXPORT_SYMBOL_GPL(__mnt_is_readonly); 283 284 static inline void mnt_inc_writers(struct mount *mnt) 285 { 286 #ifdef CONFIG_SMP 287 this_cpu_inc(mnt->mnt_pcp->mnt_writers); 288 #else 289 mnt->mnt_writers++; 290 #endif 291 } 292 293 static inline void mnt_dec_writers(struct mount *mnt) 294 { 295 #ifdef CONFIG_SMP 296 this_cpu_dec(mnt->mnt_pcp->mnt_writers); 297 #else 298 mnt->mnt_writers--; 299 #endif 300 } 301 302 static unsigned int mnt_get_writers(struct mount *mnt) 303 { 304 #ifdef CONFIG_SMP 305 unsigned int count = 0; 306 int cpu; 307 308 for_each_possible_cpu(cpu) { 309 count += per_cpu_ptr(mnt->mnt_pcp, cpu)->mnt_writers; 310 } 311 312 return count; 313 #else 314 return mnt->mnt_writers; 315 #endif 316 } 317 318 static int mnt_is_readonly(struct vfsmount *mnt) 319 { 320 if (mnt->mnt_sb->s_readonly_remount) 321 return 1; 322 /* Order wrt setting s_flags/s_readonly_remount in do_remount() */ 323 smp_rmb(); 324 return __mnt_is_readonly(mnt); 325 } 326 327 /* 328 * Most r/o & frozen checks on a fs are for operations that take discrete 329 * amounts of time, like a write() or unlink(). We must keep track of when 330 * those operations start (for permission checks) and when they end, so that we 331 * can determine when writes are able to occur to a filesystem. 332 */ 333 /** 334 * __mnt_want_write - get write access to a mount without freeze protection 335 * @m: the mount on which to take a write 336 * 337 * This tells the low-level filesystem that a write is about to be performed to 338 * it, and makes sure that writes are allowed (mnt it read-write) before 339 * returning success. This operation does not protect against filesystem being 340 * frozen. When the write operation is finished, __mnt_drop_write() must be 341 * called. This is effectively a refcount. 342 */ 343 int __mnt_want_write(struct vfsmount *m) 344 { 345 struct mount *mnt = real_mount(m); 346 int ret = 0; 347 348 preempt_disable(); 349 mnt_inc_writers(mnt); 350 /* 351 * The store to mnt_inc_writers must be visible before we pass 352 * MNT_WRITE_HOLD loop below, so that the slowpath can see our 353 * incremented count after it has set MNT_WRITE_HOLD. 354 */ 355 smp_mb(); 356 while (READ_ONCE(mnt->mnt.mnt_flags) & MNT_WRITE_HOLD) 357 cpu_relax(); 358 /* 359 * After the slowpath clears MNT_WRITE_HOLD, mnt_is_readonly will 360 * be set to match its requirements. So we must not load that until 361 * MNT_WRITE_HOLD is cleared. 362 */ 363 smp_rmb(); 364 if (mnt_is_readonly(m)) { 365 mnt_dec_writers(mnt); 366 ret = -EROFS; 367 } 368 preempt_enable(); 369 370 return ret; 371 } 372 373 /** 374 * mnt_want_write - get write access to a mount 375 * @m: the mount on which to take a write 376 * 377 * This tells the low-level filesystem that a write is about to be performed to 378 * it, and makes sure that writes are allowed (mount is read-write, filesystem 379 * is not frozen) before returning success. When the write operation is 380 * finished, mnt_drop_write() must be called. This is effectively a refcount. 381 */ 382 int mnt_want_write(struct vfsmount *m) 383 { 384 int ret; 385 386 sb_start_write(m->mnt_sb); 387 ret = __mnt_want_write(m); 388 if (ret) 389 sb_end_write(m->mnt_sb); 390 return ret; 391 } 392 EXPORT_SYMBOL_GPL(mnt_want_write); 393 394 /** 395 * mnt_clone_write - get write access to a mount 396 * @mnt: the mount on which to take a write 397 * 398 * This is effectively like mnt_want_write, except 399 * it must only be used to take an extra write reference 400 * on a mountpoint that we already know has a write reference 401 * on it. This allows some optimisation. 402 * 403 * After finished, mnt_drop_write must be called as usual to 404 * drop the reference. 405 */ 406 int mnt_clone_write(struct vfsmount *mnt) 407 { 408 /* superblock may be r/o */ 409 if (__mnt_is_readonly(mnt)) 410 return -EROFS; 411 preempt_disable(); 412 mnt_inc_writers(real_mount(mnt)); 413 preempt_enable(); 414 return 0; 415 } 416 EXPORT_SYMBOL_GPL(mnt_clone_write); 417 418 /** 419 * __mnt_want_write_file - get write access to a file's mount 420 * @file: the file who's mount on which to take a write 421 * 422 * This is like __mnt_want_write, but it takes a file and can 423 * do some optimisations if the file is open for write already 424 */ 425 int __mnt_want_write_file(struct file *file) 426 { 427 if (!(file->f_mode & FMODE_WRITER)) 428 return __mnt_want_write(file->f_path.mnt); 429 else 430 return mnt_clone_write(file->f_path.mnt); 431 } 432 433 /** 434 * mnt_want_write_file_path - get write access to a file's mount 435 * @file: the file who's mount on which to take a write 436 * 437 * This is like mnt_want_write, but it takes a file and can 438 * do some optimisations if the file is open for write already 439 * 440 * Called by the vfs for cases when we have an open file at hand, but will do an 441 * inode operation on it (important distinction for files opened on overlayfs, 442 * since the file operations will come from the real underlying file, while 443 * inode operations come from the overlay). 444 */ 445 int mnt_want_write_file_path(struct file *file) 446 { 447 int ret; 448 449 sb_start_write(file->f_path.mnt->mnt_sb); 450 ret = __mnt_want_write_file(file); 451 if (ret) 452 sb_end_write(file->f_path.mnt->mnt_sb); 453 return ret; 454 } 455 456 static inline int may_write_real(struct file *file) 457 { 458 struct dentry *dentry = file->f_path.dentry; 459 struct dentry *upperdentry; 460 461 /* Writable file? */ 462 if (file->f_mode & FMODE_WRITER) 463 return 0; 464 465 /* Not overlayfs? */ 466 if (likely(!(dentry->d_flags & DCACHE_OP_REAL))) 467 return 0; 468 469 /* File refers to upper, writable layer? */ 470 upperdentry = d_real(dentry, NULL, 0, D_REAL_UPPER); 471 if (upperdentry && 472 (file_inode(file) == d_inode(upperdentry) || 473 file_inode(file) == d_inode(dentry))) 474 return 0; 475 476 /* Lower layer: can't write to real file, sorry... */ 477 return -EPERM; 478 } 479 480 /** 481 * mnt_want_write_file - get write access to a file's mount 482 * @file: the file who's mount on which to take a write 483 * 484 * This is like mnt_want_write, but it takes a file and can 485 * do some optimisations if the file is open for write already 486 * 487 * Mostly called by filesystems from their ioctl operation before performing 488 * modification. On overlayfs this needs to check if the file is on a read-only 489 * lower layer and deny access in that case. 490 */ 491 int mnt_want_write_file(struct file *file) 492 { 493 int ret; 494 495 ret = may_write_real(file); 496 if (!ret) { 497 sb_start_write(file_inode(file)->i_sb); 498 ret = __mnt_want_write_file(file); 499 if (ret) 500 sb_end_write(file_inode(file)->i_sb); 501 } 502 return ret; 503 } 504 EXPORT_SYMBOL_GPL(mnt_want_write_file); 505 506 /** 507 * __mnt_drop_write - give up write access to a mount 508 * @mnt: the mount on which to give up write access 509 * 510 * Tells the low-level filesystem that we are done 511 * performing writes to it. Must be matched with 512 * __mnt_want_write() call above. 513 */ 514 void __mnt_drop_write(struct vfsmount *mnt) 515 { 516 preempt_disable(); 517 mnt_dec_writers(real_mount(mnt)); 518 preempt_enable(); 519 } 520 521 /** 522 * mnt_drop_write - give up write access to a mount 523 * @mnt: the mount on which to give up write access 524 * 525 * Tells the low-level filesystem that we are done performing writes to it and 526 * also allows filesystem to be frozen again. Must be matched with 527 * mnt_want_write() call above. 528 */ 529 void mnt_drop_write(struct vfsmount *mnt) 530 { 531 __mnt_drop_write(mnt); 532 sb_end_write(mnt->mnt_sb); 533 } 534 EXPORT_SYMBOL_GPL(mnt_drop_write); 535 536 void __mnt_drop_write_file(struct file *file) 537 { 538 __mnt_drop_write(file->f_path.mnt); 539 } 540 541 void mnt_drop_write_file_path(struct file *file) 542 { 543 mnt_drop_write(file->f_path.mnt); 544 } 545 546 void mnt_drop_write_file(struct file *file) 547 { 548 __mnt_drop_write(file->f_path.mnt); 549 sb_end_write(file_inode(file)->i_sb); 550 } 551 EXPORT_SYMBOL(mnt_drop_write_file); 552 553 static int mnt_make_readonly(struct mount *mnt) 554 { 555 int ret = 0; 556 557 lock_mount_hash(); 558 mnt->mnt.mnt_flags |= MNT_WRITE_HOLD; 559 /* 560 * After storing MNT_WRITE_HOLD, we'll read the counters. This store 561 * should be visible before we do. 562 */ 563 smp_mb(); 564 565 /* 566 * With writers on hold, if this value is zero, then there are 567 * definitely no active writers (although held writers may subsequently 568 * increment the count, they'll have to wait, and decrement it after 569 * seeing MNT_READONLY). 570 * 571 * It is OK to have counter incremented on one CPU and decremented on 572 * another: the sum will add up correctly. The danger would be when we 573 * sum up each counter, if we read a counter before it is incremented, 574 * but then read another CPU's count which it has been subsequently 575 * decremented from -- we would see more decrements than we should. 576 * MNT_WRITE_HOLD protects against this scenario, because 577 * mnt_want_write first increments count, then smp_mb, then spins on 578 * MNT_WRITE_HOLD, so it can't be decremented by another CPU while 579 * we're counting up here. 580 */ 581 if (mnt_get_writers(mnt) > 0) 582 ret = -EBUSY; 583 else 584 mnt->mnt.mnt_flags |= MNT_READONLY; 585 /* 586 * MNT_READONLY must become visible before ~MNT_WRITE_HOLD, so writers 587 * that become unheld will see MNT_READONLY. 588 */ 589 smp_wmb(); 590 mnt->mnt.mnt_flags &= ~MNT_WRITE_HOLD; 591 unlock_mount_hash(); 592 return ret; 593 } 594 595 static void __mnt_unmake_readonly(struct mount *mnt) 596 { 597 lock_mount_hash(); 598 mnt->mnt.mnt_flags &= ~MNT_READONLY; 599 unlock_mount_hash(); 600 } 601 602 int sb_prepare_remount_readonly(struct super_block *sb) 603 { 604 struct mount *mnt; 605 int err = 0; 606 607 /* Racy optimization. Recheck the counter under MNT_WRITE_HOLD */ 608 if (atomic_long_read(&sb->s_remove_count)) 609 return -EBUSY; 610 611 lock_mount_hash(); 612 list_for_each_entry(mnt, &sb->s_mounts, mnt_instance) { 613 if (!(mnt->mnt.mnt_flags & MNT_READONLY)) { 614 mnt->mnt.mnt_flags |= MNT_WRITE_HOLD; 615 smp_mb(); 616 if (mnt_get_writers(mnt) > 0) { 617 err = -EBUSY; 618 break; 619 } 620 } 621 } 622 if (!err && atomic_long_read(&sb->s_remove_count)) 623 err = -EBUSY; 624 625 if (!err) { 626 sb->s_readonly_remount = 1; 627 smp_wmb(); 628 } 629 list_for_each_entry(mnt, &sb->s_mounts, mnt_instance) { 630 if (mnt->mnt.mnt_flags & MNT_WRITE_HOLD) 631 mnt->mnt.mnt_flags &= ~MNT_WRITE_HOLD; 632 } 633 unlock_mount_hash(); 634 635 return err; 636 } 637 638 static void free_vfsmnt(struct mount *mnt) 639 { 640 kfree_const(mnt->mnt_devname); 641 #ifdef CONFIG_SMP 642 free_percpu(mnt->mnt_pcp); 643 #endif 644 kmem_cache_free(mnt_cache, mnt); 645 } 646 647 static void delayed_free_vfsmnt(struct rcu_head *head) 648 { 649 free_vfsmnt(container_of(head, struct mount, mnt_rcu)); 650 } 651 652 /* call under rcu_read_lock */ 653 int __legitimize_mnt(struct vfsmount *bastard, unsigned seq) 654 { 655 struct mount *mnt; 656 if (read_seqretry(&mount_lock, seq)) 657 return 1; 658 if (bastard == NULL) 659 return 0; 660 mnt = real_mount(bastard); 661 mnt_add_count(mnt, 1); 662 if (likely(!read_seqretry(&mount_lock, seq))) 663 return 0; 664 if (bastard->mnt_flags & MNT_SYNC_UMOUNT) { 665 mnt_add_count(mnt, -1); 666 return 1; 667 } 668 return -1; 669 } 670 671 /* call under rcu_read_lock */ 672 bool legitimize_mnt(struct vfsmount *bastard, unsigned seq) 673 { 674 int res = __legitimize_mnt(bastard, seq); 675 if (likely(!res)) 676 return true; 677 if (unlikely(res < 0)) { 678 rcu_read_unlock(); 679 mntput(bastard); 680 rcu_read_lock(); 681 } 682 return false; 683 } 684 685 /* 686 * find the first mount at @dentry on vfsmount @mnt. 687 * call under rcu_read_lock() 688 */ 689 struct mount *__lookup_mnt(struct vfsmount *mnt, struct dentry *dentry) 690 { 691 struct hlist_head *head = m_hash(mnt, dentry); 692 struct mount *p; 693 694 hlist_for_each_entry_rcu(p, head, mnt_hash) 695 if (&p->mnt_parent->mnt == mnt && p->mnt_mountpoint == dentry) 696 return p; 697 return NULL; 698 } 699 700 /* 701 * lookup_mnt - Return the first child mount mounted at path 702 * 703 * "First" means first mounted chronologically. If you create the 704 * following mounts: 705 * 706 * mount /dev/sda1 /mnt 707 * mount /dev/sda2 /mnt 708 * mount /dev/sda3 /mnt 709 * 710 * Then lookup_mnt() on the base /mnt dentry in the root mount will 711 * return successively the root dentry and vfsmount of /dev/sda1, then 712 * /dev/sda2, then /dev/sda3, then NULL. 713 * 714 * lookup_mnt takes a reference to the found vfsmount. 