1 /* 2 * linux/fs/namespace.c 3 * 4 * (C) Copyright Al Viro 2000, 2001 5 * Released under GPL v2. 6 * 7 * Based on code from fs/super.c, copyright Linus Torvalds and others. 8 * Heavily rewritten. 9 */ 10 11 #include <linux/syscalls.h> 12 #include <linux/export.h> 13 #include <linux/capability.h> 14 #include <linux/mnt_namespace.h> 15 #include <linux/user_namespace.h> 16 #include <linux/namei.h> 17 #include <linux/security.h> 18 #include <linux/idr.h> 19 #include <linux/init.h> /* init_rootfs */ 20 #include <linux/fs_struct.h> /* get_fs_root et.al. */ 21 #include <linux/fsnotify.h> /* fsnotify_vfsmount_delete */ 22 #include <linux/uaccess.h> 23 #include <linux/proc_ns.h> 24 #include <linux/magic.h> 25 #include <linux/bootmem.h> 26 #include <linux/task_work.h> 27 #include "pnode.h" 28 #include "internal.h" 29 30 /* Maximum number of mounts in a mount namespace */ 31 unsigned int sysctl_mount_max __read_mostly = 100000; 32 33 static unsigned int m_hash_mask __read_mostly; 34 static unsigned int m_hash_shift __read_mostly; 35 static unsigned int mp_hash_mask __read_mostly; 36 static unsigned int mp_hash_shift __read_mostly; 37 38 static __initdata unsigned long mhash_entries; 39 static int __init set_mhash_entries(char *str) 40 { 41 if (!str) 42 return 0; 43 mhash_entries = simple_strtoul(str, &str, 0); 44 return 1; 45 } 46 __setup("mhash_entries=", set_mhash_entries); 47 48 static __initdata unsigned long mphash_entries; 49 static int __init set_mphash_entries(char *str) 50 { 51 if (!str) 52 return 0; 53 mphash_entries = simple_strtoul(str, &str, 0); 54 return 1; 55 } 56 __setup("mphash_entries=", set_mphash_entries); 57 58 static u64 event; 59 static DEFINE_IDA(mnt_id_ida); 60 static DEFINE_IDA(mnt_group_ida); 61 static DEFINE_SPINLOCK(mnt_id_lock); 62 static int mnt_id_start = 0; 63 static int mnt_group_start = 1; 64 65 static struct hlist_head *mount_hashtable __read_mostly; 66 static struct hlist_head *mountpoint_hashtable __read_mostly; 67 static struct kmem_cache *mnt_cache __read_mostly; 68 static DECLARE_RWSEM(namespace_sem); 69 70 /* /sys/fs */ 71 struct kobject *fs_kobj; 72 EXPORT_SYMBOL_GPL(fs_kobj); 73 74 /* 75 * vfsmount lock may be taken for read to prevent changes to the 76 * vfsmount hash, ie. during mountpoint lookups or walking back 77 * up the tree. 78 * 79 * It should be taken for write in all cases where the vfsmount 80 * tree or hash is modified or when a vfsmount structure is modified. 81 */ 82 __cacheline_aligned_in_smp DEFINE_SEQLOCK(mount_lock); 83 84 static inline struct hlist_head *m_hash(struct vfsmount *mnt, struct dentry *dentry) 85 { 86 unsigned long tmp = ((unsigned long)mnt / L1_CACHE_BYTES); 87 tmp += ((unsigned long)dentry / L1_CACHE_BYTES); 88 tmp = tmp + (tmp >> m_hash_shift); 89 return &mount_hashtable[tmp & m_hash_mask]; 90 } 91 92 static inline struct hlist_head *mp_hash(struct dentry *dentry) 93 { 94 unsigned long tmp = ((unsigned long)dentry / L1_CACHE_BYTES); 95 tmp = tmp + (tmp >> mp_hash_shift); 96 return &mountpoint_hashtable[tmp & mp_hash_mask]; 97 } 98 99 static int mnt_alloc_id(struct mount *mnt) 100 { 101 int res; 102 103 retry: 104 ida_pre_get(&mnt_id_ida, GFP_KERNEL); 105 spin_lock(&mnt_id_lock); 106 res = ida_get_new_above(&mnt_id_ida, mnt_id_start, &mnt->mnt_id); 107 if (!res) 108 mnt_id_start = mnt->mnt_id + 1; 109 spin_unlock(&mnt_id_lock); 110 if (res == -EAGAIN) 111 goto retry; 112 113 return res; 114 } 115 116 static void mnt_free_id(struct mount *mnt) 117 { 118 int id = mnt->mnt_id; 119 spin_lock(&mnt_id_lock); 120 ida_remove(&mnt_id_ida, id); 121 if (mnt_id_start > id) 122 mnt_id_start = id; 123 spin_unlock(&mnt_id_lock); 124 } 125 126 /* 127 * Allocate a new peer group ID 128 * 129 * mnt_group_ida is protected by namespace_sem 130 */ 131 static int mnt_alloc_group_id(struct mount *mnt) 132 { 133 int res; 134 135 if (!ida_pre_get(&mnt_group_ida, GFP_KERNEL)) 136 return -ENOMEM; 137 138 res = ida_get_new_above(&mnt_group_ida, 139 mnt_group_start, 140 &mnt->mnt_group_id); 141 if (!res) 142 mnt_group_start = mnt->mnt_group_id + 1; 143 144 return res; 145 } 146 147 /* 148 * Release a peer group ID 149 */ 150 void mnt_release_group_id(struct mount *mnt) 151 { 152 int id = mnt->mnt_group_id; 153 ida_remove(&mnt_group_ida, id); 154 if (mnt_group_start > id) 155 mnt_group_start = id; 156 mnt->mnt_group_id = 0; 157 } 158 159 /* 160 * vfsmount lock must be held for read 161 */ 162 static inline void mnt_add_count(struct mount *mnt, int n) 163 { 164 #ifdef CONFIG_SMP 165 this_cpu_add(mnt->mnt_pcp->mnt_count, n); 166 #else 167 preempt_disable(); 168 mnt->mnt_count += n; 169 preempt_enable(); 170 #endif 171 } 172 173 /* 174 * vfsmount lock must be held for write 175 */ 176 unsigned int mnt_get_count(struct mount *mnt) 177 { 178 #ifdef CONFIG_SMP 179 unsigned int count = 0; 180 int cpu; 181 182 for_each_possible_cpu(cpu) { 183 count += per_cpu_ptr(mnt->mnt_pcp, cpu)->mnt_count; 184 } 185 186 return count; 187 #else 188 return mnt->mnt_count; 189 #endif 190 } 191 192 static void drop_mountpoint(struct fs_pin *p) 193 { 194 struct mount *m = container_of(p, struct mount, mnt_umount); 195 dput(m->mnt_ex_mountpoint); 196 pin_remove(p); 197 mntput(&m->mnt); 198 } 199 200 static struct mount *alloc_vfsmnt(const char *name) 201 { 202 struct mount *mnt = kmem_cache_zalloc(mnt_cache, GFP_KERNEL); 203 if (mnt) { 204 int err; 205 206 err = mnt_alloc_id(mnt); 207 if (err) 208 goto out_free_cache; 209 210 if (name) { 211 mnt->mnt_devname = kstrdup_const(name, GFP_KERNEL); 212 if (!mnt->mnt_devname) 213 goto out_free_id; 214 } 215 216 #ifdef CONFIG_SMP 217 mnt->mnt_pcp = alloc_percpu(struct mnt_pcp); 218 if (!mnt->mnt_pcp) 219 goto out_free_devname; 220 221 this_cpu_add(mnt->mnt_pcp->mnt_count, 1); 222 #else 223 mnt->mnt_count = 1; 224 mnt->mnt_writers = 0; 225 #endif 226 227 INIT_HLIST_NODE(&mnt->mnt_hash); 228 INIT_LIST_HEAD(&mnt->mnt_child); 229 INIT_LIST_HEAD(&mnt->mnt_mounts); 230 INIT_LIST_HEAD(&mnt->mnt_list); 231 INIT_LIST_HEAD(&mnt->mnt_expire); 232 INIT_LIST_HEAD(&mnt->mnt_share); 233 INIT_LIST_HEAD(&mnt->mnt_slave_list); 234 INIT_LIST_HEAD(&mnt->mnt_slave); 235 INIT_HLIST_NODE(&mnt->mnt_mp_list); 236 #ifdef CONFIG_FSNOTIFY 237 INIT_HLIST_HEAD(&mnt->mnt_fsnotify_marks); 238 #endif 239 init_fs_pin(&mnt->mnt_umount, drop_mountpoint); 240 } 241 return mnt; 242 243 #ifdef CONFIG_SMP 244 out_free_devname: 245 kfree_const(mnt->mnt_devname); 246 #endif 247 out_free_id: 248 mnt_free_id(mnt); 249 out_free_cache: 250 kmem_cache_free(mnt_cache, mnt); 251 return NULL; 252 } 253 254 /* 255 * Most r/o checks on a fs are for operations that take 256 * discrete amounts of time, like a write() or unlink(). 257 * We must keep track of when those operations start 258 * (for permission checks) and when they end, so that 259 * we can determine when writes are able to occur to 260 * a filesystem. 261 */ 262 /* 263 * __mnt_is_readonly: check whether a mount is read-only 264 * @mnt: the mount to check for its write status 265 * 266 * This shouldn't be used directly ouside of the VFS. 267 * It does not guarantee that the filesystem will stay 268 * r/w, just that it is right *now*. This can not and 269 * should not be used in place of IS_RDONLY(inode). 270 * mnt_want/drop_write() will _keep_ the filesystem 271 * r/w. 272 */ 273 int __mnt_is_readonly(struct vfsmount *mnt) 274 { 275 if (mnt->mnt_flags & MNT_READONLY) 276 return 1; 277 if (mnt->mnt_sb->s_flags & MS_RDONLY) 278 return 1; 279 return 0; 280 } 281 EXPORT_SYMBOL_GPL(__mnt_is_readonly); 282 283 static inline void mnt_inc_writers(struct mount *mnt) 284 { 285 #ifdef CONFIG_SMP 286 this_cpu_inc(mnt->mnt_pcp->mnt_writers); 287 #else 288 mnt->mnt_writers++; 289 #endif 290 } 291 292 static inline void mnt_dec_writers(struct mount *mnt) 293 { 294 #ifdef CONFIG_SMP 295 this_cpu_dec(mnt->mnt_pcp->mnt_writers); 296 #else 297 mnt->mnt_writers--; 298 #endif 299 } 300 301 static unsigned int mnt_get_writers(struct mount *mnt) 302 { 303 #ifdef CONFIG_SMP 304 unsigned int count = 0; 305 int cpu; 306 307 for_each_possible_cpu(cpu) { 308 count += per_cpu_ptr(mnt->mnt_pcp, cpu)->mnt_writers; 309 } 310 311 return count; 312 #else 313 return mnt->mnt_writers; 314 #endif 315 } 316 317 static int mnt_is_readonly(struct vfsmount *mnt) 318 { 319 if (mnt->mnt_sb->s_readonly_remount) 320 return 1; 321 /* Order wrt setting s_flags/s_readonly_remount in do_remount() */ 322 smp_rmb(); 323 return __mnt_is_readonly(mnt); 324 } 325 326 /* 327 * Most r/o & frozen checks on a fs are for operations that take discrete 328 * amounts of time, like a write() or unlink(). We must keep track of when 329 * those operations start (for permission checks) and when they end, so that we 330 * can determine when writes are able to occur to a filesystem. 331 */ 332 /** 333 * __mnt_want_write - get write access to a mount without freeze protection 334 * @m: the mount on which to take a write 335 * 336 * This tells the low-level filesystem that a write is about to be performed to 337 * it, and makes sure that writes are allowed (mnt it read-write) before 338 * returning success. This operation does not protect against filesystem being 339 * frozen. When the write operation is finished, __mnt_drop_write() must be 340 * called. This is effectively a refcount. 341 */ 342 int __mnt_want_write(struct vfsmount *m) 343 { 344 struct mount *mnt = real_mount(m); 345 int ret = 0; 346 347 preempt_disable(); 348 mnt_inc_writers(mnt); 349 /* 350 * The store to mnt_inc_writers must be visible before we pass 351 * MNT_WRITE_HOLD loop below, so that the slowpath can see our 352 * incremented count after it has set MNT_WRITE_HOLD. 353 */ 354 smp_mb(); 355 while (ACCESS_ONCE(mnt->mnt.mnt_flags) & MNT_WRITE_HOLD) 356 cpu_relax(); 357 /* 358 * After the slowpath clears MNT_WRITE_HOLD, mnt_is_readonly will 359 * be set to match its requirements. So we must not load that until 360 * MNT_WRITE_HOLD is cleared. 361 */ 362 smp_rmb(); 363 if (mnt_is_readonly(m)) { 364 mnt_dec_writers(mnt); 365 ret = -EROFS; 366 } 367 preempt_enable(); 368 369 return ret; 370 } 371 372 /** 373 * mnt_want_write - get write access to a mount 374 * @m: the mount on which to take a write 375 * 376 * This tells the low-level filesystem that a write is about to be performed to 377 * it, and makes sure that writes are allowed (mount is read-write, filesystem 378 * is not frozen) before returning success. When the write operation is 379 * finished, mnt_drop_write() must be called. This is effectively a refcount. 380 */ 381 int mnt_want_write(struct vfsmount *m) 382 { 383 int ret; 384 385 sb_start_write(m->mnt_sb); 386 ret = __mnt_want_write(m); 387 if (ret) 388 sb_end_write(m->mnt_sb); 389 return ret; 390 } 391 EXPORT_SYMBOL_GPL(mnt_want_write); 392 393 /** 394 * mnt_clone_write - get write access to a mount 395 * @mnt: the mount on which to take a write 396 * 397 * This is effectively like mnt_want_write, except 398 * it must only be used to take an extra write reference 399 * on a mountpoint that we already know has a write reference 400 * on it. This allows some optimisation. 