715 */ 716 struct vfsmount *lookup_mnt(const struct path *path) 717 { 718 struct mount *child_mnt; 719 struct vfsmount *m; 720 unsigned seq; 721 722 rcu_read_lock(); 723 do { 724 seq = read_seqbegin(&mount_lock); 725 child_mnt = __lookup_mnt(path->mnt, path->dentry); 726 m = child_mnt ? &child_mnt->mnt : NULL; 727 } while (!legitimize_mnt(m, seq)); 728 rcu_read_unlock(); 729 return m; 730 } 731 732 /* 733 * __is_local_mountpoint - Test to see if dentry is a mountpoint in the 734 * current mount namespace. 735 * 736 * The common case is dentries are not mountpoints at all and that 737 * test is handled inline. For the slow case when we are actually 738 * dealing with a mountpoint of some kind, walk through all of the 739 * mounts in the current mount namespace and test to see if the dentry 740 * is a mountpoint. 741 * 742 * The mount_hashtable is not usable in the context because we 743 * need to identify all mounts that may be in the current mount 744 * namespace not just a mount that happens to have some specified 745 * parent mount. 746 */ 747 bool __is_local_mountpoint(struct dentry *dentry) 748 { 749 struct mnt_namespace *ns = current->nsproxy->mnt_ns; 750 struct mount *mnt; 751 bool is_covered = false; 752 753 if (!d_mountpoint(dentry)) 754 goto out; 755 756 down_read(&namespace_sem); 757 list_for_each_entry(mnt, &ns->list, mnt_list) { 758 is_covered = (mnt->mnt_mountpoint == dentry); 759 if (is_covered) 760 break; 761 } 762 up_read(&namespace_sem); 763 out: 764 return is_covered; 765 } 766 767 static struct mountpoint *lookup_mountpoint(struct dentry *dentry) 768 { 769 struct hlist_head *chain = mp_hash(dentry); 770 struct mountpoint *mp; 771 772 hlist_for_each_entry(mp, chain, m_hash) { 773 if (mp->m_dentry == dentry) { 774 /* might be worth a WARN_ON() */ 775 if (d_unlinked(dentry)) 776 return ERR_PTR(-ENOENT); 777 mp->m_count++; 778 return mp; 779 } 780 } 781 return NULL; 782 } 783 784 static struct mountpoint *get_mountpoint(struct dentry *dentry) 785 { 786 struct mountpoint *mp, *new = NULL; 787 int ret; 788 789 if (d_mountpoint(dentry)) { 790 mountpoint: 791 read_seqlock_excl(&mount_lock); 792 mp = lookup_mountpoint(dentry); 793 read_sequnlock_excl(&mount_lock); 794 if (mp) 795 goto done; 796 } 797 798 if (!new) 799 new = kmalloc(sizeof(struct mountpoint), GFP_KERNEL); 800 if (!new) 801 return ERR_PTR(-ENOMEM); 802 803 804 /* Exactly one processes may set d_mounted */ 805 ret = d_set_mounted(dentry); 806 807 /* Someone else set d_mounted? */ 808 if (ret == -EBUSY) 809 goto mountpoint; 810 811 /* The dentry is not available as a mountpoint? */ 812 mp = ERR_PTR(ret); 813 if (ret) 814 goto done; 815 816 /* Add the new mountpoint to the hash table */ 817 read_seqlock_excl(&mount_lock); 818 new->m_dentry = dentry; 819 new->m_count = 1; 820 hlist_add_head(&new->m_hash, mp_hash(dentry)); 821 INIT_HLIST_HEAD(&new->m_list); 822 read_sequnlock_excl(&mount_lock); 823 824 mp = new; 825 new = NULL; 826 done: 827 kfree(new); 828 return mp; 829 } 830 831 static void put_mountpoint(struct mountpoint *mp) 832 { 833 if (!--mp->m_count) { 834 struct dentry *dentry = mp->m_dentry; 835 BUG_ON(!hlist_empty(&mp->m_list)); 836 spin_lock(&dentry->d_lock); 837 dentry->d_flags &= ~DCACHE_MOUNTED; 838 spin_unlock(&dentry->d_lock); 839 hlist_del(&mp->m_hash); 840 kfree(mp); 841 } 842 } 843 844 static inline int check_mnt(struct mount *mnt) 845 { 846 return mnt->mnt_ns == current->nsproxy->mnt_ns; 847 } 848 849 /* 850 * vfsmount lock must be held for write 851 */ 852 static void touch_mnt_namespace(struct mnt_namespace *ns) 853 { 854 if (ns) { 855 ns->event = ++event; 856 wake_up_interruptible(&ns->poll); 857 } 858 } 859 860 /* 861 * vfsmount lock must be held for write 862 */ 863 static void __touch_mnt_namespace(struct mnt_namespace *ns) 864 { 865 if (ns && ns->event != event) { 866 ns->event = event; 867 wake_up_interruptible(&ns->poll); 868 } 869 } 870 871 /* 872 * vfsmount lock must be held for write 873 */ 874 static void unhash_mnt(struct mount *mnt) 875 { 876 mnt->mnt_parent = mnt; 877 mnt->mnt_mountpoint = mnt->mnt.mnt_root; 878 list_del_init(&mnt->mnt_child); 879 hlist_del_init_rcu(&mnt->mnt_hash); 880 hlist_del_init(&mnt->mnt_mp_list); 881 put_mountpoint(mnt->mnt_mp); 882 mnt->mnt_mp = NULL; 883 } 884 885 /* 886 * vfsmount lock must be held for write 887 */ 888 static void detach_mnt(struct mount *mnt, struct path *old_path) 889 { 890 old_path->dentry = mnt->mnt_mountpoint; 891 old_path->mnt = &mnt->mnt_parent->mnt; 892 unhash_mnt(mnt); 893 } 894 895 /* 896 * vfsmount lock must be held for write 897 */ 898 static void umount_mnt(struct mount *mnt) 899 { 900 /* old mountpoint will be dropped when we can do that */ 901 mnt->mnt_ex_mountpoint = mnt->mnt_mountpoint; 902 unhash_mnt(mnt); 903 } 904 905 /* 906 * vfsmount lock must be held for write 907 */ 908 void mnt_set_mountpoint(struct mount *mnt, 909 struct mountpoint *mp, 910 struct mount *child_mnt) 911 { 912 mp->m_count++; 913 mnt_add_count(mnt, 1); /* essentially, that's mntget */ 914 child_mnt->mnt_mountpoint = dget(mp->m_dentry); 915 child_mnt->mnt_parent = mnt; 916 child_mnt->mnt_mp = mp; 917 hlist_add_head(&child_mnt->mnt_mp_list, &mp->m_list); 918 } 919 920 static void __attach_mnt(struct mount *mnt, struct mount *parent) 921 { 922 hlist_add_head_rcu(&mnt->mnt_hash, 923 m_hash(&parent->mnt, mnt->mnt_mountpoint)); 924 list_add_tail(&mnt->mnt_child, &parent->mnt_mounts); 925 } 926 927 /* 928 * vfsmount lock must be held for write 929 */ 930 static void attach_mnt(struct mount *mnt, 931 struct mount *parent, 932 struct mountpoint *mp) 933 { 934 mnt_set_mountpoint(parent, mp, mnt); 935 __attach_mnt(mnt, parent); 936 } 937 938 void mnt_change_mountpoint(struct mount *parent, struct mountpoint *mp, struct mount *mnt) 939 { 940 struct mountpoint *old_mp = mnt->mnt_mp; 941 struct dentry *old_mountpoint = mnt->mnt_mountpoint; 942 struct mount *old_parent = mnt->mnt_parent; 943 944 list_del_init(&mnt->mnt_child); 945 hlist_del_init(&mnt->mnt_mp_list); 946 hlist_del_init_rcu(&mnt->mnt_hash); 947 948 attach_mnt(mnt, parent, mp); 949 950 put_mountpoint(old_mp); 951 952 /* 953 * Safely avoid even the suggestion this code might sleep or 954 * lock the mount hash by taking advantage of the knowledge that 955 * mnt_change_mountpoint will not release the final reference 956 * to a mountpoint. 957 * 958 * During mounting, the mount passed in as the parent mount will 959 * continue to use the old mountpoint and during unmounting, the 960 * old mountpoint will continue to exist until namespace_unlock, 961 * which happens well after mnt_change_mountpoint. 962 */ 963 spin_lock(&old_mountpoint->d_lock); 964 old_mountpoint->d_lockref.count--; 965 spin_unlock(&old_mountpoint->d_lock); 966 967 mnt_add_count(old_parent, -1); 968 } 969 970 /* 971 * vfsmount lock must be held for write 972 */ 973 static void commit_tree(struct mount *mnt) 974 { 975 struct mount *parent = mnt->mnt_parent; 976 struct mount *m; 977 LIST_HEAD(head); 978 struct mnt_namespace *n = parent->mnt_ns; 979 980 BUG_ON(parent == mnt); 981 982 list_add_tail(&head, &mnt->mnt_list); 983 list_for_each_entry(m, &head, mnt_list) 984 m->mnt_ns = n; 985 986 list_splice(&head, n->list.prev); 987 988 n->mounts += n->pending_mounts; 989 n->pending_mounts = 0; 990 991 __attach_mnt(mnt, parent); 992 touch_mnt_namespace(n); 993 } 994 995 static struct mount *next_mnt(struct mount *p, struct mount *root) 996 { 997 struct list_head *next = p->mnt_mounts.next; 998 if (next == &p->mnt_mounts) { 999 while (1) { 1000 if (p == root) 1001 return NULL; 1002 next = p->mnt_child.next; 1003 if (next != &p->mnt_parent->mnt_mounts) 1004 break; 1005 p = p->mnt_parent; 1006 } 1007 } 1008 return list_entry(next, struct mount, mnt_child); 1009 } 1010 1011 static struct mount *skip_mnt_tree(struct mount *p) 1012 { 1013 struct list_head *prev = p->mnt_mounts.prev; 1014 while (prev != &p->mnt_mounts) { 1015 p = list_entry(prev, struct mount, mnt_child); 1016 prev = p->mnt_mounts.prev; 1017 } 1018 return p; 1019 } 1020 1021 struct vfsmount * 1022 vfs_kern_mount(struct file_system_type *type, int flags, const char *name, void *data) 1023 { 1024 struct mount *mnt; 1025 struct dentry *root; 1026 1027 if (!type) 1028 return ERR_PTR(-ENODEV); 1029 1030 mnt = alloc_vfsmnt(name); 1031 if (!mnt) 1032 return ERR_PTR(-ENOMEM); 1033 1034 if (flags & SB_KERNMOUNT) 1035 mnt->mnt.mnt_flags = MNT_INTERNAL; 1036 1037 root = mount_fs(type, flags, name, data); 1038 if (IS_ERR(root)) { 1039 mnt_free_id(mnt); 1040 free_vfsmnt(mnt); 1041 return ERR_CAST(root); 1042 } 1043 1044 mnt->mnt.mnt_root = root; 1045 mnt->mnt.mnt_sb = root->d_sb; 1046 mnt->mnt_mountpoint = mnt->mnt.mnt_root; 1047 mnt->mnt_parent = mnt; 1048 lock_mount_hash(); 1049 list_add_tail(&mnt->mnt_instance, &root->d_sb->s_mounts); 1050 unlock_mount_hash(); 1051 return &mnt->mnt; 1052 } 1053 EXPORT_SYMBOL_GPL(vfs_kern_mount); 1054 1055 struct vfsmount * 1056 vfs_submount(const struct dentry *mountpoint, struct file_system_type *type, 1057 const char *name, void *data) 1058 { 1059 /* Until it is worked out how to pass the user namespace 1060 * through from the parent mount to the submount don't support 1061 * unprivileged mounts with submounts. 1062 */ 1063 if (mountpoint->d_sb->s_user_ns != &init_user_ns) 1064 return ERR_PTR(-EPERM); 1065 1066 return vfs_kern_mount(type, SB_SUBMOUNT, name, data); 1067 } 1068 EXPORT_SYMBOL_GPL(vfs_submount); 1069 1070 static struct mount *clone_mnt(struct mount *old, struct dentry *root, 1071 int flag) 1072 { 1073 struct super_block *sb = old->mnt.mnt_sb; 1074 struct mount *mnt; 1075 int err; 1076 1077 mnt = alloc_vfsmnt(old->mnt_devname); 1078 if (!mnt) 1079 return ERR_PTR(-ENOMEM); 1080 1081 if (flag & (CL_SLAVE | CL_PRIVATE | CL_SHARED_TO_SLAVE)) 1082 mnt->mnt_group_id = 0; /* not a peer of original */ 1083 else 1084 mnt->mnt_group_id = old->mnt_group_id; 1085 1086 if ((flag & CL_MAKE_SHARED) && !mnt->mnt_group_id) { 1087 err = mnt_alloc_group_id(mnt); 1088 if (err) 1089 goto out_free; 1090 } 1091 1092 mnt->mnt.mnt_flags = old->mnt.mnt_flags & ~(MNT_WRITE_HOLD|MNT_MARKED); 1093 /* Don't allow unprivileged users to change mount flags */ 1094 if (flag & CL_UNPRIVILEGED) { 1095 mnt->mnt.mnt_flags |= MNT_LOCK_ATIME; 1096 1097 if (mnt->mnt.mnt_flags & MNT_READONLY) 1098 mnt->mnt.mnt_flags |= MNT_LOCK_READONLY; 1099 1100 if (mnt->mnt.mnt_flags & MNT_NODEV) 1101 mnt->mnt.mnt_flags |= MNT_LOCK_NODEV; 1102 1103 if (mnt->mnt.mnt_flags & MNT_NOSUID) 1104 mnt->mnt.mnt_flags |= MNT_LOCK_NOSUID; 1105 1106 if (mnt->mnt.mnt_flags & MNT_NOEXEC) 1107 mnt->mnt.mnt_flags |= MNT_LOCK_NOEXEC; 1108 } 1109 1110 /* Don't allow unprivileged users to reveal what is under a mount */ 1111 if ((flag & CL_UNPRIVILEGED) && 1112 (!(flag & CL_EXPIRE) || list_empty(&old->mnt_expire))) 1113 mnt->mnt.mnt_flags |= MNT_LOCKED; 1114 1115 atomic_inc(&sb->s_active); 1116 mnt->mnt.mnt_sb = sb; 1117 mnt->mnt.mnt_root = dget(root); 1118 mnt->mnt_mountpoint = mnt->mnt.mnt_root; 1119 mnt->mnt_parent = mnt; 1120 lock_mount_hash(); 1121 list_add_tail(&mnt->mnt_instance, &sb->s_mounts); 1122 unlock_mount_hash(); 1123 1124 if ((flag & CL_SLAVE) || 1125 ((flag & CL_SHARED_TO_SLAVE) && IS_MNT_SHARED(old))) { 1126 list_add(&mnt->mnt_slave, &old->mnt_slave_list); 1127 mnt->mnt_master = old; 1128 CLEAR_MNT_SHARED(mnt); 1129 } else if (!(flag & CL_PRIVATE)) { 1130 if ((flag & CL_MAKE_SHARED) || IS_MNT_SHARED(old)) 1131 list_add(&mnt->mnt_share, &old->mnt_share); 1132 if (IS_MNT_SLAVE(old)) 1133 list_add(&mnt->mnt_slave, &old->mnt_slave); 1134 mnt->mnt_master = old->mnt_master; 1135 } else { 1136 CLEAR_MNT_SHARED(mnt); 1137 } 1138 if (flag & CL_MAKE_SHARED) 1139 set_mnt_shared(mnt); 1140 1141 /* stick the duplicate mount on the same expiry list 1142 * as the original if that was on one */ 1143 if (flag & CL_EXPIRE) { 1144 if (!list_empty(&old->mnt_expire)) 1145 list_add(&mnt->mnt_expire, &old->mnt_expire); 1146 } 1147 1148 return mnt; 1149 1150 out_free: 1151 mnt_free_id(mnt); 1152 free_vfsmnt(mnt); 1153 return ERR_PTR(err); 1154 } 1155 1156 static void cleanup_mnt(struct mount *mnt) 1157 { 1158 /* 1159 * This probably indicates that somebody messed 1160 * up a mnt_want/drop_write() pair. If this 1161 * happens, the filesystem was probably unable 1162 * to make r/w->r/o transitions. 1163 */ 1164 /* 1165 * The locking used to deal with mnt_count decrement provides barriers, 1166 * so mnt_get_writers() below is safe. 1167 */ 1168 WARN_ON(mnt_get_writers(mnt)); 1169 if (unlikely(mnt->mnt_pins.first)) 1170 mnt_pin_kill(mnt); 1171 fsnotify_vfsmount_delete(&mnt->mnt); 1172 dput(mnt->mnt.mnt_root); 1173 deactivate_super(mnt->mnt.mnt_sb); 1174 mnt_free_id(mnt); 1175 call_rcu(&mnt->mnt_rcu, delayed_free_vfsmnt); 1176 } 1177 1178 static void __cleanup_mnt(struct rcu_head *head) 1179 { 1180 cleanup_mnt(container_of(head, struct mount, mnt_rcu)); 1181 } 1182 1183 static LLIST_HEAD(delayed_mntput_list); 1184 static void delayed_mntput(struct work_struct *unused) 1185 { 1186 struct llist_node *node = llist_del_all(&delayed_mntput_list); 1187 struct mount *m, *t; 1188 1189 llist_for_each_entry_safe(m, t, node, mnt_llist) 1190 cleanup_mnt(m); 1191 } 1192 static DECLARE_DELAYED_WORK(delayed_mntput_work, delayed_mntput); 1193 1194 static void mntput_no_expire(struct mount *mnt) 1195 { 1196 rcu_read_lock(); 1197 mnt_add_count(mnt, -1); 1198 if (likely(mnt->mnt_ns)) { /* shouldn't be the last one */ 1199 rcu_read_unlock(); 1200 return; 1201 } 1202 lock_mount_hash(); 1203 if (mnt_get_count(mnt)) { 1204 rcu_read_unlock(); 1205 unlock_mount_hash(); 1206 return; 1207 } 1208 if (unlikely(mnt->mnt.mnt_flags & MNT_DOOMED)) { 1209 rcu_read_unlock(); 1210 unlock_mount_hash(); 1211 return; 1212 } 1213 mnt->mnt.mnt_flags |= MNT_DOOMED; 1214 rcu_read_unlock(); 1215 1216 list_del(&mnt->mnt_instance); 1217 1218 if (unlikely(!list_empty(&mnt->mnt_mounts))) { 1219 struct mount *p, *tmp; 1220 list_for_each_entry_safe(p, tmp, &mnt->mnt_mounts, mnt_child) { 1221 umount_mnt(p); 1222 } 1223 } 1224 unlock_mount_hash(); 1225 1226 if (likely(!(mnt->mnt.mnt_flags & MNT_INTERNAL))) { 1227 struct task_struct *task = current; 1228 if (likely(!(task->flags & PF_KTHREAD))) { 1229 init_task_work(&mnt->mnt_rcu, __cleanup_mnt); 1230 if (!task_work_add(task, &mnt->mnt_rcu, true)) 1231 return; 1232 } 1233 if (llist_add(&mnt->mnt_llist, &delayed_mntput_list)) 1234 schedule_delayed_work(&delayed_mntput_work, 1); 1235 return; 1236 } 1237 cleanup_mnt(mnt); 1238 } 1239 1240 void mntput(struct vfsmount *mnt) 1241 { 1242 if (mnt) { 1243 struct mount *m = real_mount(mnt); 1244 /* avoid cacheline pingpong, hope gcc doesn't get "smart" */ 1245 if (unlikely(m->mnt_expiry_mark)) 1246 m->mnt_expiry_mark = 0; 1247 mntput_no_expire(m); 1248 } 1249 } 1250 EXPORT_SYMBOL(mntput); 1251 1252 struct vfsmount *mntget(struct vfsmount *mnt) 1253 { 1254 if (mnt) 1255 mnt_add_count(real_mount(mnt), 1); 1256 return mnt; 1257 } 1258 EXPORT_SYMBOL(mntget); 1259 1260 /* path_is_mountpoint() - Check if path is a mount in the current 1261 * namespace. 1262 * 1263 * d_mountpoint() can only be used reliably to establish if a dentry is 1264 * not mounted in any namespace and that common case is handled inline. 1265 * d_mountpoint() isn't aware of the possibility there may be multiple 1266 * mounts using a given dentry in a different namespace. This function 1267 * checks if the passed in path is a mountpoint rather than the dentry 1268 * alone. 1269 */ 1270 bool path_is_mountpoint(const struct path *path) 1271 { 1272 unsigned seq; 1273 bool res; 1274 1275 if (!d_mountpoint(path->dentry)) 1276 return false; 1277 1278 rcu_read_lock(); 1279 do { 1280 seq = read_seqbegin(&mount_lock); 1281 res = __path_is_mountpoint(path); 1282 } while (read_seqretry(&mount_lock, seq)); 1283 rcu_read_unlock(); 1284 1285 return res; 1286 } 1287 EXPORT_SYMBOL(path_is_mountpoint); 1288 1289 struct vfsmount *mnt_clone_internal(const struct path *path) 1290 { 1291 struct mount *p; 1292 p = clone_mnt(real_mount(path->mnt), path->dentry, CL_PRIVATE); 1293 if (IS_ERR(p)) 1294 return ERR_CAST(p); 1295 p->mnt.mnt_flags |= MNT_INTERNAL; 1296 return &p->mnt; 1297 } 1298 1299 #ifdef CONFIG_PROC_FS 1300 /* iterator; we want it to have access to namespace_sem, thus here... */ 1301 static void *m_start(struct seq_file *m, loff_t *pos) 1302 { 1303 struct proc_mounts *p = m->private; 1304 1305 down_read(&namespace_sem); 1306 if (p->cached_event == p->ns->event) { 1307 void *v = p->cached_mount; 1308 if (*pos == p->cached_index) 1309 return v; 1310 if (*pos == p->cached_index + 1) { 1311 v = seq_list_next(v, &p->ns->list, &p->cached_index); 1312 return p->cached_mount = v; 1313 } 1314 } 1315 1316 p->cached_event = p->ns->event; 1317 p->cached_mount = seq_list_start(&p->ns->list, *pos); 1318 p->cached_index = *pos; 1319 return p->cached_mount; 1320 } 1321 1322 static void *m_next(struct seq_file *m, void *v, loff_t *pos) 1323 { 1324 struct proc_mounts *p = m->private; 1325 1326 p->cached_mount = seq_list_next(v, &p->ns->list, pos); 1327 p->cached_index = *pos; 1328 return p->cached_mount; 1329 } 1330 1331 static void m_stop(struct seq_file *m, void *v) 1332 { 1333 up_read(&namespace_sem); 1334 } 1335 1336 static int m_show(struct seq_file *m, void *v) 1337 { 1338 struct proc_mounts *p = m->private; 1339 struct mount *r = list_entry(v, struct mount, mnt_list); 1340 return p->show(m, &r->mnt); 1341 } 1342 1343 const struct seq_operations mounts_op = { 1344 .start = m_start, 1345 .next = m_next, 1346 .stop = m_stop, 1347 .show = m_show, 1348 }; 1349 #endif /* CONFIG_PROC_FS */ 1350 1351 /** 1352 * may_umount_tree - check if a mount tree is busy 1353 * @mnt: root of mount tree 1354 * 1355 * This is called to check if a tree of mounts has any 1356 * open files, pwds, chroots or sub mounts that are 1357 * busy. 1358 */ 1359 int may_umount_tree(struct vfsmount *m) 1360 { 1361 struct mount *mnt = real_mount(m); 1362 int actual_refs = 0; 1363 int minimum_refs = 0; 1364 struct mount *p; 1365 BUG_ON(!m); 1366 1367 /* write lock needed for mnt_get_count */ 1368 lock_mount_hash(); 1369 for (p = mnt; p; p = next_mnt(p, mnt)) { 1370 actual_refs += mnt_get_count(p); 1371 minimum_refs += 2; 1372 } 1373 unlock_mount_hash(); 1374 1375 if (actual_refs > minimum_refs) 1376 return 0; 1377 1378 return 1; 1379 } 1380 1381 EXPORT_SYMBOL(may_umount_tree); 1382 1383 /** 1384 * may_umount - check if a mount point is busy 1385 * @mnt: root of mount 1386 * 1387 * This is called to check if a mount point has any 1388 * open files, pwds, chroots or sub mounts. If the 1389 * mount has sub mounts this will return busy 1390 * regardless of whether the sub mounts are busy. 1391 * 1392 * Doesn't take quota and stuff into account. IOW, in some cases it will 1393 * give false negatives. The main reason why it's here is that we need 1394 * a non-destructive way to look for easily umountable filesystems. 1395 */ 1396 int may_umount(struct vfsmount *mnt) 1397 { 1398 int ret = 1; 1399 down_read(&namespace_sem); 1400 lock_mount_hash(); 1401 if (propagate_mount_busy(real_mount(mnt), 2)) 1402 ret = 0; 1403 unlock_mount_hash(); 1404 up_read(&namespace_sem); 1405 return ret; 1406 } 1407 1408 EXPORT_SYMBOL(may_umount); 1409 1410 static HLIST_HEAD(unmounted); /* protected by namespace_sem */ 1411 1412 static void namespace_unlock(void) 1413 { 1414 struct hlist_head head; 1415 1416 hlist_move_list(&unmounted, &head); 1417 1418 up_write(&namespace_sem); 1419 1420 if (likely(hlist_empty(&head))) 1421 return; 1422 1423 synchronize_rcu(); 1424 1425 group_pin_kill(&head); 1426 } 1427 1428 static inline void namespace_lock(void) 1429 { 1430 down_write(&namespace_sem); 1431 } 1432 1433 enum umount_tree_flags { 1434 UMOUNT_SYNC = 1, 1435 UMOUNT_PROPAGATE = 2, 1436 UMOUNT_CONNECTED = 4, 1437 }; 1438 1439 static bool disconnect_mount(struct mount *mnt, enum umount_tree_flags how) 1440 { 1441 /* Leaving mounts connected is only valid for lazy umounts */ 1442 if (how & UMOUNT_SYNC) 1443 return true; 1444 1445 /* A mount without a parent has nothing to be connected to */ 1446 if (!mnt_has_parent(mnt)) 1447 return true; 1448 1449 /* Because the reference counting rules change when mounts are 1450 * unmounted and connected, umounted mounts may not be 1451 * connected to mounted mounts. 1452 */ 1453 if (!(mnt->mnt_parent->mnt.mnt_flags & MNT_UMOUNT)) 1454 return true; 1455 1456 /* Has it been requested that the mount remain connected? */ 1457 if (how & UMOUNT_CONNECTED) 1458 return false; 1459 1460 /* Is the mount locked such that it needs to remain connected? */ 1461 if (IS_MNT_LOCKED(mnt)) 1462 return false; 1463 1464 /* By default disconnect the mount */ 1465 return true; 1466 } 1467 1468 /* 1469 * mount_lock must be held 1470 * namespace_sem must be held for write 1471 */ 1472 static void umount_tree(struct mount *mnt, enum umount_tree_flags how) 1473 { 1474 LIST_HEAD(tmp_list); 1475 struct mount *p; 1476 1477 if (how & UMOUNT_PROPAGATE) 1478 propagate_mount_unlock(mnt); 1479 1480 /* Gather the mounts to umount */ 1481 for (p = mnt; p; p = next_mnt(p, mnt)) { 1482 p->mnt.mnt_flags |= MNT_UMOUNT; 1483 list_move(&p->mnt_list, &tmp_list); 1484 } 1485 1486 /* Hide the mounts from mnt_mounts */ 1487 list_for_each_entry(p, &tmp_list, mnt_list) { 1488 list_del_init(&p->mnt_child); 1489 } 1490 1491 /* Add propogated mounts to the tmp_list */ 1492 if (how & UMOUNT_PROPAGATE) 1493 propagate_umount(&tmp_list); 1494 1495 while (!list_empty(&tmp_list)) { 1496 struct mnt_namespace *ns; 1497 bool disconnect; 1498 p = list_first_entry(&tmp_list, struct mount, mnt_list); 1499 list_del_init(&p->mnt_expire); 1500 list_del_init(&p->mnt_list); 1501 ns = p->mnt_ns; 1502 if (ns) { 1503 ns->mounts--; 1504 __touch_mnt_namespace(ns); 1505 } 1506 p->mnt_ns = NULL; 1507 if (how & UMOUNT_SYNC) 1508 p->mnt.mnt_flags |= MNT_SYNC_UMOUNT; 1509 1510 disconnect = disconnect_mount(p, how); 1511 1512 pin_insert_group(&p->mnt_umount, &p->mnt_parent->mnt, 1513 disconnect ? &unmounted : NULL); 1514 if (mnt_has_parent(p)) { 1515 mnt_add_count(p->mnt_parent, -1); 1516 if (!disconnect) { 1517 /* Don't forget about p */ 1518 list_add_tail(&p->mnt_child, &p->mnt_parent->mnt_mounts); 1519 } else { 1520 umount_mnt(p); 1521 } 1522 } 1523 change_mnt_propagation(p, MS_PRIVATE); 1524 } 1525 } 1526 1527 static void shrink_submounts(struct mount *mnt); 1528 1529 static int do_umount(struct mount *mnt, int flags) 1530 { 1531 struct super_block *sb = mnt->mnt.mnt_sb; 1532 int retval; 1533 1534 retval = security_sb_umount(&mnt->mnt, flags); 1535 if (retval) 1536 return retval; 1537 1538 /* 1539 * Allow userspace to request a mountpoint be expired rather than 1540 * unmounting unconditionally. Unmount only happens if: 1541 * (1) the mark is already set (the mark is cleared by mntput()) 1542 * (2) the usage count == 1 [parent vfsmount] + 1 [sys_umount] 1543 */ 1544 if (flags & MNT_EXPIRE) { 1545 if (&mnt->mnt == current->fs->root.mnt || 1546 flags & (MNT_FORCE | MNT_DETACH)) 1547 return -EINVAL; 1548 1549 /* 1550 * probably don't strictly need the lock here if we examined 1551 * all race cases, but it's a slowpath. 