401 * 402 * After finished, mnt_drop_write must be called as usual to 403 * drop the reference. 404 */ 405 int mnt_clone_write(struct vfsmount *mnt) 406 { 407 /* superblock may be r/o */ 408 if (__mnt_is_readonly(mnt)) 409 return -EROFS; 410 preempt_disable(); 411 mnt_inc_writers(real_mount(mnt)); 412 preempt_enable(); 413 return 0; 414 } 415 EXPORT_SYMBOL_GPL(mnt_clone_write); 416 417 /** 418 * __mnt_want_write_file - get write access to a file's mount 419 * @file: the file who's mount on which to take a write 420 * 421 * This is like __mnt_want_write, but it takes a file and can 422 * do some optimisations if the file is open for write already 423 */ 424 int __mnt_want_write_file(struct file *file) 425 { 426 if (!(file->f_mode & FMODE_WRITER)) 427 return __mnt_want_write(file->f_path.mnt); 428 else 429 return mnt_clone_write(file->f_path.mnt); 430 } 431 432 /** 433 * mnt_want_write_file - get write access to a file's mount 434 * @file: the file who's mount on which to take a write 435 * 436 * This is like mnt_want_write, but it takes a file and can 437 * do some optimisations if the file is open for write already 438 */ 439 int mnt_want_write_file(struct file *file) 440 { 441 int ret; 442 443 sb_start_write(file->f_path.mnt->mnt_sb); 444 ret = __mnt_want_write_file(file); 445 if (ret) 446 sb_end_write(file->f_path.mnt->mnt_sb); 447 return ret; 448 } 449 EXPORT_SYMBOL_GPL(mnt_want_write_file); 450 451 /** 452 * __mnt_drop_write - give up write access to a mount 453 * @mnt: the mount on which to give up write access 454 * 455 * Tells the low-level filesystem that we are done 456 * performing writes to it. Must be matched with 457 * __mnt_want_write() call above. 458 */ 459 void __mnt_drop_write(struct vfsmount *mnt) 460 { 461 preempt_disable(); 462 mnt_dec_writers(real_mount(mnt)); 463 preempt_enable(); 464 } 465 466 /** 467 * mnt_drop_write - give up write access to a mount 468 * @mnt: the mount on which to give up write access 469 * 470 * Tells the low-level filesystem that we are done performing writes to it and 471 * also allows filesystem to be frozen again. Must be matched with 472 * mnt_want_write() call above. 473 */ 474 void mnt_drop_write(struct vfsmount *mnt) 475 { 476 __mnt_drop_write(mnt); 477 sb_end_write(mnt->mnt_sb); 478 } 479 EXPORT_SYMBOL_GPL(mnt_drop_write); 480 481 void __mnt_drop_write_file(struct file *file) 482 { 483 __mnt_drop_write(file->f_path.mnt); 484 } 485 486 void mnt_drop_write_file(struct file *file) 487 { 488 mnt_drop_write(file->f_path.mnt); 489 } 490 EXPORT_SYMBOL(mnt_drop_write_file); 491 492 static int mnt_make_readonly(struct mount *mnt) 493 { 494 int ret = 0; 495 496 lock_mount_hash(); 497 mnt->mnt.mnt_flags |= MNT_WRITE_HOLD; 498 /* 499 * After storing MNT_WRITE_HOLD, we'll read the counters. This store 500 * should be visible before we do. 501 */ 502 smp_mb(); 503 504 /* 505 * With writers on hold, if this value is zero, then there are 506 * definitely no active writers (although held writers may subsequently 507 * increment the count, they'll have to wait, and decrement it after 508 * seeing MNT_READONLY). 509 * 510 * It is OK to have counter incremented on one CPU and decremented on 511 * another: the sum will add up correctly. The danger would be when we 512 * sum up each counter, if we read a counter before it is incremented, 513 * but then read another CPU's count which it has been subsequently 514 * decremented from -- we would see more decrements than we should. 515 * MNT_WRITE_HOLD protects against this scenario, because 516 * mnt_want_write first increments count, then smp_mb, then spins on 517 * MNT_WRITE_HOLD, so it can't be decremented by another CPU while 518 * we're counting up here. 519 */ 520 if (mnt_get_writers(mnt) > 0) 521 ret = -EBUSY; 522 else 523 mnt->mnt.mnt_flags |= MNT_READONLY; 524 /* 525 * MNT_READONLY must become visible before ~MNT_WRITE_HOLD, so writers 526 * that become unheld will see MNT_READONLY. 527 */ 528 smp_wmb(); 529 mnt->mnt.mnt_flags &= ~MNT_WRITE_HOLD; 530 unlock_mount_hash(); 531 return ret; 532 } 533 534 static void __mnt_unmake_readonly(struct mount *mnt) 535 { 536 lock_mount_hash(); 537 mnt->mnt.mnt_flags &= ~MNT_READONLY; 538 unlock_mount_hash(); 539 } 540 541 int sb_prepare_remount_readonly(struct super_block *sb) 542 { 543 struct mount *mnt; 544 int err = 0; 545 546 /* Racy optimization. Recheck the counter under MNT_WRITE_HOLD */ 547 if (atomic_long_read(&sb->s_remove_count)) 548 return -EBUSY; 549 550 lock_mount_hash(); 551 list_for_each_entry(mnt, &sb->s_mounts, mnt_instance) { 552 if (!(mnt->mnt.mnt_flags & MNT_READONLY)) { 553 mnt->mnt.mnt_flags |= MNT_WRITE_HOLD; 554 smp_mb(); 555 if (mnt_get_writers(mnt) > 0) { 556 err = -EBUSY; 557 break; 558 } 559 } 560 } 561 if (!err && atomic_long_read(&sb->s_remove_count)) 562 err = -EBUSY; 563 564 if (!err) { 565 sb->s_readonly_remount = 1; 566 smp_wmb(); 567 } 568 list_for_each_entry(mnt, &sb->s_mounts, mnt_instance) { 569 if (mnt->mnt.mnt_flags & MNT_WRITE_HOLD) 570 mnt->mnt.mnt_flags &= ~MNT_WRITE_HOLD; 571 } 572 unlock_mount_hash(); 573 574 return err; 575 } 576 577 static void free_vfsmnt(struct mount *mnt) 578 { 579 kfree_const(mnt->mnt_devname); 580 #ifdef CONFIG_SMP 581 free_percpu(mnt->mnt_pcp); 582 #endif 583 kmem_cache_free(mnt_cache, mnt); 584 } 585 586 static void delayed_free_vfsmnt(struct rcu_head *head) 587 { 588 free_vfsmnt(container_of(head, struct mount, mnt_rcu)); 589 } 590 591 /* call under rcu_read_lock */ 592 int __legitimize_mnt(struct vfsmount *bastard, unsigned seq) 593 { 594 struct mount *mnt; 595 if (read_seqretry(&mount_lock, seq)) 596 return 1; 597 if (bastard == NULL) 598 return 0; 599 mnt = real_mount(bastard); 600 mnt_add_count(mnt, 1); 601 if (likely(!read_seqretry(&mount_lock, seq))) 602 return 0; 603 if (bastard->mnt_flags & MNT_SYNC_UMOUNT) { 604 mnt_add_count(mnt, -1); 605 return 1; 606 } 607 return -1; 608 } 609 610 /* call under rcu_read_lock */ 611 bool legitimize_mnt(struct vfsmount *bastard, unsigned seq) 612 { 613 int res = __legitimize_mnt(bastard, seq); 614 if (likely(!res)) 615 return true; 616 if (unlikely(res < 0)) { 617 rcu_read_unlock(); 618 mntput(bastard); 619 rcu_read_lock(); 620 } 621 return false; 622 } 623 624 /* 625 * find the first mount at @dentry on vfsmount @mnt. 626 * call under rcu_read_lock() 627 */ 628 struct mount *__lookup_mnt(struct vfsmount *mnt, struct dentry *dentry) 629 { 630 struct hlist_head *head = m_hash(mnt, dentry); 631 struct mount *p; 632 633 hlist_for_each_entry_rcu(p, head, mnt_hash) 634 if (&p->mnt_parent->mnt == mnt && p->mnt_mountpoint == dentry) 635 return p; 636 return NULL; 637 } 638 639 /* 640 * find the last mount at @dentry on vfsmount @mnt. 641 * mount_lock must be held. 642 */ 643 struct mount *__lookup_mnt_last(struct vfsmount *mnt, struct dentry *dentry) 644 { 645 struct mount *p, *res = NULL; 646 p = __lookup_mnt(mnt, dentry); 647 if (!p) 648 goto out; 649 if (!(p->mnt.mnt_flags & MNT_UMOUNT)) 650 res = p; 651 hlist_for_each_entry_continue(p, mnt_hash) { 652 if (&p->mnt_parent->mnt != mnt || p->mnt_mountpoint != dentry) 653 break; 654 if (!(p->mnt.mnt_flags & MNT_UMOUNT)) 655 res = p; 656 } 657 out: 658 return res; 659 } 660 661 /* 662 * lookup_mnt - Return the first child mount mounted at path 663 * 664 * "First" means first mounted chronologically. If you create the 665 * following mounts: 666 * 667 * mount /dev/sda1 /mnt 668 * mount /dev/sda2 /mnt 669 * mount /dev/sda3 /mnt 670 * 671 * Then lookup_mnt() on the base /mnt dentry in the root mount will 672 * return successively the root dentry and vfsmount of /dev/sda1, then 673 * /dev/sda2, then /dev/sda3, then NULL. 674 * 675 * lookup_mnt takes a reference to the found vfsmount. 676 */ 677 struct vfsmount *lookup_mnt(const struct path *path) 678 { 679 struct mount *child_mnt; 680 struct vfsmount *m; 681 unsigned seq; 682 683 rcu_read_lock(); 684 do { 685 seq = read_seqbegin(&mount_lock); 686 child_mnt = __lookup_mnt(path->mnt, path->dentry); 687 m = child_mnt ? &child_mnt->mnt : NULL; 688 } while (!legitimize_mnt(m, seq)); 689 rcu_read_unlock(); 690 return m; 691 } 692 693 /* 694 * __is_local_mountpoint - Test to see if dentry is a mountpoint in the 695 * current mount namespace. 696 * 697 * The common case is dentries are not mountpoints at all and that 698 * test is handled inline. For the slow case when we are actually 699 * dealing with a mountpoint of some kind, walk through all of the 700 * mounts in the current mount namespace and test to see if the dentry 701 * is a mountpoint. 702 * 703 * The mount_hashtable is not usable in the context because we 704 * need to identify all mounts that may be in the current mount 705 * namespace not just a mount that happens to have some specified 706 * parent mount. 707 */ 708 bool __is_local_mountpoint(struct dentry *dentry) 709 { 710 struct mnt_namespace *ns = current->nsproxy->mnt_ns; 711 struct mount *mnt; 712 bool is_covered = false; 713 714 if (!d_mountpoint(dentry)) 715 goto out; 716 717 down_read(&namespace_sem); 718 list_for_each_entry(mnt, &ns->list, mnt_list) { 719 is_covered = (mnt->mnt_mountpoint == dentry); 720 if (is_covered) 721 break; 722 } 723 up_read(&namespace_sem); 724 out: 725 return is_covered; 726 } 727 728 static struct mountpoint *lookup_mountpoint(struct dentry *dentry) 729 { 730 struct hlist_head *chain = mp_hash(dentry); 731 struct mountpoint *mp; 732 733 hlist_for_each_entry(mp, chain, m_hash) { 734 if (mp->m_dentry == dentry) { 735 /* might be worth a WARN_ON() */ 736 if (d_unlinked(dentry)) 737 return ERR_PTR(-ENOENT); 738 mp->m_count++; 739 return mp; 740 } 741 } 742 return NULL; 743 } 744 745 static struct mountpoint *new_mountpoint(struct dentry *dentry) 746 { 747 struct hlist_head *chain = mp_hash(dentry); 748 struct mountpoint *mp; 749 int ret; 750 751 mp = kmalloc(sizeof(struct mountpoint), GFP_KERNEL); 752 if (!mp) 753 return ERR_PTR(-ENOMEM); 754 755 ret = d_set_mounted(dentry); 756 if (ret) { 757 kfree(mp); 758 return ERR_PTR(ret); 759 } 760 761 mp->m_dentry = dentry; 762 mp->m_count = 1; 763 hlist_add_head(&mp->m_hash, chain); 764 INIT_HLIST_HEAD(&mp->m_list); 765 return mp; 766 } 767 768 static void put_mountpoint(struct mountpoint *mp) 769 { 770 if (!