1552 */ 1553 lock_mount_hash(); 1554 if (mnt_get_count(mnt) != 2) { 1555 unlock_mount_hash(); 1556 return -EBUSY; 1557 } 1558 unlock_mount_hash(); 1559 1560 if (!xchg(&mnt->mnt_expiry_mark, 1)) 1561 return -EAGAIN; 1562 } 1563 1564 /* 1565 * If we may have to abort operations to get out of this 1566 * mount, and they will themselves hold resources we must 1567 * allow the fs to do things. In the Unix tradition of 1568 * 'Gee thats tricky lets do it in userspace' the umount_begin 1569 * might fail to complete on the first run through as other tasks 1570 * must return, and the like. Thats for the mount program to worry 1571 * about for the moment. 1572 */ 1573 1574 if (flags & MNT_FORCE && sb->s_op->umount_begin) { 1575 sb->s_op->umount_begin(sb); 1576 } 1577 1578 /* 1579 * No sense to grab the lock for this test, but test itself looks 1580 * somewhat bogus. Suggestions for better replacement? 1581 * Ho-hum... In principle, we might treat that as umount + switch 1582 * to rootfs. GC would eventually take care of the old vfsmount. 1583 * Actually it makes sense, especially if rootfs would contain a 1584 * /reboot - static binary that would close all descriptors and 1585 * call reboot(9). Then init(8) could umount root and exec /reboot. 1586 */ 1587 if (&mnt->mnt == current->fs->root.mnt && !(flags & MNT_DETACH)) { 1588 /* 1589 * Special case for "unmounting" root ... 1590 * we just try to remount it readonly. 1591 */ 1592 if (!capable(CAP_SYS_ADMIN)) 1593 return -EPERM; 1594 down_write(&sb->s_umount); 1595 if (!sb_rdonly(sb)) 1596 retval = do_remount_sb(sb, SB_RDONLY, NULL, 0); 1597 up_write(&sb->s_umount); 1598 return retval; 1599 } 1600 1601 namespace_lock(); 1602 lock_mount_hash(); 1603 event++; 1604 1605 if (flags & MNT_DETACH) { 1606 if (!list_empty(&mnt->mnt_list)) 1607 umount_tree(mnt, UMOUNT_PROPAGATE); 1608 retval = 0; 1609 } else { 1610 shrink_submounts(mnt); 1611 retval = -EBUSY; 1612 if (!propagate_mount_busy(mnt, 2)) { 1613 if (!list_empty(&mnt->mnt_list)) 1614 umount_tree(mnt, UMOUNT_PROPAGATE|UMOUNT_SYNC); 1615 retval = 0; 1616 } 1617 } 1618 unlock_mount_hash(); 1619 namespace_unlock(); 1620 return retval; 1621 } 1622 1623 /* 1624 * __detach_mounts - lazily unmount all mounts on the specified dentry 1625 * 1626 * During unlink, rmdir, and d_drop it is possible to loose the path 1627 * to an existing mountpoint, and wind up leaking the mount. 1628 * detach_mounts allows lazily unmounting those mounts instead of 1629 * leaking them. 1630 * 1631 * The caller may hold dentry->d_inode->i_mutex. 1632 */ 1633 void __detach_mounts(struct dentry *dentry) 1634 { 1635 struct mountpoint *mp; 1636 struct mount *mnt; 1637 1638 namespace_lock(); 1639 lock_mount_hash(); 1640 mp = lookup_mountpoint(dentry); 1641 if (IS_ERR_OR_NULL(mp)) 1642 goto out_unlock; 1643 1644 event++; 1645 while (!hlist_empty(&mp->m_list)) { 1646 mnt = hlist_entry(mp->m_list.first, struct mount, mnt_mp_list); 1647 if (mnt->mnt.mnt_flags & MNT_UMOUNT) { 1648 hlist_add_head(&mnt->mnt_umount.s_list, &unmounted); 1649 umount_mnt(mnt); 1650 } 1651 else umount_tree(mnt, UMOUNT_CONNECTED); 1652 } 1653 put_mountpoint(mp); 1654 out_unlock: 1655 unlock_mount_hash(); 1656 namespace_unlock(); 1657 } 1658 1659 /* 1660 * Is the caller allowed to modify his namespace? 1661 */ 1662 static inline bool may_mount(void) 1663 { 1664 return ns_capable(current->nsproxy->mnt_ns->user_ns, CAP_SYS_ADMIN); 1665 } 1666 1667 static inline bool may_mandlock(void) 1668 { 1669 #ifndef CONFIG_MANDATORY_FILE_LOCKING 1670 return false; 1671 #endif 1672 return capable(CAP_SYS_ADMIN); 1673 } 1674 1675 /* 1676 * Now umount can handle mount points as well as block devices. 1677 * This is important for filesystems which use unnamed block devices. 1678 * 1679 * We now support a flag for forced unmount like the other 'big iron' 1680 * unixes. Our API is identical to OSF/1 to avoid making a mess of AMD 1681 */ 1682 1683 int ksys_umount(char __user *name, int flags) 1684 { 1685 struct path path; 1686 struct mount *mnt; 1687 int retval; 1688 int lookup_flags = 0; 1689 1690 if (flags & ~(MNT_FORCE | MNT_DETACH | MNT_EXPIRE | UMOUNT_NOFOLLOW)) 1691 return -EINVAL; 1692 1693 if (!may_mount()) 1694 return -EPERM; 1695 1696 if (!(flags & UMOUNT_NOFOLLOW)) 1697 lookup_flags |= LOOKUP_FOLLOW; 1698 1699 retval = user_path_mountpoint_at(AT_FDCWD, name, lookup_flags, &path); 1700 if (retval) 1701 goto out; 1702 mnt = real_mount(path.mnt); 1703 retval = -EINVAL; 1704 if (path.dentry != path.mnt->mnt_root) 1705 goto dput_and_out; 1706 if (!check_mnt(mnt)) 1707 goto dput_and_out; 1708 if (mnt->mnt.mnt_flags & MNT_LOCKED) 1709 goto dput_and_out; 1710 retval = -EPERM; 1711 if (flags & MNT_FORCE && !capable(CAP_SYS_ADMIN)) 1712 goto dput_and_out; 1713 1714 retval = do_umount(mnt, flags); 1715 dput_and_out: 1716 /* we mustn't call path_put() as that would clear mnt_expiry_mark */ 1717 dput(path.dentry); 1718 mntput_no_expire(mnt); 1719 out: 1720 return retval; 1721 } 1722 1723 SYSCALL_DEFINE2(umount, char __user *, name, int, flags) 1724 { 1725 return ksys_umount(name, flags); 1726 } 1727 1728 #ifdef __ARCH_WANT_SYS_OLDUMOUNT 1729 1730 /* 1731 * The 2.0 compatible umount. No flags. 1732 */ 1733 SYSCALL_DEFINE1(oldumount, char __user *, name) 1734 { 1735 return ksys_umount(name, 0); 1736 } 1737 1738 #endif 1739 1740 static bool is_mnt_ns_file(struct dentry *dentry) 1741 { 1742 /* Is this a proxy for a mount namespace? */ 1743 return dentry->d_op == &ns_dentry_operations && 1744 dentry->d_fsdata == &mntns_operations; 1745 } 1746 1747 struct mnt_namespace *to_mnt_ns(struct ns_common *ns) 1748 { 1749 return container_of(ns, struct mnt_namespace, ns); 1750 } 1751 1752 static bool mnt_ns_loop(struct dentry *dentry) 1753 { 1754 /* Could bind mounting the mount namespace inode cause a 1755 * mount namespace loop? 1756 */ 1757 struct mnt_namespace *mnt_ns; 1758 if (!is_mnt_ns_file(dentry)) 1759 return false; 1760 1761 mnt_ns = to_mnt_ns(get_proc_ns(dentry->d_inode)); 1762 return current->nsproxy->mnt_ns->seq >= mnt_ns->seq; 1763 } 1764 1765 struct mount *copy_tree(struct mount *mnt, struct dentry *dentry, 1766 int flag) 1767 { 1768 struct mount *res, *p, *q, *r, *parent; 1769 1770 if (!(flag & CL_COPY_UNBINDABLE) && IS_MNT_UNBINDABLE(mnt)) 1771 return ERR_PTR(-EINVAL); 1772 1773 if (!(flag & CL_COPY_MNT_NS_FILE) && is_mnt_ns_file(dentry)) 1774 return ERR_PTR(-EINVAL); 1775 1776 res = q = clone_mnt(mnt, dentry, flag); 1777 if (IS_ERR(q)) 1778 return q; 1779 1780 q->mnt_mountpoint = mnt->mnt_mountpoint; 1781 1782 p = mnt; 1783 list_for_each_entry(r, &mnt->mnt_mounts, mnt_child) { 1784 struct mount *s; 1785 if (!is_subdir(r->mnt_mountpoint, dentry)) 1786 continue; 1787 1788 for (s = r; s; s = next_mnt(s, r)) { 1789 if (!(flag & CL_COPY_UNBINDABLE) && 1790 IS_MNT_UNBINDABLE(s)) { 1791 s = skip_mnt_tree(s); 1792 continue; 1793 } 1794 if (!(flag & CL_COPY_MNT_NS_FILE) && 1795 is_mnt_ns_file(s->mnt.mnt_root)) { 1796 s = skip_mnt_tree(s); 1797 continue; 1798 } 1799 while (p != s->mnt_parent) { 1800 p = p->mnt_parent; 1801 q = q->mnt_parent; 1802 } 1803 p = s; 1804 parent = q; 1805 q = clone_mnt(p, p->mnt.mnt_root, flag); 1806 if (IS_ERR(q)) 1807 goto out; 1808 lock_mount_hash(); 1809 list_add_tail(&q->mnt_list, &res->mnt_list); 1810 attach_mnt(q, parent, p->mnt_mp); 1811 unlock_mount_hash(); 1812 } 1813 } 1814 return res; 1815 out: 1816 if (res) { 1817 lock_mount_hash(); 1818 umount_tree(res, UMOUNT_SYNC); 1819 unlock_mount_hash(); 1820 } 1821 return q; 1822 } 1823 1824 /* Caller should check returned pointer for errors */ 1825 1826 struct vfsmount *collect_mounts(const struct path *path) 1827 { 1828 struct mount *tree; 1829 namespace_lock(); 1830 if (!check_mnt(real_mount(path->mnt))) 1831 tree = ERR_PTR(-EINVAL); 1832 else 1833 tree = copy_tree(real_mount(path->mnt), path->dentry, 1834 CL_COPY_ALL | CL_PRIVATE); 1835 namespace_unlock(); 1836 if (IS_ERR(tree)) 1837 return ERR_CAST(tree); 1838 return &tree->mnt; 1839 } 1840 1841 void drop_collected_mounts(struct vfsmount *mnt) 1842 { 1843 namespace_lock(); 1844 lock_mount_hash(); 1845 umount_tree(real_mount(mnt), UMOUNT_SYNC); 1846 unlock_mount_hash(); 1847 namespace_unlock(); 1848 } 1849 1850 /** 1851 * clone_private_mount - create a private clone of a path 1852 * 1853 * This creates a new vfsmount, which will be the clone of @path. The new will 1854 * not be attached anywhere in the namespace and will be private (i.e. changes 1855 * to the originating mount won't be propagated into this). 1856 * 1857 * Release with mntput(). 1858 */ 1859 struct vfsmount *clone_private_mount(const struct path *path) 1860 { 1861 struct mount *old_mnt = real_mount(path->mnt); 1862 struct mount *new_mnt; 1863 1864 if (IS_MNT_UNBINDABLE(old_mnt)) 1865 return ERR_PTR(-EINVAL); 1866 1867 new_mnt = clone_mnt(old_mnt, path->dentry, CL_PRIVATE); 1868 if (IS_ERR(new_mnt)) 1869 return ERR_CAST(new_mnt); 1870 1871 return &new_mnt->mnt; 1872 } 1873 EXPORT_SYMBOL_GPL(clone_private_mount); 1874 1875 int iterate_mounts(int (*f)(struct vfsmount *, void *), void *arg, 1876 struct vfsmount *root) 1877 { 1878 struct mount *mnt; 1879 int res = f(root, arg); 1880 if (res) 1881 return res; 1882 list_for_each_entry(mnt, &real_mount(root)->mnt_list, mnt_list) { 1883 res = f(&mnt->mnt, arg); 1884 if (res) 1885 return res; 1886 } 1887 return 0; 1888 } 1889 1890 static void cleanup_group_ids(struct mount *mnt, struct mount *end) 1891 { 1892 struct mount *p; 1893 1894 for (p = mnt; p != end; p = next_mnt(p, mnt)) { 1895 if (p->mnt_group_id && !IS_MNT_SHARED(p)) 1896 mnt_release_group_id(p); 1897 } 1898 } 1899 1900 static int invent_group_ids(struct mount *mnt, bool recurse) 1901 { 1902 struct mount *p; 1903 1904 for (p = mnt; p; p = recurse ? next_mnt(p, mnt) : NULL) { 1905 if (!p->mnt_group_id && !IS_MNT_SHARED(p)) { 1906 int err = mnt_alloc_group_id(p); 1907 if (err) { 1908 cleanup_group_ids(mnt, p); 1909 return err; 1910 } 1911 } 1912 } 1913 1914 return 0; 1915 } 1916 1917 int count_mounts(struct mnt_namespace *ns, struct mount *mnt) 1918 { 1919 unsigned int max = READ_ONCE(sysctl_mount_max); 1920 unsigned int mounts = 0, old, pending, sum; 1921 struct mount *p; 1922 1923 for (p = mnt; p; p = next_mnt(p, mnt)) 1924 mounts++; 1925 1926 old = ns->mounts; 1927 pending = ns->pending_mounts; 1928 sum = old + pending; 1929 if ((old > sum) || 1930 (pending > sum) || 1931 (max < sum) || 1932 (mounts > (max - sum))) 1933 return -ENOSPC; 1934 1935 ns->pending_mounts = pending + mounts; 1936 return 0; 1937 } 1938 1939 /* 1940 * @source_mnt : mount tree to be attached 1941 * @nd : place the mount tree @source_mnt is attached 1942 * @parent_nd : if non-null, detach the source_mnt from its parent and 1943 * store the parent mount and mountpoint dentry. 