--mp->m_count) { 771 struct dentry *dentry = mp->m_dentry; 772 BUG_ON(!hlist_empty(&mp->m_list)); 773 spin_lock(&dentry->d_lock); 774 dentry->d_flags &= ~DCACHE_MOUNTED; 775 spin_unlock(&dentry->d_lock); 776 hlist_del(&mp->m_hash); 777 kfree(mp); 778 } 779 } 780 781 static inline int check_mnt(struct mount *mnt) 782 { 783 return mnt->mnt_ns == current->nsproxy->mnt_ns; 784 } 785 786 /* 787 * vfsmount lock must be held for write 788 */ 789 static void touch_mnt_namespace(struct mnt_namespace *ns) 790 { 791 if (ns) { 792 ns->event = ++event; 793 wake_up_interruptible(&ns->poll); 794 } 795 } 796 797 /* 798 * vfsmount lock must be held for write 799 */ 800 static void __touch_mnt_namespace(struct mnt_namespace *ns) 801 { 802 if (ns && ns->event != event) { 803 ns->event = event; 804 wake_up_interruptible(&ns->poll); 805 } 806 } 807 808 /* 809 * vfsmount lock must be held for write 810 */ 811 static void unhash_mnt(struct mount *mnt) 812 { 813 mnt->mnt_parent = mnt; 814 mnt->mnt_mountpoint = mnt->mnt.mnt_root; 815 list_del_init(&mnt->mnt_child); 816 hlist_del_init_rcu(&mnt->mnt_hash); 817 hlist_del_init(&mnt->mnt_mp_list); 818 put_mountpoint(mnt->mnt_mp); 819 mnt->mnt_mp = NULL; 820 } 821 822 /* 823 * vfsmount lock must be held for write 824 */ 825 static void detach_mnt(struct mount *mnt, struct path *old_path) 826 { 827 old_path->dentry = mnt->mnt_mountpoint; 828 old_path->mnt = &mnt->mnt_parent->mnt; 829 unhash_mnt(mnt); 830 } 831 832 /* 833 * vfsmount lock must be held for write 834 */ 835 static void umount_mnt(struct mount *mnt) 836 { 837 /* old mountpoint will be dropped when we can do that */ 838 mnt->mnt_ex_mountpoint = mnt->mnt_mountpoint; 839 unhash_mnt(mnt); 840 } 841 842 /* 843 * vfsmount lock must be held for write 844 */ 845 void mnt_set_mountpoint(struct mount *mnt, 846 struct mountpoint *mp, 847 struct mount *child_mnt) 848 { 849 mp->m_count++; 850 mnt_add_count(mnt, 1); /* essentially, that's mntget */ 851 child_mnt->mnt_mountpoint = dget(mp->m_dentry); 852 child_mnt->mnt_parent = mnt; 853 child_mnt->mnt_mp = mp; 854 hlist_add_head(&child_mnt->mnt_mp_list, &mp->m_list); 855 } 856 857 /* 858 * vfsmount lock must be held for write 859 */ 860 static void attach_mnt(struct mount *mnt, 861 struct mount *parent, 862 struct mountpoint *mp) 863 { 864 mnt_set_mountpoint(parent, mp, mnt); 865 hlist_add_head_rcu(&mnt->mnt_hash, m_hash(&parent->mnt, mp->m_dentry)); 866 list_add_tail(&mnt->mnt_child, &parent->mnt_mounts); 867 } 868 869 static void attach_shadowed(struct mount *mnt, 870 struct mount *parent, 871 struct mount *shadows) 872 { 873 if (shadows) { 874 hlist_add_behind_rcu(&mnt->mnt_hash, &shadows->mnt_hash); 875 list_add(&mnt->mnt_child, &shadows->mnt_child); 876 } else { 877 hlist_add_head_rcu(&mnt->mnt_hash, 878 m_hash(&parent->mnt, mnt->mnt_mountpoint)); 879 list_add_tail(&mnt->mnt_child, &parent->mnt_mounts); 880 } 881 } 882 883 /* 884 * vfsmount lock must be held for write 885 */ 886 static void commit_tree(struct mount *mnt, struct mount *shadows) 887 { 888 struct mount *parent = mnt->mnt_parent; 889 struct mount *m; 890 LIST_HEAD(head); 891 struct mnt_namespace *n = parent->mnt_ns; 892 893 BUG_ON(parent == mnt); 894 895 list_add_tail(&head, &mnt->mnt_list); 896 list_for_each_entry(m, &head, mnt_list) 897 m->mnt_ns = n; 898 899 list_splice(&head, n->list.prev); 900 901 n->mounts += n->pending_mounts; 902 n->pending_mounts = 0; 903 904 attach_shadowed(mnt, parent, shadows); 905 touch_mnt_namespace(n); 906 } 907 908 static struct mount *next_mnt(struct mount *p, struct mount *root) 909 { 910 struct list_head *next = p->mnt_mounts.next; 911 if (next == &p->mnt_mounts) { 912 while (1) { 913 if (p == root) 914 return NULL; 915 next = p->mnt_child.next; 916 if (next != &p->mnt_parent->mnt_mounts) 917 break; 918 p = p->mnt_parent; 919 } 920 } 921 return list_entry(next, struct mount, mnt_child); 922 } 923 924 static struct mount *skip_mnt_tree(struct mount *p) 925 { 926 struct list_head *prev = p->mnt_mounts.prev; 927 while (prev != &p->mnt_mounts) { 928 p = list_entry(prev, struct mount, mnt_child); 929 prev = p->mnt_mounts.prev; 930 } 931 return p; 932 } 933 934 struct vfsmount * 935 vfs_kern_mount(struct file_system_type *type, int flags, const char *name, void *data) 936 { 937 struct mount *mnt; 938 struct dentry *root; 939 940 if (!type) 941 return ERR_PTR(-ENODEV); 942 943 mnt = alloc_vfsmnt(name); 944 if (!mnt) 945 return ERR_PTR(-ENOMEM); 946 947 if (flags & MS_KERNMOUNT) 948 mnt->mnt.mnt_flags = MNT_INTERNAL; 949 950 root = mount_fs(type, flags, name, data); 951 if (IS_ERR(root)) { 952 mnt_free_id(mnt); 953 free_vfsmnt(mnt); 954 return ERR_CAST(root); 955 } 956 957 mnt->mnt.mnt_root = root; 958 mnt->mnt.mnt_sb = root->d_sb; 959 mnt->mnt_mountpoint = mnt->mnt.mnt_root; 960 mnt->mnt_parent = mnt; 961 lock_mount_hash(); 962 list_add_tail(&mnt->mnt_instance, &root->d_sb->s_mounts); 963 unlock_mount_hash(); 964 return &mnt->mnt; 965 } 966 EXPORT_SYMBOL_GPL(vfs_kern_mount); 967 968 static struct mount *clone_mnt(struct mount *old, struct dentry *root, 969 int flag) 970 { 971 struct super_block *sb = old->mnt.mnt_sb; 972 struct mount *mnt; 973 int err; 974 975 mnt = alloc_vfsmnt(old->mnt_devname); 976 if (!mnt) 977 return ERR_PTR(-ENOMEM); 978 979 if (flag & (CL_SLAVE | CL_PRIVATE | CL_SHARED_TO_SLAVE)) 980 mnt->mnt_group_id = 0; /* not a peer of original */ 981 else 982 mnt->mnt_group_id = old->mnt_group_id; 983 984 if ((flag & CL_MAKE_SHARED) && !mnt->mnt_group_id) { 985 err = mnt_alloc_group_id(mnt); 986 if (err) 987 goto out_free; 988 } 989 990 mnt->mnt.mnt_flags = old->mnt.mnt_flags & ~(MNT_WRITE_HOLD|MNT_MARKED); 991 /* Don't allow unprivileged users to change mount flags */ 992 if (flag & CL_UNPRIVILEGED) { 993 mnt->mnt.mnt_flags |= MNT_LOCK_ATIME; 994 995 if (mnt->mnt.mnt_flags & MNT_READONLY) 996 mnt->mnt.mnt_flags |= MNT_LOCK_READONLY; 997 998 if (mnt->mnt.mnt_flags & MNT_NODEV) 999 mnt->mnt.mnt_flags |= MNT_LOCK_NODEV; 1000 1001 if (mnt->mnt.mnt_flags & MNT_NOSUID) 1002 mnt->mnt.mnt_flags |= MNT_LOCK_NOSUID; 1003 1004 if (mnt->mnt.mnt_flags & MNT_NOEXEC) 1005 mnt->mnt.mnt_flags |= MNT_LOCK_NOEXEC; 1006 } 1007 1008 /* Don't allow unprivileged users to reveal what is under a mount */ 1009 if ((flag & CL_UNPRIVILEGED) && 1010 (!(flag & CL_EXPIRE) || list_empty(&old->mnt_expire))) 1011 mnt->mnt.mnt_flags |= MNT_LOCKED; 1012 1013 atomic_inc(&sb->s_active); 1014 mnt->mnt.mnt_sb = sb; 1015 mnt->mnt.mnt_root = dget(root); 1016 mnt->mnt_mountpoint = mnt->mnt.mnt_root; 1017 mnt->mnt_parent = mnt; 1018 lock_mount_hash(); 1019 list_add_tail(&mnt->mnt_instance, &sb->s_mounts); 1020 unlock_mount_hash(); 1021 1022 if ((flag & CL_SLAVE) || 1023 ((flag & CL_SHARED_TO_SLAVE) && IS_MNT_SHARED(old))) { 1024 list_add(&mnt->mnt_slave, &old->mnt_slave_list); 1025 mnt->mnt_master = old; 1026 CLEAR_MNT_SHARED(mnt); 1027 } else if (!(flag & CL_PRIVATE)) { 1028 if ((flag & CL_MAKE_SHARED) || IS_MNT_SHARED(old)) 1029 list_add(&mnt->mnt_share, &old->mnt_share); 1030 if (IS_MNT_SLAVE(old)) 1031 list_add(&mnt->mnt_slave, &old->mnt_slave); 1032 mnt->mnt_master = old->mnt_master; 1033 } else { 1034 CLEAR_MNT_SHARED(mnt); 1035 } 1036 if (flag & CL_MAKE_SHARED) 1037 set_mnt_shared(mnt); 1038 1039 /* stick the duplicate mount on the same expiry list 1040 * as the original if that was on one */ 1041 if (flag & CL_EXPIRE) { 1042 if (!list_empty(&old->mnt_expire)) 1043 list_add(&mnt->mnt_expire, &old->mnt_expire); 1044 } 1045 1046 return mnt; 1047 1048 out_free: 1049 mnt_free_id(mnt); 1050 free_vfsmnt(mnt); 1051 return ERR_PTR(err); 1052 } 1053 1054 static void cleanup_mnt(struct mount *mnt) 1055 { 1056 /* 1057 * This probably indicates that somebody messed 1058 * up a mnt_want/drop_write() pair. If this 1059 * happens, the filesystem was probably unable 1060 * to make r/w->r/o transitions. 1061 */ 1062 /* 1063 * The locking used to deal with mnt_count decrement provides barriers, 1064 * so mnt_get_writers() below is safe. 1065 */ 1066 WARN_ON(mnt_get_writers(mnt)); 1067 if (unlikely(mnt->mnt_pins.first)) 1068 mnt_pin_kill(mnt); 1069 fsnotify_vfsmount_delete(&mnt->mnt); 1070 dput(mnt->mnt.mnt_root); 1071 deactivate_super(mnt->mnt.mnt_sb); 1072 mnt_free_id(mnt); 1073 call_rcu(&mnt->mnt_rcu, delayed_free_vfsmnt); 1074 } 1075 1076 static void __cleanup_mnt(struct rcu_head *head) 1077 { 1078 cleanup_mnt(container_of(head, struct mount, mnt_rcu)); 1079 } 1080 1081 static LLIST_HEAD(delayed_mntput_list); 1082 static void delayed_mntput(struct work_struct *unused) 1083 { 1084 struct llist_node *node = llist_del_all(&delayed_mntput_list); 1085 struct llist_node *next; 1086 1087 for (; node; node = next) { 1088 next = llist_next(node); 1089 cleanup_mnt(llist_entry(node, struct mount, mnt_llist)); 1090 } 1091 } 1092 static DECLARE_DELAYED_WORK(delayed_mntput_work, delayed_mntput); 1093 1094 static void mntput_no_expire(struct mount *mnt) 1095 { 1096 rcu_read_lock(); 1097 mnt_add_count(mnt, -1); 1098 if (likely(mnt->mnt_ns)) { /* shouldn't be the last one */ 1099 rcu_read_unlock(); 1100 return; 1101 } 1102 lock_mount_hash(); 1103 if (mnt_get_count(mnt)) { 1104 rcu_read_unlock(); 1105 unlock_mount_hash(); 1106 return; 1107 } 1108 if (unlikely(mnt->mnt.mnt_flags & MNT_DOOMED)) { 1109 rcu_read_unlock(); 1110 unlock_mount_hash(); 1111 return; 1112 } 1113 mnt->mnt.mnt_flags |= MNT_DOOMED; 1114 rcu_read_unlock(); 1115 1116 list_del(&mnt->mnt_instance); 1117 1118 if (unlikely(!list_empty(&mnt->mnt_mounts))) { 1119 struct mount *p, *tmp; 1120 list_for_each_entry_safe(p, tmp, &mnt->mnt_mounts, mnt_child) { 1121 umount_mnt(p); 1122 } 1123 } 1124 unlock_mount_hash(); 1125 1126 if (likely(!(mnt->mnt.mnt_flags & MNT_INTERNAL))) { 1127 struct task_struct *task = current; 1128 if (likely(!(task->flags & PF_KTHREAD))) { 1129 init_task_work(&mnt->mnt_rcu, __cleanup_mnt); 1130 if (!task_work_add(task, &mnt->mnt_rcu, true)) 1131 return; 1132 } 1133 if (llist_add(&mnt->mnt_llist, &delayed_mntput_list)) 1134 schedule_delayed_work(&delayed_mntput_work, 1); 1135 return; 1136 } 1137 cleanup_mnt(mnt); 1138 } 1139 1140 void mntput(struct vfsmount *mnt) 1141 { 1142 if (mnt) { 1143 struct mount *m = real_mount(mnt); 1144 /* avoid cacheline pingpong, hope gcc doesn't get "smart" */ 1145 if (unlikely(m->mnt_expiry_mark)) 1146 m->mnt_expiry_mark = 0; 1147 mntput_no_expire(m); 1148 } 1149 } 1150 EXPORT_SYMBOL(mntput); 1151 1152 struct vfsmount *mntget(struct vfsmount *mnt) 1153 { 1154 if (mnt) 1155 mnt_add_count(real_mount(mnt), 1); 1156 return mnt; 1157 } 1158 EXPORT_SYMBOL(mntget); 1159 1160 /* path_is_mountpoint() - Check if path is a mount in the current 1161 * namespace. 1162 * 1163 * d_mountpoint() can only be used reliably to establish if a dentry is 1164 * not mounted in any namespace and that common case is handled inline. 1165 * d_mountpoint() isn't aware of the possibility there may be multiple 1166 * mounts using a given dentry in a different namespace. This function 1167 * checks if the passed in path is a mountpoint rather than the dentry 1168 * alone. 1169 */ 1170 bool path_is_mountpoint(const struct path *path) 1171 { 1172 unsigned seq; 1173 bool res; 1174 1175 if (!d_mountpoint(path->dentry)) 1176 return false; 1177 1178 rcu_read_lock(); 1179 do { 1180 seq = read_seqbegin(&mount_lock); 1181 res = __path_is_mountpoint(path); 1182 } while (read_seqretry(&mount_lock, seq)); 1183 rcu_read_unlock(); 1184 1185 return res; 1186 } 1187 EXPORT_SYMBOL(path_is_mountpoint); 1188 1189 struct vfsmount *mnt_clone_internal(const struct path *path) 1190 { 1191 struct mount *p; 1192 p = clone_mnt(real_mount(path->mnt), path->dentry, CL_PRIVATE); 1193 if (IS_ERR(p)) 1194 return ERR_CAST(p); 1195 p->mnt.mnt_flags |= MNT_INTERNAL; 1196 return &p->mnt; 1197 } 1198 1199 static inline void mangle(struct seq_file *m, const char *s) 1200 { 1201 seq_escape(m, s, " \t\n\\"); 1202 } 1203 1204 /* 1205 * Simple .show_options callback for filesystems which don't want to 1206 * implement more complex mount option showing. 1207 * 1208 * See also save_mount_options(). 1209 */ 1210 int generic_show_options(struct seq_file *m, struct dentry *root) 1211 { 1212 const char *options; 1213 1214 rcu_read_lock(); 1215 options = rcu_dereference(root->d_sb->s_options); 1216 1217 if (options != NULL && options[0]) { 1218 seq_putc(m, ','); 1219 mangle(m, options); 1220 } 1221 rcu_read_unlock(); 1222 1223 return 0; 1224 } 1225 EXPORT_SYMBOL(generic_show_options); 1226 1227 /* 1228 * If filesystem uses generic_show_options(), this function should be 1229 * called from the fill_super() callback. 1230 * 1231 * The .remount_fs callback usually needs to be handled in a special 1232 * way, to make sure, that previous options are not overwritten if the 1233 * remount fails. 1234 * 1235 * Also note, that if the filesystem's .remount_fs function doesn't 1236 * reset all options to their default value, but changes only newly 1237 * given options, then the displayed options will not reflect reality 1238 * any more. 1239 */ 1240 void save_mount_options(struct super_block *sb, char *options) 1241 { 1242 BUG_ON(sb->s_options); 1243 rcu_assign_pointer(sb->s_options, kstrdup(options, GFP_KERNEL)); 1244 } 1245 EXPORT_SYMBOL(save_mount_options); 1246 1247 void replace_mount_options(struct super_block *sb, char *options) 1248 { 1249 char *old = sb->s_options; 1250 rcu_assign_pointer(sb->s_options, options); 1251 if (old) { 1252 synchronize_rcu(); 1253 kfree(old); 1254 } 1255 } 1256 EXPORT_SYMBOL(replace_mount_options); 1257 1258 #ifdef CONFIG_PROC_FS 1259 /* iterator; we want it to have access to namespace_sem, thus here... */ 1260 static void *m_start(struct seq_file *m, loff_t *pos) 1261 { 1262 struct proc_mounts *p = m->private; 1263 1264 down_read(&namespace_sem); 1265 if (p->cached_event == p->ns->event) { 1266 void *v = p->cached_mount; 1267 if (*pos == p->cached_index) 1268 return v; 1269 if (*pos == p->cached_index + 1) { 1270 v = seq_list_next(v, &p->ns->list, &p->cached_index); 1271 return p->cached_mount = v; 1272 } 1273 } 1274 1275 p->cached_event = p->ns->event; 1276 p->cached_mount = seq_list_start(&p->ns->list, *pos); 1277 p->cached_index = *pos; 1278 return p->cached_mount; 1279 } 1280 1281 static void *m_next(struct seq_file *m, void *v, loff_t *pos) 1282 { 1283 struct proc_mounts *p = m->private; 1284 1285 p->cached_mount = seq_list_next(v, &p->ns->list, pos); 1286 p->cached_index = *pos; 1287 return p->cached_mount; 1288 } 1289 1290 static void m_stop(struct seq_file *m, void *v) 1291 { 1292 up_read(&namespace_sem); 1293 } 1294 1295 static int m_show(struct seq_file *m, void *v) 1296 { 1297 struct proc_mounts *p = m->private; 1298 struct mount *r = list_entry(v, struct mount, mnt_list); 1299 return p->show(m, &r->mnt); 1300 } 1301 1302 const struct seq_operations mounts_op = { 1303 .start = m_start, 1304 .next = m_next, 1305 .stop = m_stop, 1306 .show = m_show, 1307 }; 1308 #endif /* CONFIG_PROC_FS */ 1309 1310 /** 1311 * may_umount_tree - check if a mount tree is busy 1312 * @mnt: root of mount tree 1313 * 1314 * This is called to check if a tree of mounts has any 1315 * open files, pwds, chroots or sub mounts that are 1316 * busy. 1317 */ 1318 int may_umount_tree(struct vfsmount *m) 1319 { 1320 struct mount *mnt = real_mount(m); 1321 int actual_refs = 0; 1322 int minimum_refs = 0; 1323 struct mount *p; 1324 BUG_ON(!m); 1325 1326 /* write lock needed for mnt_get_count */ 1327 lock_mount_hash(); 1328 for (p = mnt; p; p = next_mnt(p, mnt)) { 1329 actual_refs += mnt_get_count(p); 1330 minimum_refs += 2; 1331 } 1332 unlock_mount_hash(); 1333 1334 if (actual_refs > minimum_refs) 1335 return 0; 1336 1337 return 1; 1338 } 1339 1340 EXPORT_SYMBOL(may_umount_tree); 1341 1342 /** 1343 * may_umount - check if a mount point is busy 1344 * @mnt: root of mount 1345 * 1346 * This is called to check if a mount point has any 1347 * open files, pwds, chroots or sub mounts. If the 1348 * mount has sub mounts this will return busy 1349 * regardless of whether the sub mounts are busy. 1350 * 1351 * Doesn't take quota and stuff into account. IOW, in some cases it will 1352 * give false negatives. The main reason why it's here is that we need 1353 * a non-destructive way to look for easily umountable filesystems. 1354 */ 1355 int may_umount(struct vfsmount *mnt) 1356 { 1357 int ret = 1; 1358 down_read(&namespace_sem); 1359 lock_mount_hash(); 1360 if (propagate_mount_busy(real_mount(mnt), 2)) 1361 ret = 0; 1362 unlock_mount_hash(); 1363 up_read(&namespace_sem); 1364 return ret; 1365 } 1366 1367 EXPORT_SYMBOL(may_umount); 1368 1369 static HLIST_HEAD(unmounted); /* protected by namespace_sem */ 1370 1371 static void namespace_unlock(void) 1372 { 1373 struct hlist_head head; 1374 1375 hlist_move_list(&unmounted, &head); 1376 1377 up_write(&namespace_sem); 1378 1379 if (likely(hlist_empty(&head))) 1380 return; 1381 1382 synchronize_rcu(); 1383 1384 group_pin_kill(&head); 1385 } 1386 1387 static inline void namespace_lock(void) 1388 { 1389 down_write(&namespace_sem); 1390 } 1391 1392 enum umount_tree_flags { 1393 UMOUNT_SYNC = 1, 1394 UMOUNT_PROPAGATE = 2, 1395 UMOUNT_CONNECTED = 4, 1396 }; 1397 1398 static bool disconnect_mount(struct mount *mnt, enum umount_tree_flags how) 1399 { 1400 /* Leaving mounts connected is only valid for lazy umounts */ 1401 if (how & UMOUNT_SYNC) 1402 return true; 1403 1404 /* A mount without a parent has nothing to be connected to */ 1405 if (!mnt_has_parent(mnt)) 1406 return true; 1407 1408 /* Because the reference counting rules change when mounts are 1409 * unmounted and connected, umounted mounts may not be 1410 * connected to mounted mounts. 1411 */ 1412 if (!(mnt->mnt_parent->mnt.mnt_flags & MNT_UMOUNT)) 1413 return true; 1414 1415 /* Has it been requested that the mount remain connected? */ 1416 if (how & UMOUNT_CONNECTED) 1417 return false; 1418 1419 /* Is the mount locked such that it needs to remain connected? */ 1420 if (IS_MNT_LOCKED(mnt)) 1421 return false; 1422 1423 /* By default disconnect the mount */ 1424 return true; 1425 } 1426 1427 /* 1428 * mount_lock must be held 1429 * namespace_sem must be held for write 1430 */ 1431 static void umount_tree(struct mount *mnt, enum umount_tree_flags how) 1432 { 1433 LIST_HEAD(tmp_list); 1434 struct mount *p; 1435 1436 if (how & UMOUNT_PROPAGATE) 1437 propagate_mount_unlock(mnt); 1438 1439 /* Gather the mounts to umount */ 1440 for (p = mnt; p; p = next_mnt(p, mnt)) { 1441 p->mnt.mnt_flags |= MNT_UMOUNT; 1442 list_move(&p->mnt_list, &tmp_list); 1443 } 1444 1445 /* Hide the mounts from mnt_mounts */ 1446 list_for_each_entry(p, &tmp_list, mnt_list) { 1447 list_del_init(&p->mnt_child); 1448 } 1449 1450 /* Add propogated mounts to the tmp_list */ 1451 if (how & UMOUNT_PROPAGATE) 1452 propagate_umount(&tmp_list); 1453 1454 while (!list_empty(&tmp_list)) { 1455 struct mnt_namespace *ns; 1456 bool disconnect; 1457 p = list_first_entry(&tmp_list, struct mount, mnt_list); 1458 list_del_init(&p->mnt_expire); 1459 list_del_init(&p->mnt_list); 1460 ns = p->mnt_ns; 1461 if (ns) { 1462 ns->mounts--; 1463 __touch_mnt_namespace(ns); 1464 } 1465 p->mnt_ns = NULL; 1466 if (how & UMOUNT_SYNC) 1467 p->mnt.mnt_flags |= MNT_SYNC_UMOUNT; 1468 1469 disconnect = disconnect_mount(p, how); 1470 1471 pin_insert_group(&p->mnt_umount, &p->mnt_parent->mnt, 1472 disconnect ? &unmounted : NULL); 1473 if (mnt_has_parent(p)) { 1474 mnt_add_count(p->mnt_parent, -1); 1475 if (!disconnect) { 1476 /* Don't forget about p */ 1477 list_add_tail(&p->mnt_child, &p->mnt_parent->mnt_mounts); 1478 } else { 1479 umount_mnt(p); 1480 } 1481 } 1482 change_mnt_propagation(p, MS_PRIVATE); 1483 } 1484 } 1485 1486 static void shrink_submounts(struct mount *mnt); 1487 1488 static int do_umount(struct mount *mnt, int flags) 1489 { 1490 struct super_block *sb = mnt->mnt.mnt_sb; 1491 int retval; 1492 1493 retval = security_sb_umount(&mnt->mnt, flags); 1494 if (retval) 1495 return retval; 1496 1497 /* 1498 * Allow userspace to request a mountpoint be expired rather than 1499 * unmounting unconditionally. Unmount only happens if: 1500 * (1) the mark is already set (the mark is cleared by mntput()) 1501 * (2) the usage count == 1 [parent vfsmount] + 1 [sys_umount] 1502 */ 1503 if (flags & MNT_EXPIRE) { 1504 if (&mnt->mnt == current->fs->root.mnt || 1505 flags & (MNT_FORCE | MNT_DETACH)) 1506 return -EINVAL; 1507 1508 /* 1509 * probably don't strictly need the lock here if we examined 1510 * all race cases, but it's a slowpath. 1511 */ 1512 lock_mount_hash(); 1513 if (mnt_get_count(mnt) != 2) { 1514 unlock_mount_hash(); 1515 return -EBUSY; 1516 } 1517 unlock_mount_hash(); 1518 1519 if (!xchg(&mnt->mnt_expiry_mark, 1)) 1520 return -EAGAIN; 1521 } 1522 1523 /* 1524 * If we may have to abort operations to get out of this 1525 * mount, and they will themselves hold resources we must 1526 * allow the fs to do things. In the Unix tradition of 1527 * 'Gee thats tricky lets do it in userspace' the umount_begin 1528 * might fail to complete on the first run through as other tasks 1529 * must return, and the like. Thats for the mount program to worry 1530 * about for the moment. 1531 */ 1532 1533 if (flags & MNT_FORCE && sb->s_op->umount_begin) { 1534 sb->s_op->umount_begin(sb); 1535 } 1536 1537 /* 1538 * No sense to grab the lock for this test, but test itself looks 1539 * somewhat bogus. Suggestions for better replacement? 1540 * Ho-hum... In principle, we might treat that as umount + switch 1541 * to rootfs. GC would eventually take care of the old vfsmount. 1542 * Actually it makes sense, especially if rootfs would contain a 1543 * /reboot - static binary that would close all descriptors and 1544 * call reboot(9). Then init(8) could umount root and exec /reboot. 1545 */ 1546 if (&mnt->mnt == current->fs->root.mnt && !(flags & MNT_DETACH)) { 1547 /* 1548 * Special case for "unmounting" root ... 1549 * we just try to remount it readonly. 1550 */ 1551 if (!capable(CAP_SYS_ADMIN)) 1552 return -EPERM; 1553 down_write(&sb->s_umount); 1554 if (!(sb->s_flags & MS_RDONLY)) 1555 retval = do_remount_sb(sb, MS_RDONLY, NULL, 0); 1556 up_write(&sb->s_umount); 1557 return retval; 1558 } 1559 1560 namespace_lock(); 1561 lock_mount_hash(); 1562 event++; 1563 1564 if (flags & MNT_DETACH) { 1565 if (!list_empty(&mnt->mnt_list)) 1566 umount_tree(mnt, UMOUNT_PROPAGATE); 1567 retval = 0; 1568 } else { 1569 shrink_submounts(mnt); 1570 retval = -EBUSY; 1571 if (!propagate_mount_busy(mnt, 2)) { 1572 if (!list_empty(&mnt->mnt_list)) 1573 umount_tree(mnt, UMOUNT_PROPAGATE|UMOUNT_SYNC); 1574 retval = 0; 1575 } 1576 } 1577 unlock_mount_hash(); 1578 namespace_unlock(); 1579 return retval; 1580 } 1581 1582 /* 1583 * __detach_mounts - lazily unmount all mounts on the specified dentry 1584 * 1585 * During unlink, rmdir, and d_drop it is possible to loose the path 1586 * to an existing mountpoint, and wind up leaking the mount. 