1944 * (done when source_mnt is moved) 1945 * 1946 * NOTE: in the table below explains the semantics when a source mount 1947 * of a given type is attached to a destination mount of a given type. 1948 * --------------------------------------------------------------------------- 1949 * | BIND MOUNT OPERATION | 1950 * |************************************************************************** 1951 * | source-->| shared | private | slave | unbindable | 1952 * | dest | | | | | 1953 * | | | | | | | 1954 * | v | | | | | 1955 * |************************************************************************** 1956 * | shared | shared (++) | shared (+) | shared(+++)| invalid | 1957 * | | | | | | 1958 * |non-shared| shared (+) | private | slave (*) | invalid | 1959 * *************************************************************************** 1960 * A bind operation clones the source mount and mounts the clone on the 1961 * destination mount. 1962 * 1963 * (++) the cloned mount is propagated to all the mounts in the propagation 1964 * tree of the destination mount and the cloned mount is added to 1965 * the peer group of the source mount. 1966 * (+) the cloned mount is created under the destination mount and is marked 1967 * as shared. The cloned mount is added to the peer group of the source 1968 * mount. 1969 * (+++) the mount is propagated to all the mounts in the propagation tree 1970 * of the destination mount and the cloned mount is made slave 1971 * of the same master as that of the source mount. The cloned mount 1972 * is marked as 'shared and slave'. 1973 * (*) the cloned mount is made a slave of the same master as that of the 1974 * source mount. 1975 * 1976 * --------------------------------------------------------------------------- 1977 * | MOVE MOUNT OPERATION | 1978 * |************************************************************************** 1979 * | source-->| shared | private | slave | unbindable | 1980 * | dest | | | | | 1981 * | | | | | | | 1982 * | v | | | | | 1983 * |************************************************************************** 1984 * | shared | shared (+) | shared (+) | shared(+++) | invalid | 1985 * | | | | | | 1986 * |non-shared| shared (+*) | private | slave (*) | unbindable | 1987 * *************************************************************************** 1988 * 1989 * (+) the mount is moved to the destination. And is then propagated to 1990 * all the mounts in the propagation tree of the destination mount. 1991 * (+*) the mount is moved to the destination. 1992 * (+++) the mount is moved to the destination and is then propagated to 1993 * all the mounts belonging to the destination mount's propagation tree. 1994 * the mount is marked as 'shared and slave'. 1995 * (*) the mount continues to be a slave at the new location. 1996 * 1997 * if the source mount is a tree, the operations explained above is 1998 * applied to each mount in the tree. 1999 * Must be called without spinlocks held, since this function can sleep 2000 * in allocations. 2001 */ 2002 static int attach_recursive_mnt(struct mount *source_mnt, 2003 struct mount *dest_mnt, 2004 struct mountpoint *dest_mp, 2005 struct path *parent_path) 2006 { 2007 HLIST_HEAD(tree_list); 2008 struct mnt_namespace *ns = dest_mnt->mnt_ns; 2009 struct mountpoint *smp; 2010 struct mount *child, *p; 2011 struct hlist_node *n; 2012 int err; 2013 2014 /* Preallocate a mountpoint in case the new mounts need 2015 * to be tucked under other mounts. 2016 */ 2017 smp = get_mountpoint(source_mnt->mnt.mnt_root); 2018 if (IS_ERR(smp)) 2019 return PTR_ERR(smp); 2020 2021 /* Is there space to add these mounts to the mount namespace? */ 2022 if (!parent_path) { 2023 err = count_mounts(ns, source_mnt); 2024 if (err) 2025 goto out; 2026 } 2027 2028 if (IS_MNT_SHARED(dest_mnt)) { 2029 err = invent_group_ids(source_mnt, true); 2030 if (err) 2031 goto out; 2032 err = propagate_mnt(dest_mnt, dest_mp, source_mnt, &tree_list); 2033 lock_mount_hash(); 2034 if (err) 2035 goto out_cleanup_ids; 2036 for (p = source_mnt; p; p = next_mnt(p, source_mnt)) 2037 set_mnt_shared(p); 2038 } else { 2039 lock_mount_hash(); 2040 } 2041 if (parent_path) { 2042 detach_mnt(source_mnt, parent_path); 2043 attach_mnt(source_mnt, dest_mnt, dest_mp); 2044 touch_mnt_namespace(source_mnt->mnt_ns); 2045 } else { 2046 mnt_set_mountpoint(dest_mnt, dest_mp, source_mnt); 2047 commit_tree(source_mnt); 2048 } 2049 2050 hlist_for_each_entry_safe(child, n, &tree_list, mnt_hash) { 2051 struct mount *q; 2052 hlist_del_init(&child->mnt_hash); 2053 q = __lookup_mnt(&child->mnt_parent->mnt, 2054 child->mnt_mountpoint); 2055 if (q) 2056 mnt_change_mountpoint(child, smp, q); 2057 commit_tree(child); 2058 } 2059 put_mountpoint(smp); 2060 unlock_mount_hash(); 2061 2062 return 0; 2063 2064 out_cleanup_ids: 2065 while (!hlist_empty(&tree_list)) { 2066 child = hlist_entry(tree_list.first, struct mount, mnt_hash); 2067 child->mnt_parent->mnt_ns->pending_mounts = 0; 2068 umount_tree(child, UMOUNT_SYNC); 2069 } 2070 unlock_mount_hash(); 2071 cleanup_group_ids(source_mnt, NULL); 2072 out: 2073 ns->pending_mounts = 0; 2074 2075 read_seqlock_excl(&mount_lock); 2076 put_mountpoint(smp); 2077 read_sequnlock_excl(&mount_lock); 2078 2079 return err; 2080 } 2081 2082 static struct mountpoint *lock_mount(struct path *path) 2083 { 2084 struct vfsmount *mnt; 2085 struct dentry *dentry = path->dentry; 2086 retry: 2087 inode_lock(dentry->d_inode); 2088 if (unlikely(cant_mount(dentry))) { 2089 inode_unlock(dentry->d_inode); 2090 return ERR_PTR(-ENOENT); 2091 } 2092 namespace_lock(); 2093 mnt = lookup_mnt(path); 2094 if (likely(!mnt)) { 2095 struct mountpoint *mp = get_mountpoint(dentry); 2096 if (IS_ERR(mp)) { 2097 namespace_unlock(); 2098 inode_unlock(dentry->d_inode); 2099 return mp; 2100 } 2101 return mp; 2102 } 2103 namespace_unlock(); 2104 inode_unlock(path->dentry->d_inode); 2105 path_put(path); 2106 path->mnt = mnt; 2107 dentry = path->dentry = dget(mnt->mnt_root); 2108 goto retry; 2109 } 2110 2111 static void unlock_mount(struct mountpoint *where) 2112 { 2113 struct dentry *dentry = where->m_dentry; 2114 2115 read_seqlock_excl(&mount_lock); 2116 put_mountpoint(where); 2117 read_sequnlock_excl(&mount_lock); 2118 2119 namespace_unlock(); 2120 inode_unlock(dentry->d_inode); 2121 } 2122 2123 static int graft_tree(struct mount *mnt, struct mount *p, struct mountpoint *mp) 2124 { 2125 if (mnt->mnt.mnt_sb->s_flags & SB_NOUSER) 2126 return -EINVAL; 2127 2128 if (d_is_dir(mp->m_dentry) != 2129 d_is_dir(mnt->mnt.mnt_root)) 2130 return -ENOTDIR; 2131 2132 return attach_recursive_mnt(mnt, p, mp, NULL); 2133 } 2134 2135 /* 2136 * Sanity check the flags to change_mnt_propagation. 2137 */ 2138 2139 static int flags_to_propagation_type(int ms_flags) 2140 { 2141 int type = ms_flags & ~(MS_REC | MS_SILENT); 2142 2143 /* Fail if any non-propagation flags are set */ 2144 if (type & ~(MS_SHARED | MS_PRIVATE | MS_SLAVE | MS_UNBINDABLE)) 2145 return 0; 2146 /* Only one propagation flag should be set */ 2147 if (!is_power_of_2(type)) 2148 return 0; 2149 return type; 2150 } 2151 2152 /* 2153 * recursively change the type of the mountpoint. 2154 */ 2155 static int do_change_type(struct path *path, int ms_flags) 2156 { 2157 struct mount *m; 2158 struct mount *mnt = real_mount(path->mnt); 2159 int recurse = ms_flags & MS_REC; 2160 int type; 2161 int err = 0; 2162 2163 if (path->dentry != path->mnt->mnt_root) 2164 return -EINVAL; 2165 2166 type = flags_to_propagation_type(ms_flags); 2167 if (!type) 2168 return -EINVAL; 2169 2170 namespace_lock(); 2171 if (type == MS_SHARED) { 2172 err = invent_group_ids(mnt, recurse); 2173 if (err) 2174 goto out_unlock; 2175 } 2176 2177 lock_mount_hash(); 2178 for (m = mnt; m; m = (recurse ? next_mnt(m, mnt) : NULL)) 2179 change_mnt_propagation(m, type); 2180 unlock_mount_hash(); 2181 2182 out_unlock: 2183 namespace_unlock(); 2184 return err; 2185 } 2186 2187 static bool has_locked_children(struct mount *mnt, struct dentry *dentry) 2188 { 2189 struct mount *child; 2190 list_for_each_entry(child, &mnt->mnt_mounts, mnt_child) { 2191 if (!is_subdir(child->mnt_mountpoint, dentry)) 2192 continue; 2193 2194 if (child->mnt.mnt_flags & MNT_LOCKED) 2195 return true; 2196 } 2197 return false; 2198 } 2199 2200 /* 2201 * do loopback mount. 2202 */ 2203 static int do_loopback(struct path *path, const char *old_name, 2204 int recurse) 2205 { 2206 struct path old_path; 2207 struct mount *mnt = NULL, *old, *parent; 2208 struct mountpoint *mp; 2209 int err; 2210 if (!old_name || !*old_name) 2211 return -EINVAL; 2212 err = kern_path(old_name, LOOKUP_FOLLOW|LOOKUP_AUTOMOUNT, &old_path); 2213 if (err) 2214 return err; 2215 2216 err = -EINVAL; 2217 if (mnt_ns_loop(old_path.dentry)) 2218 goto out; 2219 2220 mp = lock_mount(path); 2221 err = PTR_ERR(mp); 2222 if (IS_ERR(mp)) 2223 goto out; 2224 2225 old = real_mount(old_path.mnt); 2226 parent = real_mount(path->mnt); 2227 2228 err = -EINVAL; 2229 if (IS_MNT_UNBINDABLE(old)) 2230 goto out2; 2231 2232 if (!check_mnt(parent)) 2233 goto out2; 2234 2235 if (!check_mnt(old) && old_path.dentry->d_op != &ns_dentry_operations) 2236 goto out2; 2237 2238 if (!recurse && has_locked_children(old, old_path.dentry)) 2239 goto out2; 2240 2241 if (recurse) 2242 mnt = copy_tree(old, old_path.dentry, CL_COPY_MNT_NS_FILE); 2243 else 2244 mnt = clone_mnt(old, old_path.dentry, 0); 2245 2246 if (IS_ERR(mnt)) { 2247 err = PTR_ERR(mnt); 2248 goto out2; 2249 } 2250 2251 mnt->mnt.mnt_flags &= ~MNT_LOCKED; 2252 2253 err = graft_tree(mnt, parent, mp); 2254 if (err) { 2255 lock_mount_hash(); 2256 umount_tree(mnt, UMOUNT_SYNC); 2257 unlock_mount_hash(); 2258 } 2259 out2: 2260 unlock_mount(mp); 2261 out: 2262 path_put(&old_path); 2263 return err; 2264 } 2265 2266 static int change_mount_flags(struct vfsmount *mnt, int ms_flags) 2267 { 2268 int error = 0; 2269 int readonly_request = 0; 2270 2271 if (ms_flags & MS_RDONLY) 2272 readonly_request = 1; 2273 if (readonly_request == __mnt_is_readonly(mnt)) 2274 return 0; 2275 2276 if (readonly_request) 2277 error = mnt_make_readonly(real_mount(mnt)); 2278 else 2279 __mnt_unmake_readonly(real_mount(mnt)); 2280 return error; 2281 } 2282 2283 /* 2284 * change filesystem flags. dir should be a physical root of filesystem. 2285 * If you've mounted a non-root directory somewhere and want to do remount 2286 * on it - tough luck. 2287 */ 2288 static int do_remount(struct path *path, int ms_flags, int sb_flags, 2289 int mnt_flags, void *data) 2290 { 2291 int err; 2292 struct super_block *sb = path->mnt->mnt_sb; 2293 struct mount *mnt = real_mount(path->mnt); 2294 2295 if (!check_mnt(mnt)) 2296 return -EINVAL; 2297 2298 if (path->dentry != path->mnt->mnt_root) 2299 return -EINVAL; 2300 2301 /* Don't allow changing of locked mnt flags. 2302 * 2303 * No locks need to be held here while testing the various 2304 * MNT_LOCK flags because those flags can never be cleared 2305 * once they are set. 2306 */ 2307 if ((mnt->mnt.mnt_flags & MNT_LOCK_READONLY) && 2308 !