1587 * detach_mounts allows lazily unmounting those mounts instead of 1588 * leaking them. 1589 * 1590 * The caller may hold dentry->d_inode->i_mutex. 1591 */ 1592 void __detach_mounts(struct dentry *dentry) 1593 { 1594 struct mountpoint *mp; 1595 struct mount *mnt; 1596 1597 namespace_lock(); 1598 mp = lookup_mountpoint(dentry); 1599 if (IS_ERR_OR_NULL(mp)) 1600 goto out_unlock; 1601 1602 lock_mount_hash(); 1603 event++; 1604 while (!hlist_empty(&mp->m_list)) { 1605 mnt = hlist_entry(mp->m_list.first, struct mount, mnt_mp_list); 1606 if (mnt->mnt.mnt_flags & MNT_UMOUNT) { 1607 hlist_add_head(&mnt->mnt_umount.s_list, &unmounted); 1608 umount_mnt(mnt); 1609 } 1610 else umount_tree(mnt, UMOUNT_CONNECTED); 1611 } 1612 unlock_mount_hash(); 1613 put_mountpoint(mp); 1614 out_unlock: 1615 namespace_unlock(); 1616 } 1617 1618 /* 1619 * Is the caller allowed to modify his namespace? 1620 */ 1621 static inline bool may_mount(void) 1622 { 1623 return ns_capable(current->nsproxy->mnt_ns->user_ns, CAP_SYS_ADMIN); 1624 } 1625 1626 static inline bool may_mandlock(void) 1627 { 1628 #ifndef CONFIG_MANDATORY_FILE_LOCKING 1629 return false; 1630 #endif 1631 return capable(CAP_SYS_ADMIN); 1632 } 1633 1634 /* 1635 * Now umount can handle mount points as well as block devices. 1636 * This is important for filesystems which use unnamed block devices. 1637 * 1638 * We now support a flag for forced unmount like the other 'big iron' 1639 * unixes. Our API is identical to OSF/1 to avoid making a mess of AMD 1640 */ 1641 1642 SYSCALL_DEFINE2(umount, char __user *, name, int, flags) 1643 { 1644 struct path path; 1645 struct mount *mnt; 1646 int retval; 1647 int lookup_flags = 0; 1648 1649 if (flags & ~(MNT_FORCE | MNT_DETACH | MNT_EXPIRE | UMOUNT_NOFOLLOW)) 1650 return -EINVAL; 1651 1652 if (!may_mount()) 1653 return -EPERM; 1654 1655 if (!(flags & UMOUNT_NOFOLLOW)) 1656 lookup_flags |= LOOKUP_FOLLOW; 1657 1658 retval = user_path_mountpoint_at(AT_FDCWD, name, lookup_flags, &path); 1659 if (retval) 1660 goto out; 1661 mnt = real_mount(path.mnt); 1662 retval = -EINVAL; 1663 if (path.dentry != path.mnt->mnt_root) 1664 goto dput_and_out; 1665 if (!check_mnt(mnt)) 1666 goto dput_and_out; 1667 if (mnt->mnt.mnt_flags & MNT_LOCKED) 1668 goto dput_and_out; 1669 retval = -EPERM; 1670 if (flags & MNT_FORCE && !capable(CAP_SYS_ADMIN)) 1671 goto dput_and_out; 1672 1673 retval = do_umount(mnt, flags); 1674 dput_and_out: 1675 /* we mustn't call path_put() as that would clear mnt_expiry_mark */ 1676 dput(path.dentry); 1677 mntput_no_expire(mnt); 1678 out: 1679 return retval; 1680 } 1681 1682 #ifdef __ARCH_WANT_SYS_OLDUMOUNT 1683 1684 /* 1685 * The 2.0 compatible umount. No flags. 1686 */ 1687 SYSCALL_DEFINE1(oldumount, char __user *, name) 1688 { 1689 return sys_umount(name, 0); 1690 } 1691 1692 #endif 1693 1694 static bool is_mnt_ns_file(struct dentry *dentry) 1695 { 1696 /* Is this a proxy for a mount namespace? */ 1697 return dentry->d_op == &ns_dentry_operations && 1698 dentry->d_fsdata == &mntns_operations; 1699 } 1700 1701 struct mnt_namespace *to_mnt_ns(struct ns_common *ns) 1702 { 1703 return container_of(ns, struct mnt_namespace, ns); 1704 } 1705 1706 static bool mnt_ns_loop(struct dentry *dentry) 1707 { 1708 /* Could bind mounting the mount namespace inode cause a 1709 * mount namespace loop? 1710 */ 1711 struct mnt_namespace *mnt_ns; 1712 if (!is_mnt_ns_file(dentry)) 1713 return false; 1714 1715 mnt_ns = to_mnt_ns(get_proc_ns(dentry->d_inode)); 1716 return current->nsproxy->mnt_ns->seq >= mnt_ns->seq; 1717 } 1718 1719 struct mount *copy_tree(struct mount *mnt, struct dentry *dentry, 1720 int flag) 1721 { 1722 struct mount *res, *p, *q, *r, *parent; 1723 1724 if (!(flag & CL_COPY_UNBINDABLE) && IS_MNT_UNBINDABLE(mnt)) 1725 return ERR_PTR(-EINVAL); 1726 1727 if (!(flag & CL_COPY_MNT_NS_FILE) && is_mnt_ns_file(dentry)) 1728 return ERR_PTR(-EINVAL); 1729 1730 res = q = clone_mnt(mnt, dentry, flag); 1731 if (IS_ERR(q)) 1732 return q; 1733 1734 q->mnt_mountpoint = mnt->mnt_mountpoint; 1735 1736 p = mnt; 1737 list_for_each_entry(r, &mnt->mnt_mounts, mnt_child) { 1738 struct mount *s; 1739 if (!is_subdir(r->mnt_mountpoint, dentry)) 1740 continue; 1741 1742 for (s = r; s; s = next_mnt(s, r)) { 1743 struct mount *t = NULL; 1744 if (!(flag & CL_COPY_UNBINDABLE) && 1745 IS_MNT_UNBINDABLE(s)) { 1746 s = skip_mnt_tree(s); 1747 continue; 1748 } 1749 if (!(flag & CL_COPY_MNT_NS_FILE) && 1750 is_mnt_ns_file(s->mnt.mnt_root)) { 1751 s = skip_mnt_tree(s); 1752 continue; 1753 } 1754 while (p != s->mnt_parent) { 1755 p = p->mnt_parent; 1756 q = q->mnt_parent; 1757 } 1758 p = s; 1759 parent = q; 1760 q = clone_mnt(p, p->mnt.mnt_root, flag); 1761 if (IS_ERR(q)) 1762 goto out; 1763 lock_mount_hash(); 1764 list_add_tail(&q->mnt_list, &res->mnt_list); 1765 mnt_set_mountpoint(parent, p->mnt_mp, q); 1766 if (!list_empty(&parent->mnt_mounts)) { 1767 t = list_last_entry(&parent->mnt_mounts, 1768 struct mount, mnt_child); 1769 if (t->mnt_mp != p->mnt_mp) 1770 t = NULL; 1771 } 1772 attach_shadowed(q, parent, t); 1773 unlock_mount_hash(); 1774 } 1775 } 1776 return res; 1777 out: 1778 if (res) { 1779 lock_mount_hash(); 1780 umount_tree(res, UMOUNT_SYNC); 1781 unlock_mount_hash(); 1782 } 1783 return q; 1784 } 1785 1786 /* Caller should check returned pointer for errors */ 1787 1788 struct vfsmount *collect_mounts(const struct path *path) 1789 { 1790 struct mount *tree; 1791 namespace_lock(); 1792 if (!check_mnt(real_mount(path->mnt))) 1793 tree = ERR_PTR(-EINVAL); 1794 else 1795 tree = copy_tree(real_mount(path->mnt), path->dentry, 1796 CL_COPY_ALL | CL_PRIVATE); 1797 namespace_unlock(); 1798 if (IS_ERR(tree)) 1799 return ERR_CAST(tree); 1800 return &tree->mnt; 1801 } 1802 1803 void drop_collected_mounts(struct vfsmount *mnt) 1804 { 1805 namespace_lock(); 1806 lock_mount_hash(); 1807 umount_tree(real_mount(mnt), UMOUNT_SYNC); 1808 unlock_mount_hash(); 1809 namespace_unlock(); 1810 } 1811 1812 /** 1813 * clone_private_mount - create a private clone of a path 1814 * 1815 * This creates a new vfsmount, which will be the clone of @path. The new will 1816 * not be attached anywhere in the namespace and will be private (i.e. changes 1817 * to the originating mount won't be propagated into this). 1818 * 1819 * Release with mntput(). 1820 */ 1821 struct vfsmount *clone_private_mount(const struct path *path) 1822 { 1823 struct mount *old_mnt = real_mount(path->mnt); 1824 struct mount *new_mnt; 1825 1826 if (IS_MNT_UNBINDABLE(old_mnt)) 1827 return ERR_PTR(-EINVAL); 1828 1829 new_mnt = clone_mnt(old_mnt, path->dentry, CL_PRIVATE); 1830 if (IS_ERR(new_mnt)) 1831 return ERR_CAST(new_mnt); 1832 1833 return &new_mnt->mnt; 1834 } 1835 EXPORT_SYMBOL_GPL(clone_private_mount); 1836 1837 int iterate_mounts(int (*f)(struct vfsmount *, void *), void *arg, 1838 struct vfsmount *root) 1839 { 1840 struct mount *mnt; 1841 int res = f(root, arg); 1842 if (res) 1843 return res; 1844 list_for_each_entry(mnt, &real_mount(root)->mnt_list, mnt_list) { 1845 res = f(&mnt->mnt, arg); 1846 if (res) 1847 return res; 1848 } 1849 return 0; 1850 } 1851 1852 static void cleanup_group_ids(struct mount *mnt, struct mount *end) 1853 { 1854 struct mount *p; 1855 1856 for (p = mnt; p != end; p = next_mnt(p, mnt)) { 1857 if (p->mnt_group_id && !IS_MNT_SHARED(p)) 1858 mnt_release_group_id(p); 1859 } 1860 } 1861 1862 static int invent_group_ids(struct mount *mnt, bool recurse) 1863 { 1864 struct mount *p; 1865 1866 for (p = mnt; p; p = recurse ? next_mnt(p, mnt) : NULL) { 1867 if (!p->mnt_group_id && !IS_MNT_SHARED(p)) { 1868 int err = mnt_alloc_group_id(p); 1869 if (err) { 1870 cleanup_group_ids(mnt, p); 1871 return err; 1872 } 1873 } 1874 } 1875 1876 return 0; 1877 } 1878 1879 int count_mounts(struct mnt_namespace *ns, struct mount *mnt) 1880 { 1881 unsigned int max = READ_ONCE(sysctl_mount_max); 1882 unsigned int mounts = 0, old, pending, sum; 1883 struct mount *p; 1884 1885 for (p = mnt; p; p = next_mnt(p, mnt)) 1886 mounts++; 1887 1888 old = ns->mounts; 1889 pending = ns->pending_mounts; 1890 sum = old + pending; 1891 if ((old > sum) || 1892 (pending > sum) || 1893 (max < sum) || 1894 (mounts > (max - sum))) 1895 return -ENOSPC; 1896 1897 ns->pending_mounts = pending + mounts; 1898 return 0; 1899 } 1900 1901 /* 1902 * @source_mnt : mount tree to be attached 1903 * @nd : place the mount tree @source_mnt is attached 1904 * @parent_nd : if non-null, detach the source_mnt from its parent and 1905 * store the parent mount and mountpoint dentry. 1906 * (done when source_mnt is moved) 1907 * 1908 * NOTE: in the table below explains the semantics when a source mount 1909 * of a given type is attached to a destination mount of a given type. 1910 * --------------------------------------------------------------------------- 1911 * | BIND MOUNT OPERATION | 1912 * |************************************************************************** 1913 * | source-->| shared | private | slave | unbindable | 1914 * | dest | | | | | 1915 * | | | | | | | 1916 * | v | | | | | 1917 * |************************************************************************** 1918 * | shared | shared (++) | shared (+) | shared(+++)| invalid | 1919 * | | | | | | 1920 * |non-shared| shared (+) | private | slave (*) | invalid | 1921 * *************************************************************************** 1922 * A bind operation clones the source mount and mounts the clone on the 1923 * destination mount. 1924 * 1925 * (++) the cloned mount is propagated to all the mounts in the propagation 1926 * tree of the destination mount and the cloned mount is added to 1927 * the peer group of the source mount. 1928 * (+) the cloned mount is created under the destination mount and is marked 1929 * as shared. The cloned mount is added to the peer group of the source 1930 * mount. 1931 * (+++) the mount is propagated to all the mounts in the propagation tree 1932 * of the destination mount and the cloned mount is made slave 1933 * of the same master as that of the source mount. The cloned mount 1934 * is marked as 'shared and slave'. 1935 * (*) the cloned mount is made a slave of the same master as that of the 1936 * source mount. 1937 * 1938 * --------------------------------------------------------------------------- 1939 * | MOVE MOUNT OPERATION | 1940 * |************************************************************************** 1941 * | source-->| shared | private | slave | unbindable | 1942 * | dest | | | | | 1943 * | | | | | | | 1944 * | v | | | | | 1945 * |************************************************************************** 1946 * | shared | shared (+) | shared (+) | shared(+++) | invalid | 1947 * | | | | | | 1948 * |non-shared| shared (+*) | private | slave (*) | unbindable | 1949 * *************************************************************************** 1950 * 1951 * (+) the mount is moved to the destination. And is then propagated to 1952 * all the mounts in the propagation tree of the destination mount. 1953 * (+*) the mount is moved to the destination. 1954 * (+++) the mount is moved to the destination and is then propagated to 1955 * all the mounts belonging to the destination mount's propagation tree. 1956 * the mount is marked as 'shared and slave'. 1957 * (*) the mount continues to be a slave at the new location. 1958 * 1959 * if the source mount is a tree, the operations explained above is 1960 * applied to each mount in the tree. 1961 * Must be called without spinlocks held, since this function can sleep 1962 * in allocations. 1963 */ 1964 static int attach_recursive_mnt(struct mount *source_mnt, 1965 struct mount *dest_mnt, 1966 struct mountpoint *dest_mp, 1967 struct path *parent_path) 1968 { 1969 HLIST_HEAD(tree_list); 1970 struct mnt_namespace *ns = dest_mnt->mnt_ns; 1971 struct mount *child, *p; 1972 struct hlist_node *n; 1973 int err; 1974 1975 /* Is there space to add these mounts to the mount namespace? */ 1976 if (!parent_path) { 1977 err = count_mounts(ns, source_mnt); 1978 if (err) 1979 goto out; 1980 } 1981 1982 if (IS_MNT_SHARED(dest_mnt)) { 1983 err = invent_group_ids(source_mnt, true); 1984 if (err) 1985 goto out; 1986 err = propagate_mnt(dest_mnt, dest_mp, source_mnt, &tree_list); 1987 lock_mount_hash(); 1988 if (err) 1989 goto out_cleanup_ids; 1990 for (p = source_mnt; p; p = next_mnt(p, source_mnt)) 1991 set_mnt_shared(p); 1992 } else { 1993 lock_mount_hash(); 1994 } 1995 if (parent_path) { 1996 detach_mnt(source_mnt, parent_path); 1997 attach_mnt(source_mnt, dest_mnt, dest_mp); 1998 touch_mnt_namespace(source_mnt->mnt_ns); 1999 } else { 2000 mnt_set_mountpoint(dest_mnt, dest_mp, source_mnt); 2001 commit_tree(source_mnt, NULL); 2002 } 2003 2004 hlist_for_each_entry_safe(child, n, &tree_list, mnt_hash) { 2005 struct mount *q; 2006 hlist_del_init(&child->mnt_hash); 2007 q = __lookup_mnt_last(&child->mnt_parent->mnt, 2008 child->mnt_mountpoint); 2009 commit_tree(child, q); 2010 } 2011 unlock_mount_hash(); 2012 2013 return 0; 2014 2015 out_cleanup_ids: 2016 while (!hlist_empty(&tree_list)) { 2017 child = hlist_entry(tree_list.first, struct mount, mnt_hash); 2018 child->mnt_parent->mnt_ns->pending_mounts = 0; 2019 umount_tree(child, UMOUNT_SYNC); 2020 } 2021 unlock_mount_hash(); 2022 cleanup_group_ids(source_mnt, NULL); 2023 out: 2024 ns->pending_mounts = 0; 2025 return err; 2026 } 2027 2028 static struct mountpoint *lock_mount(struct path *path) 2029 { 2030 struct vfsmount *mnt; 2031 struct dentry *dentry = path->dentry; 2032 retry: 2033 inode_lock(dentry->d_inode); 2034 if (unlikely(cant_mount(dentry))) { 2035 inode_unlock(dentry->d_inode); 2036 return ERR_PTR(-ENOENT); 2037 } 2038 namespace_lock(); 2039 mnt = lookup_mnt(path); 2040 if (likely(!mnt)) { 2041 struct mountpoint *mp = lookup_mountpoint(dentry); 2042 if (!mp) 2043 mp = new_mountpoint(dentry); 2044 if (IS_ERR(mp)) { 2045 namespace_unlock(); 2046 inode_unlock(dentry->d_inode); 2047 return mp; 2048 } 2049 return mp; 2050 } 2051 namespace_unlock(); 2052 inode_unlock(path->dentry->d_inode); 2053 path_put(path); 2054 path->mnt = mnt; 2055 dentry = path->dentry = dget(mnt->mnt_root); 2056 goto retry; 2057 } 2058 2059 static void unlock_mount(struct mountpoint *where) 2060 { 2061 struct dentry *dentry = where->m_dentry; 2062 put_mountpoint(where); 2063 namespace_unlock(); 2064 inode_unlock(dentry->d_inode); 2065 } 2066 2067 static int graft_tree(struct mount *mnt, struct mount *p, struct mountpoint *mp) 2068 { 2069 if (mnt->mnt.mnt_sb->s_flags & MS_NOUSER) 2070 return -EINVAL; 2071 2072 if (d_is_dir(mp->m_dentry) != 2073 d_is_dir(mnt->mnt.mnt_root)) 2074 return -ENOTDIR; 2075 2076 return attach_recursive_mnt(mnt, p, mp, NULL); 2077 } 2078 2079 /* 2080 * Sanity check the flags to change_mnt_propagation. 2081 */ 2082 2083 static int flags_to_propagation_type(int flags) 2084 { 2085 int type = flags & ~(MS_REC | MS_SILENT); 2086 2087 /* Fail if any non-propagation flags are set */ 2088 if (type & ~(MS_SHARED | MS_PRIVATE | MS_SLAVE | MS_UNBINDABLE)) 2089 return 0; 2090 /* Only one propagation flag should be set */ 2091 if (!is_power_of_2(type)) 2092 return 0; 2093 return type; 2094 } 2095 2096 /* 2097 * recursively change the type of the mountpoint. 2098 */ 2099 static int do_change_type(struct path *path, int flag) 2100 { 2101 struct mount *m; 2102 struct mount *mnt = real_mount(path->mnt); 2103 int recurse = flag & MS_REC; 2104 int type; 2105 int err = 0; 2106 2107 if (path->dentry != path->mnt->mnt_root) 2108 return -EINVAL; 2109 2110 type = flags_to_propagation_type(flag); 2111 if (!type) 2112 return -EINVAL; 2113 2114 namespace_lock(); 2115 if (type == MS_SHARED) { 2116 err = invent_group_ids(mnt, recurse); 2117 if (err) 2118 goto out_unlock; 2119 } 2120 2121 lock_mount_hash(); 2122 for (m = mnt; m; m = (recurse ? next_mnt(m, mnt) : NULL)) 2123 change_mnt_propagation(m, type); 2124 unlock_mount_hash(); 2125 2126 out_unlock: 2127 namespace_unlock(); 2128 return err; 2129 } 2130 2131 static bool has_locked_children(struct mount *mnt, struct dentry *dentry) 2132 { 2133 struct mount *child; 2134 list_for_each_entry(child, &mnt->mnt_mounts, mnt_child) { 2135 if (!is_subdir(child->mnt_mountpoint, dentry)) 2136 continue; 2137 2138 if (child->mnt.mnt_flags & MNT_LOCKED) 2139 return true; 2140 } 2141 return false; 2142 } 2143 2144 /* 2145 * do loopback mount. 2146 */ 2147 static int do_loopback(struct path *path, const char *old_name, 2148 int recurse) 2149 { 2150 struct path old_path; 2151 struct mount *mnt = NULL, *old, *parent; 2152 struct mountpoint *mp; 2153 int err; 2154 if (!old_name || !*old_name) 2155 return -EINVAL; 2156 err = kern_path(old_name, LOOKUP_FOLLOW|LOOKUP_AUTOMOUNT, &old_path); 2157 if (err) 2158 return err; 2159 2160 err = -EINVAL; 2161 if (mnt_ns_loop(old_path.dentry)) 2162 goto out; 2163 2164 mp = lock_mount(path); 2165 err = PTR_ERR(mp); 2166 if (IS_ERR(mp)) 2167 goto out; 2168 2169 old = real_mount(old_path.mnt); 2170 parent = real_mount(path->mnt); 2171 2172 err = -EINVAL; 2173 if (IS_MNT_UNBINDABLE(old)) 2174 goto out2; 2175 2176 if (!check_mnt(parent)) 2177 goto out2; 2178 2179 if (!check_mnt(old) && old_path.dentry->d_op != &ns_dentry_operations) 2180 goto out2; 2181 2182 if (!recurse && has_locked_children(old, old_path.dentry)) 2183 goto out2; 2184 2185 if (recurse) 2186 mnt = copy_tree(old, old_path.dentry, CL_COPY_MNT_NS_FILE); 2187 else 2188 mnt = clone_mnt(old, old_path.dentry, 0); 2189 2190 if (IS_ERR(mnt)) { 2191 err = PTR_ERR(mnt); 2192 goto out2; 2193 } 2194 2195 mnt->mnt.mnt_flags &= ~MNT_LOCKED; 2196 2197 err = graft_tree(mnt, parent, mp); 2198 if (err) { 2199 lock_mount_hash(); 2200 umount_tree(mnt, UMOUNT_SYNC); 2201 unlock_mount_hash(); 2202 } 2203 out2: 2204 unlock_mount(mp); 2205 out: 2206 path_put(&old_path); 2207 return err; 2208 } 2209 2210 static int change_mount_flags(struct vfsmount *mnt, int ms_flags) 2211 { 2212 int error = 0; 2213 int readonly_request = 0; 2214 2215 if (ms_flags & MS_RDONLY) 2216 readonly_request = 1; 2217 if (readonly_request == __mnt_is_readonly(mnt)) 2218 return 0; 2219 2220 if (readonly_request) 2221 error = mnt_make_readonly(real_mount(mnt)); 2222 else 2223 __mnt_unmake_readonly(real_mount(mnt)); 2224 return error; 2225 } 2226 2227 /* 2228 * change filesystem flags. dir should be a physical root of filesystem. 2229 * If you've mounted a non-root directory somewhere and want to do remount 2230 * on it - tough luck. 2231 */ 2232 static int do_remount(struct path *path, int flags, int mnt_flags, 2233 void *data) 2234 { 2235 int err; 2236 struct super_block *sb = path->mnt->mnt_sb; 2237 struct mount *mnt = real_mount(path->mnt); 2238 2239 if (!check_mnt(mnt)) 2240 return -EINVAL; 2241 2242 if (path->dentry != path->mnt->mnt_root) 2243 return -EINVAL; 2244 2245 /* Don't allow changing of locked mnt flags. 2246 * 2247 * No locks need to be held here while testing the various 2248 * MNT_LOCK flags because those flags can never be cleared 2249 * once they are set. 2250 */ 2251 if ((mnt->mnt.mnt_flags & MNT_LOCK_READONLY) && 2252 !(mnt_flags & MNT_READONLY)) { 2253 return -EPERM; 2254 } 2255 if ((mnt->mnt.mnt_flags & MNT_LOCK_NODEV) && 2256 !(mnt_flags & MNT_NODEV)) { 2257 return -EPERM; 2258 } 2259 if ((mnt->mnt.mnt_flags & MNT_LOCK_NOSUID) && 2260 !(mnt_flags & MNT_NOSUID)) { 2261 return -EPERM; 2262 } 2263 if ((mnt->mnt.mnt_flags & MNT_LOCK_NOEXEC) && 2264 !(mnt_flags & MNT_NOEXEC)) { 2265 return -EPERM; 2266 } 2267 if ((mnt->mnt.mnt_flags & MNT_LOCK_ATIME) && 2268 ((mnt->mnt.mnt_flags & MNT_ATIME_MASK) != (mnt_flags & MNT_ATIME_MASK))) { 2269 return -EPERM; 2270 } 2271 2272 err = security_sb_remount(sb, data); 2273 if (err) 2274 return err; 2275 2276 down_write(&sb->s_umount); 2277 if (flags & MS_BIND) 2278 err = change_mount_flags(path->mnt, flags); 2279 else if (!capable(CAP_SYS_ADMIN)) 2280 err = -EPERM; 2281 else 2282 err = do_remount_sb(sb, flags, data, 0); 2283 if (!err) { 2284 lock_mount_hash(); 2285 mnt_flags |= mnt->mnt.mnt_flags & ~MNT_USER_SETTABLE_MASK; 2286 mnt->mnt.mnt_flags = mnt_flags; 2287 touch_mnt_namespace(mnt->mnt_ns); 2288 unlock_mount_hash(); 2289 } 2290 up_write(&sb->s_umount); 2291 return err; 2292 } 2293 2294 static inline int tree_contains_unbindable(struct mount *mnt) 2295 { 2296 struct mount *p; 2297 for (p = mnt; p; p = next_mnt(p, mnt)) { 2298 if (IS_MNT_UNBINDABLE(p)) 2299 return 1; 2300 } 2301 return 0; 2302 } 2303 2304 static int do_move_mount(struct path *path, const char *old_name) 2305 { 2306 struct path old_path, parent_path; 2307 struct mount *p; 2308 struct mount *old; 2309 struct mountpoint *mp; 2310 int err; 2311 if (!old_name || !*old_name) 2312 return -EINVAL; 2313 err = kern_path(old_name, LOOKUP_FOLLOW, &old_path); 2314 if (err) 2315 return err; 2316 2317 mp = lock_mount(path); 2318 err = PTR_ERR(mp); 2319 if (IS_ERR(mp)) 2320 goto out; 2321 2322 old = real_mount(old_path.mnt); 2323 p = real_mount(path->mnt); 2324 2325 err = -EINVAL; 2326 if (!check_mnt(p) || !check_mnt(old)) 2327 goto out1; 2328 2329 if (old->mnt.mnt_flags & MNT_LOCKED) 2330 goto out1; 2331 2332 err = -EINVAL; 2333 if (old_path.dentry != old_path.mnt->mnt_root) 2334 goto out1; 2335 2336 if (!mnt_has_parent(old)) 2337 goto out1; 2338 2339 if (d_is_dir(path->dentry) != 2340 d_is_dir(old_path.dentry)) 2341 goto out1; 2342 /* 2343 * Don't move a mount residing in a shared parent. 2344 */ 2345 if (IS_MNT_SHARED(old->mnt_parent)) 2346 goto out1; 2347 /* 2348 * Don't move a mount tree containing unbindable mounts to a destination 2349 * mount which is shared. 