(mnt_flags & MNT_READONLY)) { 2309 return -EPERM; 2310 } 2311 if ((mnt->mnt.mnt_flags & MNT_LOCK_NODEV) && 2312 !(mnt_flags & MNT_NODEV)) { 2313 return -EPERM; 2314 } 2315 if ((mnt->mnt.mnt_flags & MNT_LOCK_NOSUID) && 2316 !(mnt_flags & MNT_NOSUID)) { 2317 return -EPERM; 2318 } 2319 if ((mnt->mnt.mnt_flags & MNT_LOCK_NOEXEC) && 2320 !(mnt_flags & MNT_NOEXEC)) { 2321 return -EPERM; 2322 } 2323 if ((mnt->mnt.mnt_flags & MNT_LOCK_ATIME) && 2324 ((mnt->mnt.mnt_flags & MNT_ATIME_MASK) != (mnt_flags & MNT_ATIME_MASK))) { 2325 return -EPERM; 2326 } 2327 2328 err = security_sb_remount(sb, data); 2329 if (err) 2330 return err; 2331 2332 down_write(&sb->s_umount); 2333 if (ms_flags & MS_BIND) 2334 err = change_mount_flags(path->mnt, ms_flags); 2335 else if (!capable(CAP_SYS_ADMIN)) 2336 err = -EPERM; 2337 else 2338 err = do_remount_sb(sb, sb_flags, data, 0); 2339 if (!err) { 2340 lock_mount_hash(); 2341 mnt_flags |= mnt->mnt.mnt_flags & ~MNT_USER_SETTABLE_MASK; 2342 mnt->mnt.mnt_flags = mnt_flags; 2343 touch_mnt_namespace(mnt->mnt_ns); 2344 unlock_mount_hash(); 2345 } 2346 up_write(&sb->s_umount); 2347 return err; 2348 } 2349 2350 static inline int tree_contains_unbindable(struct mount *mnt) 2351 { 2352 struct mount *p; 2353 for (p = mnt; p; p = next_mnt(p, mnt)) { 2354 if (IS_MNT_UNBINDABLE(p)) 2355 return 1; 2356 } 2357 return 0; 2358 } 2359 2360 static int do_move_mount(struct path *path, const char *old_name) 2361 { 2362 struct path old_path, parent_path; 2363 struct mount *p; 2364 struct mount *old; 2365 struct mountpoint *mp; 2366 int err; 2367 if (!old_name || !*old_name) 2368 return -EINVAL; 2369 err = kern_path(old_name, LOOKUP_FOLLOW, &old_path); 2370 if (err) 2371 return err; 2372 2373 mp = lock_mount(path); 2374 err = PTR_ERR(mp); 2375 if (IS_ERR(mp)) 2376 goto out; 2377 2378 old = real_mount(old_path.mnt); 2379 p = real_mount(path->mnt); 2380 2381 err = -EINVAL; 2382 if (!check_mnt(p) || !check_mnt(old)) 2383 goto out1; 2384 2385 if (old->mnt.mnt_flags & MNT_LOCKED) 2386 goto out1; 2387 2388 err = -EINVAL; 2389 if (old_path.dentry != old_path.mnt->mnt_root) 2390 goto out1; 2391 2392 if (!mnt_has_parent(old)) 2393 goto out1; 2394 2395 if (d_is_dir(path->dentry) != 2396 d_is_dir(old_path.dentry)) 2397 goto out1; 2398 /* 2399 * Don't move a mount residing in a shared parent. 2400 */ 2401 if (IS_MNT_SHARED(old->mnt_parent)) 2402 goto out1; 2403 /* 2404 * Don't move a mount tree containing unbindable mounts to a destination 2405 * mount which is shared. 2406 */ 2407 if (IS_MNT_SHARED(p) && tree_contains_unbindable(old)) 2408 goto out1; 2409 err = -ELOOP; 2410 for (; mnt_has_parent(p); p = p->mnt_parent) 2411 if (p == old) 2412 goto out1; 2413 2414 err = attach_recursive_mnt(old, real_mount(path->mnt), mp, &parent_path); 2415 if (err) 2416 goto out1; 2417 2418 /* if the mount is moved, it should no longer be expire 2419 * automatically */ 2420 list_del_init(&old->mnt_expire); 2421 out1: 2422 unlock_mount(mp); 2423 out: 2424 if (!err) 2425 path_put(&parent_path); 2426 path_put(&old_path); 2427 return err; 2428 } 2429 2430 static struct vfsmount *fs_set_subtype(struct vfsmount *mnt, const char *fstype) 2431 { 2432 int err; 2433 const char *subtype = strchr(fstype, '.'); 2434 if (subtype) { 2435 subtype++; 2436 err = -EINVAL; 2437 if (!subtype[0]) 2438 goto err; 2439 } else 2440 subtype = ""; 2441 2442 mnt->mnt_sb->s_subtype = kstrdup(subtype, GFP_KERNEL); 2443 err = -ENOMEM; 2444 if (!mnt->mnt_sb->s_subtype) 2445 goto err; 2446 return mnt; 2447 2448 err: 2449 mntput(mnt); 2450 return ERR_PTR(err); 2451 } 2452 2453 /* 2454 * add a mount into a namespace's mount tree 2455 */ 2456 static int do_add_mount(struct mount *newmnt, struct path *path, int mnt_flags) 2457 { 2458 struct mountpoint *mp; 2459 struct mount *parent; 2460 int err; 2461 2462 mnt_flags &= ~MNT_INTERNAL_FLAGS; 2463 2464 mp = lock_mount(path); 2465 if (IS_ERR(mp)) 2466 return PTR_ERR(mp); 2467 2468 parent = real_mount(path->mnt); 2469 err = -EINVAL; 2470 if (unlikely(!check_mnt(parent))) { 2471 /* that's acceptable only for automounts done in private ns */ 2472 if (!(mnt_flags & MNT_SHRINKABLE)) 2473 goto unlock; 2474 /* ... and for those we'd better have mountpoint still alive */ 2475 if (!parent->mnt_ns) 2476 goto unlock; 2477 } 2478 2479 /* Refuse the same filesystem on the same mount point */ 2480 err = -EBUSY; 2481 if (path->mnt->mnt_sb == newmnt->mnt.mnt_sb && 2482 path->mnt->mnt_root == path->dentry) 2483 goto unlock; 2484 2485 err = -EINVAL; 2486 if (d_is_symlink(newmnt->mnt.mnt_root)) 2487 goto unlock; 2488 2489 newmnt->mnt.mnt_flags = mnt_flags; 2490 err = graft_tree(newmnt, parent, mp); 2491 2492 unlock: 2493 unlock_mount(mp); 2494 return err; 2495 } 2496 2497 static bool mount_too_revealing(struct vfsmount *mnt, int *new_mnt_flags); 2498 2499 /* 2500 * create a new mount for userspace and request it to be added into the 2501 * namespace's tree 2502 */ 2503 static int do_new_mount(struct path *path, const char *fstype, int sb_flags, 2504 int mnt_flags, const char *name, void *data) 2505 { 2506 struct file_system_type *type; 2507 struct vfsmount *mnt; 2508 int err; 2509 2510 if (!fstype) 2511 return -EINVAL; 2512 2513 type = get_fs_type(fstype); 2514 if (!type) 2515 return -ENODEV; 2516 2517 mnt = vfs_kern_mount(type, sb_flags, name, data); 2518 if (!IS_ERR(mnt) && (type->fs_flags & FS_HAS_SUBTYPE) && 2519 !mnt->mnt_sb->s_subtype) 2520 mnt = fs_set_subtype(mnt, fstype); 2521 2522 put_filesystem(type); 2523 if (IS_ERR(mnt)) 2524 return PTR_ERR(mnt); 2525 2526 if (mount_too_revealing(mnt, &mnt_flags)) { 2527 mntput(mnt); 2528 return -EPERM; 2529 } 2530 2531 err = do_add_mount(real_mount(mnt), path, mnt_flags); 2532 if (err) 2533 mntput(mnt); 2534 return err; 2535 } 2536 2537 int finish_automount(struct vfsmount *m, struct path *path) 2538 { 2539 struct mount *mnt = real_mount(m); 2540 int err; 2541 /* The new mount record should have at least 2 refs to prevent it being 2542 * expired before we get a chance to add it 2543 */ 2544 BUG_ON(mnt_get_count(mnt) < 2); 2545 2546 if (m->mnt_sb == path->mnt->mnt_sb && 2547 m->mnt_root == path->dentry) { 2548 err = -ELOOP; 2549 goto fail; 2550 } 2551 2552 err = do_add_mount(mnt, path, path->mnt->mnt_flags | MNT_SHRINKABLE); 2553 if (!err) 2554 return 0; 2555 fail: 2556 /* remove m from any expiration list it may be on */ 2557 if (!list_empty(&mnt->mnt_expire)) { 2558 namespace_lock(); 2559 list_del_init(&mnt->mnt_expire); 2560 namespace_unlock(); 2561 } 2562 mntput(m); 2563 mntput(m); 2564 return err; 2565 } 2566 2567 /** 2568 * mnt_set_expiry - Put a mount on an expiration list 2569 * @mnt: The mount to list. 2570 * @expiry_list: The list to add the mount to. 2571 */ 2572 void mnt_set_expiry(struct vfsmount *mnt, struct list_head *expiry_list) 2573 { 2574 namespace_lock(); 2575 2576 list_add_tail(&real_mount(mnt)->mnt_expire, expiry_list); 2577 2578 namespace_unlock(); 2579 } 2580 EXPORT_SYMBOL(mnt_set_expiry); 2581 2582 /* 2583 * process a list of expirable mountpoints with the intent of discarding any 2584 * mountpoints that aren't in use and haven't been touched since last we came 2585 * here 2586 */ 2587 void mark_mounts_for_expiry(struct list_head *mounts) 2588 { 2589 struct mount *mnt, *next; 2590 LIST_HEAD(graveyard); 2591 2592 if (list_empty(mounts)) 2593 return; 2594 2595 namespace_lock(); 2596 lock_mount_hash(); 2597 2598 /* extract from the expiration list every vfsmount that matches the 2599 * following criteria: 2600 * - only referenced by its parent vfsmount 2601 * - still marked for expiry (marked on the last call here; marks are 2602 * cleared by mntput()) 2603 */ 2604 list_for_each_entry_safe(mnt, next, mounts, mnt_expire) { 2605 if (!xchg(&mnt->mnt_expiry_mark, 1) || 2606 propagate_mount_busy(mnt, 1)) 2607 continue; 2608 list_move(&mnt->mnt_expire, &graveyard); 2609 } 2610 while (!list_empty(&graveyard)) { 2611 mnt = list_first_entry(&graveyard, struct mount, mnt_expire); 2612 touch_mnt_namespace(mnt->mnt_ns); 2613 umount_tree(mnt, UMOUNT_PROPAGATE|UMOUNT_SYNC); 2614 } 2615 unlock_mount_hash(); 2616 namespace_unlock(); 2617 } 2618 2619 EXPORT_SYMBOL_GPL(mark_mounts_for_expiry); 2620 2621 /* 2622 * Ripoff of 'select_parent()' 2623 * 2624 * search the list of submounts for a given mountpoint, and move any 2625 * shrinkable submounts to the 'graveyard' list. 2626 */ 2627 static int select_submounts(struct mount *parent, struct list_head *graveyard) 2628 { 2629 struct mount *this_parent = parent; 2630 struct list_head *next; 2631 int found = 0; 2632 2633 repeat: 2634 next = this_parent->mnt_mounts.next; 2635 resume: 2636 while (next != &this_parent->mnt_mounts) { 2637 struct list_head *tmp = next; 2638 struct mount *mnt = list_entry(tmp, struct mount, mnt_child); 2639 2640 next = tmp->next; 2641 if (!(mnt->mnt.mnt_flags & MNT_SHRINKABLE)) 2642 continue; 2643 /* 2644 * Descend a level if the d_mounts list is non-empty. 2645 */ 2646 if (!list_empty(&mnt->mnt_mounts)) { 2647 this_parent = mnt; 2648 goto repeat; 2649 } 2650 2651 if (!propagate_mount_busy(mnt, 1)) { 2652 list_move_tail(&mnt->mnt_expire, graveyard); 2653 found++; 2654 } 2655 } 2656 /* 2657 * All done at this level ... ascend and resume the search 2658 */ 2659 if (this_parent != parent) { 2660 next = this_parent->mnt_child.next; 2661 this_parent = this_parent->mnt_parent; 2662 goto resume; 2663 } 2664 return found; 2665 } 2666 2667 /* 2668 * process a list of expirable mountpoints with the intent of discarding any 2669 * submounts of a specific parent mountpoint 2670 * 2671 * mount_lock must be held for write 2672 */ 2673 static void shrink_submounts(struct mount *mnt) 2674 { 2675 LIST_HEAD(graveyard); 2676 struct mount *m; 2677 2678 /* extract submounts of 'mountpoint' from the expiration list */ 2679 while (select_submounts(mnt, &graveyard)) { 2680 while (!list_empty(&graveyard)) { 2681 m = list_first_entry(&graveyard, struct mount, 2682 mnt_expire); 2683 touch_mnt_namespace(m->mnt_ns); 2684 umount_tree(m, UMOUNT_PROPAGATE|UMOUNT_SYNC); 2685 } 2686 } 2687 } 2688 2689 /* 2690 * Some copy_from_user() implementations do not return the exact number of 2691 * bytes remaining to copy on a fault. But copy_mount_options() requires that. 2692 * Note that this function differs from copy_from_user() in that it will oops 2693 * on bad values of `to', rather than returning a short copy. 2694 */ 2695 static long exact_copy_from_user(void *to, const void __user * from, 2696 unsigned long n) 2697 { 2698 char *t = to; 2699 const char __user *f = from; 2700 char c; 2701 2702 if (!access_ok(VERIFY_READ, from, n)) 2703 return n; 2704 2705 while (n) { 2706 if (__get_user(c, f)) { 2707 memset(t, 0, n); 2708 break; 2709 } 2710 *t++ = c; 2711 f++; 2712 n--; 2713 } 2714 return n; 2715 } 2716 2717 void *copy_mount_options(const void __user * data) 2718 { 2719 int i; 2720 unsigned long size; 2721 char *copy; 2722 2723 if (!data) 2724 return NULL; 2725 2726 copy = kmalloc(PAGE_SIZE, GFP_KERNEL); 2727 if (!copy) 2728 return ERR_PTR(-ENOMEM); 2729 2730 /* We only care that *some* data at the address the user 2731 * gave us is valid. Just in case, we'll zero 2732 * the remainder of the page. 2733 */ 2734 /* copy_from_user cannot cross TASK_SIZE ! */ 2735 size = TASK_SIZE - (unsigned long)data; 2736 if (size > PAGE_SIZE) 2737 size = PAGE_SIZE; 2738 2739 i = size - exact_copy_from_user(copy, data, size); 2740 if (!i) { 2741 kfree(copy); 2742 return ERR_PTR(-EFAULT); 2743 } 2744 if (i != PAGE_SIZE) 2745 memset(copy + i, 0, PAGE_SIZE - i); 2746 return copy; 2747 } 2748 2749 char *copy_mount_string(const void __user *data) 2750 { 2751 return data ? strndup_user(data, PAGE_SIZE) : NULL; 2752 } 2753 2754 /* 2755 * Flags is a 32-bit value that allows up to 31 non-fs dependent flags to 2756 * be given to the mount() call (ie: read-only, no-dev, no-suid etc). 2757 * 2758 * data is a (void *) that can point to any structure up to 2759 * PAGE_SIZE-1 bytes, which can contain arbitrary fs-dependent 2760 * information (or be NULL). 2761 * 2762 * Pre-0.97 versions of mount() didn't have a flags word. 2763 * When the flags word was introduced its top half was required 2764 * to have the magic value 0xC0ED, and this remained so until 2.4.0-test9. 2765 * Therefore, if this magic number is present, it carries no information 2766 * and must be discarded. 2767 */ 2768 long do_mount(const char *dev_name, const char __user *dir_name, 2769 const char *type_page, unsigned long flags, void *data_page) 2770 { 2771 struct path path; 2772 unsigned int mnt_flags = 0, sb_flags; 2773 int retval = 0; 2774 2775 /* Discard magic */ 2776 if ((flags & MS_MGC_MSK) == MS_MGC_VAL) 2777 flags &= ~MS_MGC_MSK; 2778 2779 /* Basic sanity checks */ 2780 if (data_page) 2781 ((char *)data_page)[PAGE_SIZE - 1] = 0; 2782 2783 if (flags & MS_NOUSER) 2784 return -EINVAL; 2785 2786 /* ... and get the mountpoint */ 2787 retval = user_path(dir_name, &path); 2788 if (retval) 2789 return retval; 2790 2791 retval = security_sb_mount(dev_name, &path, 2792 type_page, flags, data_page); 2793 if (!retval && !may_mount()) 2794 retval = -EPERM; 2795 if (!retval && (flags & SB_MANDLOCK) && !may_mandlock()) 2796 retval = -EPERM; 2797 if (retval) 2798 goto dput_out; 2799 2800 /* Default to relatime unless overriden */ 2801 if (!(flags & MS_NOATIME)) 2802 mnt_flags |= MNT_RELATIME; 2803 2804 /* Separate the per-mountpoint flags */ 2805 if (flags & MS_NOSUID) 2806 mnt_flags |= MNT_NOSUID; 2807 if (flags & MS_NODEV) 2808 mnt_flags |= MNT_NODEV; 2809 if (flags & MS_NOEXEC) 2810 mnt_flags |= MNT_NOEXEC; 2811 if (flags & MS_NOATIME) 2812 mnt_flags |= MNT_NOATIME; 2813 if (flags & MS_NODIRATIME) 2814 mnt_flags |= MNT_NODIRATIME; 2815 if (flags & MS_STRICTATIME) 2816 mnt_flags &= ~(MNT_RELATIME | MNT_NOATIME); 2817 if (flags & SB_RDONLY) 2818 mnt_flags |= MNT_READONLY; 2819 2820 /* The default atime for remount is preservation */ 2821 if ((flags & MS_REMOUNT) && 2822 ((flags & (MS_NOATIME | MS_NODIRATIME | MS_RELATIME | 2823 MS_STRICTATIME)) == 0)) { 2824 mnt_flags &= ~MNT_ATIME_MASK; 2825 mnt_flags |= path.mnt->mnt_flags & MNT_ATIME_MASK; 2826 } 2827 2828 sb_flags = flags & (SB_RDONLY | 2829 SB_SYNCHRONOUS | 2830 SB_MANDLOCK | 2831 SB_DIRSYNC | 2832 SB_SILENT | 2833 SB_POSIXACL | 2834 SB_LAZYTIME | 2835 SB_I_VERSION); 2836 2837 if (flags & MS_REMOUNT) 2838 retval = do_remount(&path, flags, sb_flags, mnt_flags, 2839 data_page); 2840 else if (flags & MS_BIND) 2841 retval = do_loopback(&path, dev_name, flags & MS_REC); 2842 else if (flags & (MS_SHARED | MS_PRIVATE | MS_SLAVE | MS_UNBINDABLE)) 2843 retval = do_change_type(&path, flags); 2844 else if (flags & MS_MOVE) 2845 retval = do_move_mount(&path, dev_name); 2846 else 2847 retval = do_new_mount(&path, type_page, sb_flags, mnt_flags, 2848 dev_name, data_page); 2849 dput_out: 2850 path_put(&path); 2851 return retval; 2852 } 2853 2854 static struct ucounts *inc_mnt_namespaces(struct user_namespace *ns) 2855 { 2856 return inc_ucount(ns, current_euid(), UCOUNT_MNT_NAMESPACES); 2857 } 2858 2859 static void dec_mnt_namespaces(struct ucounts *ucounts) 2860 { 2861 dec_ucount(ucounts, UCOUNT_MNT_NAMESPACES); 2862 } 2863 2864 static void free_mnt_ns(struct mnt_namespace *ns) 2865 { 2866 ns_free_inum(&ns->ns); 2867 dec_mnt_namespaces(ns->ucounts); 2868 put_user_ns(ns->user_ns); 2869 kfree(ns); 2870 } 2871 2872 /* 2873 * Assign a sequence number so we can detect when we attempt to bind 2874 * mount a reference to an older mount namespace into the current 2875 * mount namespace, preventing reference counting loops. A 64bit 2876 * number incrementing at 10Ghz will take 12,427 years to wrap which 2877 * is effectively never, so we can ignore the possibility. 2878 */ 2879 static atomic64_t mnt_ns_seq = ATOMIC64_INIT(1); 2880 2881 static struct mnt_namespace *alloc_mnt_ns(struct user_namespace *user_ns) 2882 { 2883 struct mnt_namespace *new_ns; 2884 struct ucounts *ucounts; 2885 int ret; 2886 2887 ucounts = inc_mnt_namespaces(user_ns); 2888 if (!ucounts) 2889 return ERR_PTR(-ENOSPC); 2890 2891 new_ns = kmalloc(sizeof(struct mnt_namespace), GFP_KERNEL); 2892 if (!new_ns) { 2893 dec_mnt_namespaces(ucounts); 2894 return ERR_PTR(-ENOMEM); 2895 } 2896 ret = ns_alloc_inum(&new_ns->ns); 2897 if (ret) { 2898 kfree(new_ns); 2899 dec_mnt_namespaces(ucounts); 2900 return ERR_PTR(ret); 2901 } 2902 new_ns->ns.ops = &mntns_operations; 2903 new_ns->seq = atomic64_add_return(1, &mnt_ns_seq); 2904 atomic_set(&new_ns->count, 1); 2905 new_ns->root = NULL; 2906 INIT_LIST_HEAD(&new_ns->list); 2907 init_waitqueue_head(&new_ns->poll); 2908 new_ns->event = 0; 2909 new_ns->user_ns = get_user_ns(user_ns); 2910 new_ns->ucounts = ucounts; 2911 new_ns->mounts = 0; 2912 new_ns->pending_mounts = 0; 2913 return new_ns; 2914 } 2915 2916 __latent_entropy 2917 struct mnt_namespace *copy_mnt_ns(unsigned long flags, struct mnt_namespace *ns, 2918 struct user_namespace *user_ns, struct fs_struct *new_fs) 2919 { 2920 struct mnt_namespace *new_ns; 2921 struct vfsmount *rootmnt = NULL, *pwdmnt = NULL; 2922 struct mount *p, *q; 2923 struct mount *old; 2924 struct mount *new; 2925 int copy_flags; 2926 2927 BUG_ON(!ns); 2928 2929 if (likely(!(flags & CLONE_NEWNS))) { 2930 get_mnt_ns(ns); 2931 return ns; 2932 } 2933 2934 old = ns->root; 2935 2936 new_ns = alloc_mnt_ns(user_ns); 2937 if (IS_ERR(new_ns)) 2938 return new_ns; 2939 2940 namespace_lock(); 2941 /* First pass: copy the tree topology */ 2942 copy_flags = CL_COPY_UNBINDABLE | CL_EXPIRE; 2943 if (user_ns != ns->user_ns) 2944 copy_flags |= CL_SHARED_TO_SLAVE | CL_UNPRIVILEGED; 2945 new = copy_tree(old, old->mnt.mnt_root, copy_flags); 2946 if (IS_ERR(new)) { 2947 namespace_unlock(); 2948 free_mnt_ns(new_ns); 2949 return ERR_CAST(new); 2950 } 2951 new_ns->root = new; 2952 list_add_tail(&new_ns->list, &new->mnt_list); 2953 2954 /* 2955 * Second pass: switch the tsk->fs->* elements and mark new vfsmounts 2956 * as belonging to new namespace. We have already acquired a private 2957 * fs_struct, so tsk->fs->lock is not needed. 2958 */ 2959 p = old; 2960 q = new; 2961 while (p) { 2962 q->mnt_ns = new_ns; 2963 new_ns->mounts++; 2964 if (new_fs) { 2965 if (&p->mnt == new_fs->root.mnt) { 2966 new_fs->root.mnt = mntget(&q->mnt); 2967 rootmnt = &p->mnt; 2968 } 2969 if (&p->mnt == new_fs->pwd.mnt) { 2970 new_fs->pwd.mnt = mntget(&q->mnt); 2971 pwdmnt = &p->mnt; 2972 } 2973 } 2974 p = next_mnt(p, old); 2975 q = next_mnt(q, new); 2976 if (!q) 2977 break; 2978 while (p->mnt.mnt_root != q->mnt.mnt_root) 2979 p = next_mnt(p, old); 2980 } 2981 namespace_unlock(); 2982 2983 if (rootmnt) 2984 mntput(rootmnt); 2985 if (pwdmnt) 2986 mntput(pwdmnt); 2987 2988 return new_ns; 2989 } 2990 2991 /** 2992 * create_mnt_ns - creates a private namespace and adds a root filesystem 2993 * @mnt: pointer to the new root filesystem mountpoint 2994 */ 2995 static struct mnt_namespace *create_mnt_ns(struct vfsmount *m) 2996 { 2997 struct mnt_namespace *new_ns = alloc_mnt_ns(&init_user_ns); 2998 if (!IS_ERR(new_ns)) { 2999 struct mount *mnt = real_mount(m); 3000 mnt->mnt_ns = new_ns; 3001 new_ns->root = mnt; 3002 new_ns->mounts++; 3003 list_add(&mnt->mnt_list, &new_ns->list); 3004 } else { 3005 mntput(m); 3006 } 3007 return new_ns; 3008 } 3009 3010 struct dentry *mount_subtree(struct vfsmount *mnt, const char *name) 3011 { 3012 struct mnt_namespace *ns; 3013 struct super_block *s; 3014 struct path path; 3015 int err; 3016 3017 ns = create_mnt_ns(mnt); 3018 if (IS_ERR(ns)) 3019 return ERR_CAST(ns); 3020 3021 err = vfs_path_lookup(mnt->mnt_root, mnt, 3022 name, LOOKUP_FOLLOW|LOOKUP_AUTOMOUNT, &path); 3023 3024 put_mnt_ns(ns); 3025 3026 if (err) 3027 return ERR_PTR(err); 3028 3029 /* trade a vfsmount reference for active sb one */ 3030 s = path.mnt->mnt_sb; 3031 atomic_inc(&s->s_active); 3032 mntput(path.mnt); 3033 /* lock the sucker */ 3034 down_write(&s->s_umount); 3035 /* ... and return the root of (sub)tree on it */ 3036 return path.dentry; 3037 } 3038 EXPORT_SYMBOL(mount_subtree); 3039 3040 int ksys_mount(char __user *dev_name, char __user *dir_name, char __user *type, 3041 unsigned long flags, void __user *data) 3042 { 3043 int ret; 3044 char *kernel_type; 3045 char *kernel_dev; 3046 void *options; 3047 3048 kernel_type = copy_mount_string(type); 3049 ret = PTR_ERR(kernel_type); 3050 if (IS_ERR(kernel_type)) 3051 goto out_type; 3052 3053 kernel_dev = copy_mount_string(dev_name); 3054 ret = PTR_ERR(kernel_dev); 3055 if (IS_ERR(kernel_dev)) 3056 goto out_dev; 3057 3058 options = copy_mount_options(data); 3059 ret = PTR_ERR(options); 3060 if (IS_ERR(options)) 3061 goto out_data; 3062 3063 ret = do_mount(kernel_dev, dir_name, kernel_type, flags, options); 3064 3065 kfree(options); 3066 out_data: 3067 kfree(kernel_dev); 3068 out_dev: 3069 kfree(kernel_type); 3070 out_type: 3071 return ret; 3072 } 3073 3074 SYSCALL_DEFINE5(mount, char __user *, dev_name, char __user *, dir_name, 3075 char __user *, type, unsigned long, flags, void __user *, data) 3076 { 3077 return ksys_mount(dev_name, dir_name, type, flags, data); 3078 } 3079 3080 /* 3081 * Return true if path is reachable from root 3082 * 3083 * namespace_sem or mount_lock is held 3084 */ 3085 bool is_path_reachable(struct mount *mnt, struct dentry *dentry, 3086 const struct path *root) 3087 { 3088 while (&mnt->mnt != root->mnt && mnt_has_parent(mnt)) { 3089 dentry = mnt->mnt_mountpoint; 3090 mnt = mnt->mnt_parent; 3091 } 3092 return &mnt->mnt == root->mnt && is_subdir(dentry, root->dentry); 3093 } 3094 3095 bool path_is_under(const struct path *path1, const struct path *path2) 3096 { 3097 bool res; 3098 read_seqlock_excl(&mount_lock); 3099 res = is_path_reachable(real_mount(path1->mnt), path1->dentry, path2); 3100 read_sequnlock_excl(&mount_lock); 3101 return res; 3102 } 3103 EXPORT_SYMBOL(path_is_under); 3104 3105 /* 3106 * pivot_root Semantics: 3107 * Moves the root file system of the current process to the directory put_old, 3108 * makes new_root as the new root file system of the current process, and sets 3109 * root/cwd of all processes which had them on the current root to new_root. 3110 * 3111 * Restrictions: 3112 * The new_root and put_old must be directories, and must not be on the 3113 * same file system as the current process root. The put_old must be 3114 * underneath new_root, i.e. adding a non-zero number of /.. to the string 3115 * pointed to by put_old must yield the same directory as new_root. No other 3116 * file system may be mounted on put_old. After all, new_root is a mountpoint. 3117 * 3118 * Also, the current root cannot be on the 'rootfs' (initial ramfs) filesystem. 3119 * See Documentation/filesystems/ramfs-rootfs-initramfs.txt for alternatives 3120 * in this situation. 