2350 */ 2351 if (IS_MNT_SHARED(p) && tree_contains_unbindable(old)) 2352 goto out1; 2353 err = -ELOOP; 2354 for (; mnt_has_parent(p); p = p->mnt_parent) 2355 if (p == old) 2356 goto out1; 2357 2358 err = attach_recursive_mnt(old, real_mount(path->mnt), mp, &parent_path); 2359 if (err) 2360 goto out1; 2361 2362 /* if the mount is moved, it should no longer be expire 2363 * automatically */ 2364 list_del_init(&old->mnt_expire); 2365 out1: 2366 unlock_mount(mp); 2367 out: 2368 if (!err) 2369 path_put(&parent_path); 2370 path_put(&old_path); 2371 return err; 2372 } 2373 2374 static struct vfsmount *fs_set_subtype(struct vfsmount *mnt, const char *fstype) 2375 { 2376 int err; 2377 const char *subtype = strchr(fstype, '.'); 2378 if (subtype) { 2379 subtype++; 2380 err = -EINVAL; 2381 if (!subtype[0]) 2382 goto err; 2383 } else 2384 subtype = ""; 2385 2386 mnt->mnt_sb->s_subtype = kstrdup(subtype, GFP_KERNEL); 2387 err = -ENOMEM; 2388 if (!mnt->mnt_sb->s_subtype) 2389 goto err; 2390 return mnt; 2391 2392 err: 2393 mntput(mnt); 2394 return ERR_PTR(err); 2395 } 2396 2397 /* 2398 * add a mount into a namespace's mount tree 2399 */ 2400 static int do_add_mount(struct mount *newmnt, struct path *path, int mnt_flags) 2401 { 2402 struct mountpoint *mp; 2403 struct mount *parent; 2404 int err; 2405 2406 mnt_flags &= ~MNT_INTERNAL_FLAGS; 2407 2408 mp = lock_mount(path); 2409 if (IS_ERR(mp)) 2410 return PTR_ERR(mp); 2411 2412 parent = real_mount(path->mnt); 2413 err = -EINVAL; 2414 if (unlikely(!check_mnt(parent))) { 2415 /* that's acceptable only for automounts done in private ns */ 2416 if (!(mnt_flags & MNT_SHRINKABLE)) 2417 goto unlock; 2418 /* ... and for those we'd better have mountpoint still alive */ 2419 if (!parent->mnt_ns) 2420 goto unlock; 2421 } 2422 2423 /* Refuse the same filesystem on the same mount point */ 2424 err = -EBUSY; 2425 if (path->mnt->mnt_sb == newmnt->mnt.mnt_sb && 2426 path->mnt->mnt_root == path->dentry) 2427 goto unlock; 2428 2429 err = -EINVAL; 2430 if (d_is_symlink(newmnt->mnt.mnt_root)) 2431 goto unlock; 2432 2433 newmnt->mnt.mnt_flags = mnt_flags; 2434 err = graft_tree(newmnt, parent, mp); 2435 2436 unlock: 2437 unlock_mount(mp); 2438 return err; 2439 } 2440 2441 static bool mount_too_revealing(struct vfsmount *mnt, int *new_mnt_flags); 2442 2443 /* 2444 * create a new mount for userspace and request it to be added into the 2445 * namespace's tree 2446 */ 2447 static int do_new_mount(struct path *path, const char *fstype, int flags, 2448 int mnt_flags, const char *name, void *data) 2449 { 2450 struct file_system_type *type; 2451 struct vfsmount *mnt; 2452 int err; 2453 2454 if (!fstype) 2455 return -EINVAL; 2456 2457 type = get_fs_type(fstype); 2458 if (!type) 2459 return -ENODEV; 2460 2461 mnt = vfs_kern_mount(type, flags, name, data); 2462 if (!IS_ERR(mnt) && (type->fs_flags & FS_HAS_SUBTYPE) && 2463 !mnt->mnt_sb->s_subtype) 2464 mnt = fs_set_subtype(mnt, fstype); 2465 2466 put_filesystem(type); 2467 if (IS_ERR(mnt)) 2468 return PTR_ERR(mnt); 2469 2470 if (mount_too_revealing(mnt, &mnt_flags)) { 2471 mntput(mnt); 2472 return -EPERM; 2473 } 2474 2475 err = do_add_mount(real_mount(mnt), path, mnt_flags); 2476 if (err) 2477 mntput(mnt); 2478 return err; 2479 } 2480 2481 int finish_automount(struct vfsmount *m, struct path *path) 2482 { 2483 struct mount *mnt = real_mount(m); 2484 int err; 2485 /* The new mount record should have at least 2 refs to prevent it being 2486 * expired before we get a chance to add it 2487 */ 2488 BUG_ON(mnt_get_count(mnt) < 2); 2489 2490 if (m->mnt_sb == path->mnt->mnt_sb && 2491 m->mnt_root == path->dentry) { 2492 err = -ELOOP; 2493 goto fail; 2494 } 2495 2496 err = do_add_mount(mnt, path, path->mnt->mnt_flags | MNT_SHRINKABLE); 2497 if (!err) 2498 return 0; 2499 fail: 2500 /* remove m from any expiration list it may be on */ 2501 if (!list_empty(&mnt->mnt_expire)) { 2502 namespace_lock(); 2503 list_del_init(&mnt->mnt_expire); 2504 namespace_unlock(); 2505 } 2506 mntput(m); 2507 mntput(m); 2508 return err; 2509 } 2510 2511 /** 2512 * mnt_set_expiry - Put a mount on an expiration list 2513 * @mnt: The mount to list. 2514 * @expiry_list: The list to add the mount to. 2515 */ 2516 void mnt_set_expiry(struct vfsmount *mnt, struct list_head *expiry_list) 2517 { 2518 namespace_lock(); 2519 2520 list_add_tail(&real_mount(mnt)->mnt_expire, expiry_list); 2521 2522 namespace_unlock(); 2523 } 2524 EXPORT_SYMBOL(mnt_set_expiry); 2525 2526 /* 2527 * process a list of expirable mountpoints with the intent of discarding any 2528 * mountpoints that aren't in use and haven't been touched since last we came 2529 * here 2530 */ 2531 void mark_mounts_for_expiry(struct list_head *mounts) 2532 { 2533 struct mount *mnt, *next; 2534 LIST_HEAD(graveyard); 2535 2536 if (list_empty(mounts)) 2537 return; 2538 2539 namespace_lock(); 2540 lock_mount_hash(); 2541 2542 /* extract from the expiration list every vfsmount that matches the 2543 * following criteria: 2544 * - only referenced by its parent vfsmount 2545 * - still marked for expiry (marked on the last call here; marks are 2546 * cleared by mntput()) 2547 */ 2548 list_for_each_entry_safe(mnt, next, mounts, mnt_expire) { 2549 if (!xchg(&mnt->mnt_expiry_mark, 1) || 2550 propagate_mount_busy(mnt, 1)) 2551 continue; 2552 list_move(&mnt->mnt_expire, &graveyard); 2553 } 2554 while (!list_empty(&graveyard)) { 2555 mnt = list_first_entry(&graveyard, struct mount, mnt_expire); 2556 touch_mnt_namespace(mnt->mnt_ns); 2557 umount_tree(mnt, UMOUNT_PROPAGATE|UMOUNT_SYNC); 2558 } 2559 unlock_mount_hash(); 2560 namespace_unlock(); 2561 } 2562 2563 EXPORT_SYMBOL_GPL(mark_mounts_for_expiry); 2564 2565 /* 2566 * Ripoff of 'select_parent()' 2567 * 2568 * search the list of submounts for a given mountpoint, and move any 2569 * shrinkable submounts to the 'graveyard' list. 2570 */ 2571 static int select_submounts(struct mount *parent, struct list_head *graveyard) 2572 { 2573 struct mount *this_parent = parent; 2574 struct list_head *next; 2575 int found = 0; 2576 2577 repeat: 2578 next = this_parent->mnt_mounts.next; 2579 resume: 2580 while (next != &this_parent->mnt_mounts) { 2581 struct list_head *tmp = next; 2582 struct mount *mnt = list_entry(tmp, struct mount, mnt_child); 2583 2584 next = tmp->next; 2585 if (!(mnt->mnt.mnt_flags & MNT_SHRINKABLE)) 2586 continue; 2587 /* 2588 * Descend a level if the d_mounts list is non-empty. 2589 */ 2590 if (!list_empty(&mnt->mnt_mounts)) { 2591 this_parent = mnt; 2592 goto repeat; 2593 } 2594 2595 if (!propagate_mount_busy(mnt, 1)) { 2596 list_move_tail(&mnt->mnt_expire, graveyard); 2597 found++; 2598 } 2599 } 2600 /* 2601 * All done at this level ... ascend and resume the search 2602 */ 2603 if (this_parent != parent) { 2604 next = this_parent->mnt_child.next; 2605 this_parent = this_parent->mnt_parent; 2606 goto resume; 2607 } 2608 return found; 2609 } 2610 2611 /* 2612 * process a list of expirable mountpoints with the intent of discarding any 2613 * submounts of a specific parent mountpoint 2614 * 2615 * mount_lock must be held for write 2616 */ 2617 static void shrink_submounts(struct mount *mnt) 2618 { 2619 LIST_HEAD(graveyard); 2620 struct mount *m; 2621 2622 /* extract submounts of 'mountpoint' from the expiration list */ 2623 while (select_submounts(mnt, &graveyard)) { 2624 while (!list_empty(&graveyard)) { 2625 m = list_first_entry(&graveyard, struct mount, 2626 mnt_expire); 2627 touch_mnt_namespace(m->mnt_ns); 2628 umount_tree(m, UMOUNT_PROPAGATE|UMOUNT_SYNC); 2629 } 2630 } 2631 } 2632 2633 /* 2634 * Some copy_from_user() implementations do not return the exact number of 2635 * bytes remaining to copy on a fault. But copy_mount_options() requires that. 2636 * Note that this function differs from copy_from_user() in that it will oops 2637 * on bad values of `to', rather than returning a short copy. 2638 */ 2639 static long exact_copy_from_user(void *to, const void __user * from, 2640 unsigned long n) 2641 { 2642 char *t = to; 2643 const char __user *f = from; 2644 char c; 2645 2646 if (!access_ok(VERIFY_READ, from, n)) 2647 return n; 2648 2649 while (n) { 2650 if (__get_user(c, f)) { 2651 memset(t, 0, n); 2652 break; 2653 } 2654 *t++ = c; 2655 f++; 2656 n--; 2657 } 2658 return n; 2659 } 2660 2661 void *copy_mount_options(const void __user * data) 2662 { 2663 int i; 2664 unsigned long size; 2665 char *copy; 2666 2667 if (!data) 2668 return NULL; 2669 2670 copy = kmalloc(PAGE_SIZE, GFP_KERNEL); 2671 if (!copy) 2672 return ERR_PTR(-ENOMEM); 2673 2674 /* We only care that *some* data at the address the user 2675 * gave us is valid. Just in case, we'll zero 2676 * the remainder of the page. 2677 */ 2678 /* copy_from_user cannot cross TASK_SIZE ! */ 2679 size = TASK_SIZE - (unsigned long)data; 2680 if (size > PAGE_SIZE) 2681 size = PAGE_SIZE; 2682 2683 i = size - exact_copy_from_user(copy, data, size); 2684 if (!i) { 2685 kfree(copy); 2686 return ERR_PTR(-EFAULT); 2687 } 2688 if (i != PAGE_SIZE) 2689 memset(copy + i, 0, PAGE_SIZE - i); 2690 return copy; 2691 } 2692 2693 char *copy_mount_string(const void __user *data) 2694 { 2695 return data ? strndup_user(data, PAGE_SIZE) : NULL; 2696 } 2697 2698 /* 2699 * Flags is a 32-bit value that allows up to 31 non-fs dependent flags to 2700 * be given to the mount() call (ie: read-only, no-dev, no-suid etc). 2701 * 2702 * data is a (void *) that can point to any structure up to 2703 * PAGE_SIZE-1 bytes, which can contain arbitrary fs-dependent 2704 * information (or be NULL). 2705 * 2706 * Pre-0.97 versions of mount() didn't have a flags word. 2707 * When the flags word was introduced its top half was required 2708 * to have the magic value 0xC0ED, and this remained so until 2.4.0-test9. 2709 * Therefore, if this magic number is present, it carries no information 2710 * and must be discarded. 2711 */ 2712 long do_mount(const char *dev_name, const char __user *dir_name, 2713 const char *type_page, unsigned long flags, void *data_page) 2714 { 2715 struct path path; 2716 int retval = 0; 2717 int mnt_flags = 0; 2718 2719 /* Discard magic */ 2720 if ((flags & MS_MGC_MSK) == MS_MGC_VAL) 2721 flags &= ~MS_MGC_MSK; 2722 2723 /* Basic sanity checks */ 2724 if (data_page) 2725 ((char *)data_page)[PAGE_SIZE - 1] = 0; 2726 2727 /* ... and get the mountpoint */ 2728 retval = user_path(dir_name, &path); 2729 if (retval) 2730 return retval; 2731 2732 retval = security_sb_mount(dev_name, &path, 2733 type_page, flags, data_page); 2734 if (!retval && !may_mount()) 2735 retval = -EPERM; 2736 if (!retval && (flags & MS_MANDLOCK) && !may_mandlock()) 2737 retval = -EPERM; 2738 if (retval) 2739 goto dput_out; 2740 2741 /* Default to relatime unless overriden */ 2742 if (!