3121 * 3122 * Notes: 3123 * - we don't move root/cwd if they are not at the root (reason: if something 3124 * cared enough to change them, it's probably wrong to force them elsewhere) 3125 * - it's okay to pick a root that isn't the root of a file system, e.g. 3126 * /nfs/my_root where /nfs is the mount point. It must be a mountpoint, 3127 * though, so you may need to say mount --bind /nfs/my_root /nfs/my_root 3128 * first. 3129 */ 3130 SYSCALL_DEFINE2(pivot_root, const char __user *, new_root, 3131 const char __user *, put_old) 3132 { 3133 struct path new, old, parent_path, root_parent, root; 3134 struct mount *new_mnt, *root_mnt, *old_mnt; 3135 struct mountpoint *old_mp, *root_mp; 3136 int error; 3137 3138 if (!may_mount()) 3139 return -EPERM; 3140 3141 error = user_path_dir(new_root, &new); 3142 if (error) 3143 goto out0; 3144 3145 error = user_path_dir(put_old, &old); 3146 if (error) 3147 goto out1; 3148 3149 error = security_sb_pivotroot(&old, &new); 3150 if (error) 3151 goto out2; 3152 3153 get_fs_root(current->fs, &root); 3154 old_mp = lock_mount(&old); 3155 error = PTR_ERR(old_mp); 3156 if (IS_ERR(old_mp)) 3157 goto out3; 3158 3159 error = -EINVAL; 3160 new_mnt = real_mount(new.mnt); 3161 root_mnt = real_mount(root.mnt); 3162 old_mnt = real_mount(old.mnt); 3163 if (IS_MNT_SHARED(old_mnt) || 3164 IS_MNT_SHARED(new_mnt->mnt_parent) || 3165 IS_MNT_SHARED(root_mnt->mnt_parent)) 3166 goto out4; 3167 if (!check_mnt(root_mnt) || !check_mnt(new_mnt)) 3168 goto out4; 3169 if (new_mnt->mnt.mnt_flags & MNT_LOCKED) 3170 goto out4; 3171 error = -ENOENT; 3172 if (d_unlinked(new.dentry)) 3173 goto out4; 3174 error = -EBUSY; 3175 if (new_mnt == root_mnt || old_mnt == root_mnt) 3176 goto out4; /* loop, on the same file system */ 3177 error = -EINVAL; 3178 if (root.mnt->mnt_root != root.dentry) 3179 goto out4; /* not a mountpoint */ 3180 if (!mnt_has_parent(root_mnt)) 3181 goto out4; /* not attached */ 3182 root_mp = root_mnt->mnt_mp; 3183 if (new.mnt->mnt_root != new.dentry) 3184 goto out4; /* not a mountpoint */ 3185 if (!mnt_has_parent(new_mnt)) 3186 goto out4; /* not attached */ 3187 /* make sure we can reach put_old from new_root */ 3188 if (!is_path_reachable(old_mnt, old.dentry, &new)) 3189 goto out4; 3190 /* make certain new is below the root */ 3191 if (!is_path_reachable(new_mnt, new.dentry, &root)) 3192 goto out4; 3193 root_mp->m_count++; /* pin it so it won't go away */ 3194 lock_mount_hash(); 3195 detach_mnt(new_mnt, &parent_path); 3196 detach_mnt(root_mnt, &root_parent); 3197 if (root_mnt->mnt.mnt_flags & MNT_LOCKED) { 3198 new_mnt->mnt.mnt_flags |= MNT_LOCKED; 3199 root_mnt->mnt.mnt_flags &= ~MNT_LOCKED; 3200 } 3201 /* mount old root on put_old */ 3202 attach_mnt(root_mnt, old_mnt, old_mp); 3203 /* mount new_root on / */ 3204 attach_mnt(new_mnt, real_mount(root_parent.mnt), root_mp); 3205 touch_mnt_namespace(current->nsproxy->mnt_ns); 3206 /* A moved mount should not expire automatically */ 3207 list_del_init(&new_mnt->mnt_expire); 3208 put_mountpoint(root_mp); 3209 unlock_mount_hash(); 3210 chroot_fs_refs(&root, &new); 3211 error = 0; 3212 out4: 3213 unlock_mount(old_mp); 3214 if (!error) { 3215 path_put(&root_parent); 3216 path_put(&parent_path); 3217 } 3218 out3: 3219 path_put(&root); 3220 out2: 3221 path_put(&old); 3222 out1: 3223 path_put(&new); 3224 out0: 3225 return error; 3226 } 3227 3228 static void __init init_mount_tree(void) 3229 { 3230 struct vfsmount *mnt; 3231 struct mnt_namespace *ns; 3232 struct path root; 3233 struct file_system_type *type; 3234 3235 type = get_fs_type("rootfs"); 3236 if (!type) 3237 panic("Can't find rootfs type"); 3238 mnt = vfs_kern_mount(type, 0, "rootfs", NULL); 3239 put_filesystem(type); 3240 if (IS_ERR(mnt)) 3241 panic("Can't create rootfs"); 3242 3243 ns = create_mnt_ns(mnt); 3244 if (IS_ERR(ns)) 3245 panic("Can't allocate initial namespace"); 3246 3247 init_task.nsproxy->mnt_ns = ns; 3248 get_mnt_ns(ns); 3249 3250 root.mnt = mnt; 3251 root.dentry = mnt->mnt_root; 3252 mnt->mnt_flags |= MNT_LOCKED; 3253 3254 set_fs_pwd(current->fs, &root); 3255 set_fs_root(current->fs, &root); 3256 } 3257 3258 void __init mnt_init(void) 3259 { 3260 int err; 3261 3262 mnt_cache = kmem_cache_create("mnt_cache", sizeof(struct mount), 3263 0, SLAB_HWCACHE_ALIGN | SLAB_PANIC, NULL); 3264 3265 mount_hashtable = alloc_large_system_hash("Mount-cache", 3266 sizeof(struct hlist_head), 3267 mhash_entries, 19, 3268 HASH_ZERO, 3269 &m_hash_shift, &m_hash_mask, 0, 0); 3270 mountpoint_hashtable = alloc_large_system_hash("Mountpoint-cache", 3271 sizeof(struct hlist_head), 3272 mphash_entries, 19, 3273 HASH_ZERO, 3274 &mp_hash_shift, &mp_hash_mask, 0, 0); 3275 3276 if (!mount_hashtable || !mountpoint_hashtable) 3277 panic("Failed to allocate mount hash table\n"); 3278 3279 kernfs_init(); 3280 3281 err = sysfs_init(); 3282 if (err) 3283 printk(KERN_WARNING "%s: sysfs_init error: %d\n", 3284 __func__, err); 3285 fs_kobj = kobject_create_and_add("fs", NULL); 3286 if (!fs_kobj) 3287 printk(KERN_WARNING "%s: kobj create error\n", __func__); 3288 init_rootfs(); 3289 init_mount_tree(); 3290 } 3291 3292 void put_mnt_ns(struct mnt_namespace *ns) 3293 { 3294 if (!atomic_dec_and_test(&ns->count)) 3295 return; 3296 drop_collected_mounts(&ns->root->mnt); 3297 free_mnt_ns(ns); 3298 } 3299 3300 struct vfsmount *kern_mount_data(struct file_system_type *type, void *data) 3301 { 3302 struct vfsmount *mnt; 3303 mnt = vfs_kern_mount(type, SB_KERNMOUNT, type->name, data); 3304 if (!IS_ERR(mnt)) { 3305 /* 3306 * it is a longterm mount, don't release mnt until 3307 * we unmount before file sys is unregistered 3308 */ 3309 real_mount(mnt)->mnt_ns = MNT_NS_INTERNAL; 3310 } 3311 return mnt; 3312 } 3313 EXPORT_SYMBOL_GPL(kern_mount_data); 3314 3315 void kern_unmount(struct vfsmount *mnt) 3316 { 3317 /* release long term mount so mount point can be released */ 3318 if (!IS_ERR_OR_NULL(mnt)) { 3319 real_mount(mnt)->mnt_ns = NULL; 3320 synchronize_rcu(); /* yecchhh... */ 3321 mntput(mnt); 3322 } 3323 } 3324 EXPORT_SYMBOL(kern_unmount); 3325 3326 bool our_mnt(struct vfsmount *mnt) 3327 { 3328 return check_mnt(real_mount(mnt)); 3329 } 3330 3331 bool current_chrooted(void) 3332 { 3333 /* Does the current process have a non-standard root */ 3334 struct path ns_root; 3335 struct path fs_root; 3336 bool chrooted; 3337 3338 /* Find the namespace root */ 3339 ns_root.mnt = ¤t->nsproxy->mnt_ns->root->mnt; 3340 ns_root.dentry = ns_root.mnt->mnt_root; 3341 path_get(&ns_root); 3342 while (d_mountpoint(ns_root.dentry) && follow_down_one(&ns_root)) 3343 ; 3344 3345 get_fs_root(current->fs, &fs_root); 3346 3347 chrooted = !path_equal(&fs_root, &ns_root); 3348 3349 path_put(&fs_root); 3350 path_put(&ns_root); 3351 3352 return chrooted; 3353 } 3354 3355 static bool mnt_already_visible(struct mnt_namespace *ns, struct vfsmount *new, 3356 int *new_mnt_flags) 3357 { 3358 int new_flags = *new_mnt_flags; 3359 struct mount *mnt; 3360 bool visible = false; 3361 3362 down_read(&namespace_sem); 3363 list_for_each_entry(mnt, &ns->list, mnt_list) { 3364 struct mount *child; 3365 int mnt_flags; 3366 3367 if (mnt->mnt.mnt_sb->s_type != new->mnt_sb->s_type) 3368 continue; 3369 3370 /* This mount is not fully visible if it's root directory 3371 * is not the root directory of the filesystem. 3372 */ 3373 if (mnt->mnt.mnt_root != mnt->mnt.mnt_sb->s_root) 3374 continue; 3375 3376 /* A local view of the mount flags */ 3377 mnt_flags = mnt->mnt.mnt_flags; 3378 3379 /* Don't miss readonly hidden in the superblock flags */ 3380 if (sb_rdonly(mnt->mnt.mnt_sb)) 3381 mnt_flags |= MNT_LOCK_READONLY; 3382 3383 /* Verify the mount flags are equal to or more permissive 3384 * than the proposed new mount. 3385 */ 3386 if ((mnt_flags & MNT_LOCK_READONLY) && 3387 !(new_flags & MNT_READONLY)) 3388 continue; 3389 if ((mnt_flags & MNT_LOCK_ATIME) && 3390 ((mnt_flags & MNT_ATIME_MASK) != (new_flags & MNT_ATIME_MASK))) 3391 continue; 3392 3393 /* This mount is not fully visible if there are any 3394 * locked child mounts that cover anything except for 3395 * empty directories. 3396 */ 3397 list_for_each_entry(child, &mnt->mnt_mounts, mnt_child) { 3398 struct inode *inode = child->mnt_mountpoint->d_inode; 3399 /* Only worry about locked mounts */ 3400 if (!(child->mnt.mnt_flags & MNT_LOCKED)) 3401 continue; 3402 /* Is the directory permanetly empty? */ 3403 if (!is_empty_dir_inode(inode)) 3404 goto next; 3405 } 3406 /* Preserve the locked attributes */ 3407 *new_mnt_flags |= mnt_flags & (MNT_LOCK_READONLY | \ 3408 MNT_LOCK_ATIME); 3409 visible = true; 3410 goto found; 3411 next: ; 3412 } 3413 found: 3414 up_read(&namespace_sem); 3415 return visible; 3416 } 3417 3418 static bool mount_too_revealing(struct vfsmount *mnt, int *new_mnt_flags) 3419 { 3420 const unsigned long required_iflags = SB_I_NOEXEC | SB_I_NODEV; 3421 struct mnt_namespace *ns = current->nsproxy->mnt_ns; 3422 unsigned long s_iflags; 3423 3424 if (ns->user_ns == &init_user_ns) 3425 return false; 3426 3427 /* Can this filesystem be too revealing? */ 3428 s_iflags = mnt->mnt_sb->s_iflags; 3429 if (!(s_iflags & SB_I_USERNS_VISIBLE)) 3430 return false; 3431 3432 if ((s_iflags & required_iflags) != required_iflags) { 3433 WARN_ONCE(1, "Expected s_iflags to contain 0x%lx\n", 3434 required_iflags); 3435 return true; 3436 } 3437 3438 return !mnt_already_visible(ns, mnt, new_mnt_flags); 3439 } 3440 3441 bool mnt_may_suid(struct vfsmount *mnt) 3442 { 3443 /* 3444 * Foreign mounts (accessed via fchdir or through /proc 3445 * symlinks) are always treated as if they are nosuid. This 3446 * prevents namespaces from trusting potentially unsafe 3447 * suid/sgid bits, file caps, or security labels that originate 3448 * in other namespaces. 3449 */ 3450 return !(mnt->mnt_flags & MNT_NOSUID) && check_mnt(real_mount(mnt)) && 3451 current_in_userns(mnt->mnt_sb->s_user_ns); 3452 } 3453 3454 static struct ns_common *mntns_get(struct task_struct *task) 3455 { 3456 struct ns_common *ns = NULL; 3457 struct nsproxy *nsproxy; 3458 3459 task_lock(task); 3460 nsproxy = task->nsproxy; 3461 if (nsproxy) { 3462 ns = &nsproxy->mnt_ns->ns; 3463 get_mnt_ns(to_mnt_ns(ns)); 3464 } 3465 task_unlock(task); 3466 3467 return ns; 3468 } 3469 3470 static void mntns_put(struct ns_common *ns) 3471 { 3472 put_mnt_ns(to_mnt_ns(ns)); 3473 } 3474 3475 static int mntns_install(struct nsproxy *nsproxy, struct ns_common *ns) 3476 { 3477 struct fs_struct *fs = current->fs; 3478 struct mnt_namespace *mnt_ns = to_mnt_ns(ns), *old_mnt_ns; 3479 struct path root; 3480 int err; 3481 3482 if (!ns_capable(mnt_ns->user_ns, CAP_SYS_ADMIN) || 3483 !ns_capable(current_user_ns(), CAP_SYS_CHROOT) || 3484 !ns_capable(current_user_ns(), CAP_SYS_ADMIN)) 3485 return -EPERM; 3486 3487 if (fs->users != 1) 3488 return -EINVAL; 3489 3490 get_mnt_ns(mnt_ns); 3491 old_mnt_ns = nsproxy->mnt_ns; 3492 nsproxy->mnt_ns = mnt_ns; 3493 3494 /* Find the root */ 3495 err = vfs_path_lookup(mnt_ns->root->mnt.mnt_root, &mnt_ns->root->mnt, 3496 "/", LOOKUP_DOWN, &root); 3497 if (err) { 3498 /* revert to old namespace */ 3499 nsproxy->mnt_ns = old_mnt_ns; 3500 put_mnt_ns(mnt_ns); 3501 return err; 3502 } 3503 3504 put_mnt_ns(old_mnt_ns); 3505 3506 /* Update the pwd and root */ 3507 set_fs_pwd(fs, &root); 3508 set_fs_root(fs, &root); 3509 3510 path_put(&root); 3511 return 0; 3512 } 3513 3514 static struct user_namespace *mntns_owner(struct ns_common *ns) 3515 { 3516 return to_mnt_ns(ns)->user_ns; 3517 } 3518 3519 const struct proc_ns_operations mntns_operations = { 3520 .name = "mnt", 3521 .type = CLONE_NEWNS, 3522 .get = mntns_get, 3523 .put = mntns_put, 3524 .install = mntns_install, 3525 .owner = mntns_owner, 3526 }; 3527