(flags & MS_NOATIME)) 2743 mnt_flags |= MNT_RELATIME; 2744 2745 /* Separate the per-mountpoint flags */ 2746 if (flags & MS_NOSUID) 2747 mnt_flags |= MNT_NOSUID; 2748 if (flags & MS_NODEV) 2749 mnt_flags |= MNT_NODEV; 2750 if (flags & MS_NOEXEC) 2751 mnt_flags |= MNT_NOEXEC; 2752 if (flags & MS_NOATIME) 2753 mnt_flags |= MNT_NOATIME; 2754 if (flags & MS_NODIRATIME) 2755 mnt_flags |= MNT_NODIRATIME; 2756 if (flags & MS_STRICTATIME) 2757 mnt_flags &= ~(MNT_RELATIME | MNT_NOATIME); 2758 if (flags & MS_RDONLY) 2759 mnt_flags |= MNT_READONLY; 2760 2761 /* The default atime for remount is preservation */ 2762 if ((flags & MS_REMOUNT) && 2763 ((flags & (MS_NOATIME | MS_NODIRATIME | MS_RELATIME | 2764 MS_STRICTATIME)) == 0)) { 2765 mnt_flags &= ~MNT_ATIME_MASK; 2766 mnt_flags |= path.mnt->mnt_flags & MNT_ATIME_MASK; 2767 } 2768 2769 flags &= ~(MS_NOSUID | MS_NOEXEC | MS_NODEV | MS_ACTIVE | MS_BORN | 2770 MS_NOATIME | MS_NODIRATIME | MS_RELATIME| MS_KERNMOUNT | 2771 MS_STRICTATIME | MS_NOREMOTELOCK); 2772 2773 if (flags & MS_REMOUNT) 2774 retval = do_remount(&path, flags & ~MS_REMOUNT, mnt_flags, 2775 data_page); 2776 else if (flags & MS_BIND) 2777 retval = do_loopback(&path, dev_name, flags & MS_REC); 2778 else if (flags & (MS_SHARED | MS_PRIVATE | MS_SLAVE | MS_UNBINDABLE)) 2779 retval = do_change_type(&path, flags); 2780 else if (flags & MS_MOVE) 2781 retval = do_move_mount(&path, dev_name); 2782 else 2783 retval = do_new_mount(&path, type_page, flags, mnt_flags, 2784 dev_name, data_page); 2785 dput_out: 2786 path_put(&path); 2787 return retval; 2788 } 2789 2790 static struct ucounts *inc_mnt_namespaces(struct user_namespace *ns) 2791 { 2792 return inc_ucount(ns, current_euid(), UCOUNT_MNT_NAMESPACES); 2793 } 2794 2795 static void dec_mnt_namespaces(struct ucounts *ucounts) 2796 { 2797 dec_ucount(ucounts, UCOUNT_MNT_NAMESPACES); 2798 } 2799 2800 static void free_mnt_ns(struct mnt_namespace *ns) 2801 { 2802 ns_free_inum(&ns->ns); 2803 dec_mnt_namespaces(ns->ucounts); 2804 put_user_ns(ns->user_ns); 2805 kfree(ns); 2806 } 2807 2808 /* 2809 * Assign a sequence number so we can detect when we attempt to bind 2810 * mount a reference to an older mount namespace into the current 2811 * mount namespace, preventing reference counting loops. A 64bit 2812 * number incrementing at 10Ghz will take 12,427 years to wrap which 2813 * is effectively never, so we can ignore the possibility. 2814 */ 2815 static atomic64_t mnt_ns_seq = ATOMIC64_INIT(1); 2816 2817 static struct mnt_namespace *alloc_mnt_ns(struct user_namespace *user_ns) 2818 { 2819 struct mnt_namespace *new_ns; 2820 struct ucounts *ucounts; 2821 int ret; 2822 2823 ucounts = inc_mnt_namespaces(user_ns); 2824 if (!ucounts) 2825 return ERR_PTR(-ENOSPC); 2826 2827 new_ns = kmalloc(sizeof(struct mnt_namespace), GFP_KERNEL); 2828 if (!new_ns) { 2829 dec_mnt_namespaces(ucounts); 2830 return ERR_PTR(-ENOMEM); 2831 } 2832 ret = ns_alloc_inum(&new_ns->ns); 2833 if (ret) { 2834 kfree(new_ns); 2835 dec_mnt_namespaces(ucounts); 2836 return ERR_PTR(ret); 2837 } 2838 new_ns->ns.ops = &mntns_operations; 2839 new_ns->seq = atomic64_add_return(1, &mnt_ns_seq); 2840 atomic_set(&new_ns->count, 1); 2841 new_ns->root = NULL; 2842 INIT_LIST_HEAD(&new_ns->list); 2843 init_waitqueue_head(&new_ns->poll); 2844 new_ns->event = 0; 2845 new_ns->user_ns = get_user_ns(user_ns); 2846 new_ns->ucounts = ucounts; 2847 new_ns->mounts = 0; 2848 new_ns->pending_mounts = 0; 2849 return new_ns; 2850 } 2851 2852 __latent_entropy 2853 struct mnt_namespace *copy_mnt_ns(unsigned long flags, struct mnt_namespace *ns, 2854 struct user_namespace *user_ns, struct fs_struct *new_fs) 2855 { 2856 struct mnt_namespace *new_ns; 2857 struct vfsmount *rootmnt = NULL, *pwdmnt = NULL; 2858 struct mount *p, *q; 2859 struct mount *old; 2860 struct mount *new; 2861 int copy_flags; 2862 2863 BUG_ON(!ns); 2864 2865 if (likely(!(flags & CLONE_NEWNS))) { 2866 get_mnt_ns(ns); 2867 return ns; 2868 } 2869 2870 old = ns->root; 2871 2872 new_ns = alloc_mnt_ns(user_ns); 2873 if (IS_ERR(new_ns)) 2874 return new_ns; 2875 2876 namespace_lock(); 2877 /* First pass: copy the tree topology */ 2878 copy_flags = CL_COPY_UNBINDABLE | CL_EXPIRE; 2879 if (user_ns != ns->user_ns) 2880 copy_flags |= CL_SHARED_TO_SLAVE | CL_UNPRIVILEGED; 2881 new = copy_tree(old, old->mnt.mnt_root, copy_flags); 2882 if (IS_ERR(new)) { 2883 namespace_unlock(); 2884 free_mnt_ns(new_ns); 2885 return ERR_CAST(new); 2886 } 2887 new_ns->root = new; 2888 list_add_tail(&new_ns->list, &new->mnt_list); 2889 2890 /* 2891 * Second pass: switch the tsk->fs->* elements and mark new vfsmounts 2892 * as belonging to new namespace. We have already acquired a private 2893 * fs_struct, so tsk->fs->lock is not needed. 2894 */ 2895 p = old; 2896 q = new; 2897 while (p) { 2898 q->mnt_ns = new_ns; 2899 new_ns->mounts++; 2900 if (new_fs) { 2901 if (&p->mnt == new_fs->root.mnt) { 2902 new_fs->root.mnt = mntget(&q->mnt); 2903 rootmnt = &p->mnt; 2904 } 2905 if (&p->mnt == new_fs->pwd.mnt) { 2906 new_fs->pwd.mnt = mntget(&q->mnt); 2907 pwdmnt = &p->mnt; 2908 } 2909 } 2910 p = next_mnt(p, old); 2911 q = next_mnt(q, new); 2912 if (!q) 2913 break; 2914 while (p->mnt.mnt_root != q->mnt.mnt_root) 2915 p = next_mnt(p, old); 2916 } 2917 namespace_unlock(); 2918 2919 if (rootmnt) 2920 mntput(rootmnt); 2921 if (pwdmnt) 2922 mntput(pwdmnt); 2923 2924 return new_ns; 2925 } 2926 2927 /** 2928 * create_mnt_ns - creates a private namespace and adds a root filesystem 2929 * @mnt: pointer to the new root filesystem mountpoint 2930 */ 2931 static struct mnt_namespace *create_mnt_ns(struct vfsmount *m) 2932 { 2933 struct mnt_namespace *new_ns = alloc_mnt_ns(&init_user_ns); 2934 if (!IS_ERR(new_ns)) { 2935 struct mount *mnt = real_mount(m); 2936 mnt->mnt_ns = new_ns; 2937 new_ns->root = mnt; 2938 new_ns->mounts++; 2939 list_add(&mnt->mnt_list, &new_ns->list); 2940 } else { 2941 mntput(m); 2942 } 2943 return new_ns; 2944 } 2945 2946 struct dentry *mount_subtree(struct vfsmount *mnt, const char *name) 2947 { 2948 struct mnt_namespace *ns; 2949 struct super_block *s; 2950 struct path path; 2951 int err; 2952 2953 ns = create_mnt_ns(mnt); 2954 if (IS_ERR(ns)) 2955 return ERR_CAST(ns); 2956 2957 err = vfs_path_lookup(mnt->mnt_root, mnt, 2958 name, LOOKUP_FOLLOW|LOOKUP_AUTOMOUNT, &path); 2959 2960 put_mnt_ns(ns); 2961 2962 if (err) 2963 return ERR_PTR(err); 2964 2965 /* trade a vfsmount reference for active sb one */ 2966 s = path.mnt->mnt_sb; 2967 atomic_inc(&s->s_active); 2968 mntput(path.mnt); 2969 /* lock the sucker */ 2970 down_write(&s->s_umount); 2971 /* ... and return the root of (sub)tree on it */ 2972 return path.dentry; 2973 } 2974 EXPORT_SYMBOL(mount_subtree); 2975 2976 SYSCALL_DEFINE5(mount, char __user *, dev_name, char __user *, dir_name, 2977 char __user *, type, unsigned long, flags, void __user *, data) 2978 { 2979 int ret; 2980 char *kernel_type; 2981 char *kernel_dev; 2982 void *options; 2983 2984 kernel_type = copy_mount_string(type); 2985 ret = PTR_ERR(kernel_type); 2986 if (IS_ERR(kernel_type)) 2987 goto out_type; 2988 2989 kernel_dev = copy_mount_string(dev_name); 2990 ret = PTR_ERR(kernel_dev); 2991 if (IS_ERR(kernel_dev)) 2992 goto out_dev; 2993 2994 options = copy_mount_options(data); 2995 ret = PTR_ERR(options); 2996 if (IS_ERR(options)) 2997 goto out_data; 2998 2999 ret = do_mount(kernel_dev, dir_name, kernel_type, flags, options); 3000 3001 kfree(options); 3002 out_data: 3003 kfree(kernel_dev); 3004 out_dev: 3005 kfree(kernel_type); 3006 out_type: 3007 return ret; 3008 } 3009 3010 /* 3011 * Return true if path is reachable from root 3012 * 3013 * namespace_sem or mount_lock is held 3014 */ 3015 bool is_path_reachable(struct mount *mnt, struct dentry *dentry, 3016 const struct path *root) 3017 { 3018 while (&mnt->mnt != root->mnt && mnt_has_parent(mnt)) { 3019 dentry = mnt->mnt_mountpoint; 3020 mnt = mnt->mnt_parent; 3021 } 3022 return &mnt->mnt == root->mnt && is_subdir(dentry, root->dentry); 3023 } 3024 3025 bool path_is_under(const struct path *path1, const struct path *path2) 3026 { 3027 bool res; 3028 read_seqlock_excl(&mount_lock); 3029 res = is_path_reachable(real_mount(path1->mnt), path1->dentry, path2); 3030 read_sequnlock_excl(&mount_lock); 3031 return res; 3032 } 3033 EXPORT_SYMBOL(path_is_under); 3034 3035 /* 3036 * pivot_root Semantics: 3037 * Moves the root file system of the current process to the directory put_old, 3038 * makes new_root as the new root file system of the current process, and sets 3039 * root/cwd of all processes which had them on the current root to new_root. 3040 * 3041 * Restrictions: 3042 * The new_root and put_old must be directories, and must not be on the 3043 * same file system as the current process root. The put_old must be 3044 * underneath new_root, i.e. adding a non-zero number of /.. to the string 3045 * pointed to by put_old must yield the same directory as new_root. No other 3046 * file system may be mounted on put_old. After all, new_root is a mountpoint. 3047 * 3048 * Also, the current root cannot be on the 'rootfs' (initial ramfs) filesystem. 3049 * See Documentation/filesystems/ramfs-rootfs-initramfs.txt for alternatives 3050 * in this situation. 3051 * 3052 * Notes: 3053 * - we don't move root/cwd if they are not at the root (reason: if something 3054 * cared enough to change them, it's probably wrong to force them elsewhere) 3055 * - it's okay to pick a root that isn't the root of a file system, e.g. 3056 * /nfs/my_root where /nfs is the mount point. It must be a mountpoint, 3057 * though, so you may need to say mount --bind /nfs/my_root /nfs/my_root 3058 * first. 3059 */ 3060 SYSCALL_DEFINE2(pivot_root, const char __user *, new_root, 3061 const char __user *, put_old) 3062 { 3063 struct path new, old, parent_path, root_parent, root; 3064 struct mount *new_mnt, *root_mnt, *old_mnt; 3065 struct mountpoint *old_mp, *root_mp; 3066 int error; 3067 3068 if (!may_mount()) 3069 return -EPERM; 3070 3071 error = user_path_dir(new_root, &new); 3072 if (error) 3073 goto out0; 3074 3075 error = user_path_dir(put_old, &old); 3076 if (error) 3077 goto out1; 3078 3079 error = security_sb_pivotroot(&old, &new); 3080 if (error) 3081 goto out2; 3082 3083 get_fs_root(current->fs, &root); 3084 old_mp = lock_mount(&old); 3085 error = PTR_ERR(old_mp); 3086 if (IS_ERR(old_mp)) 3087 goto out3; 3088 3089 error = -EINVAL; 3090 new_mnt = real_mount(new.mnt); 3091 root_mnt = real_mount(root.mnt); 3092 old_mnt = real_mount(old.mnt); 3093 if (IS_MNT_SHARED(old_mnt) || 3094 IS_MNT_SHARED(new_mnt->mnt_parent) || 3095 IS_MNT_SHARED(root_mnt->mnt_parent)) 3096 goto out4; 3097 if (!check_mnt(root_mnt) || !check_mnt(new_mnt)) 3098 goto out4; 3099 if (new_mnt->mnt.mnt_flags & MNT_LOCKED) 3100 goto out4; 3101 error = -ENOENT; 3102 if (d_unlinked(new.dentry)) 3103 goto out4; 3104 error = -EBUSY; 3105 if (new_mnt == root_mnt || old_mnt == root_mnt) 3106 goto out4; /* loop, on the same file system */ 3107 error = -EINVAL; 3108 if (root.mnt->mnt_root != root.dentry) 3109 goto out4; /* not a mountpoint */ 3110 if (!mnt_has_parent(root_mnt)) 3111 goto out4; /* not attached */ 3112 root_mp = root_mnt->mnt_mp; 3113 if (new.mnt->mnt_root != new.dentry) 3114 goto out4; /* not a mountpoint */ 3115 if (!mnt_has_parent(new_mnt)) 3116 goto out4; /* not attached */ 3117 /* make sure we can reach put_old from new_root */ 3118 if (!is_path_reachable(old_mnt, old.dentry, &new)) 3119 goto out4; 3120 /* make certain new is below the root */ 3121 if (!is_path_reachable(new_mnt, new.dentry, &root)) 3122 goto out4; 3123 root_mp->m_count++; /* pin it so it won't go away */ 3124 lock_mount_hash(); 3125 detach_mnt(new_mnt, &parent_path); 3126 detach_mnt(root_mnt, &root_parent); 3127 if (root_mnt->mnt.mnt_flags & MNT_LOCKED) { 3128 new_mnt->mnt.mnt_flags |= MNT_LOCKED; 3129 root_mnt->mnt.mnt_flags &= ~MNT_LOCKED; 3130 } 3131 /* mount old root on put_old */ 3132 attach_mnt(root_mnt, old_mnt, old_mp); 3133 /* mount new_root on / */ 3134 attach_mnt(new_mnt, real_mount(root_parent.mnt), root_mp); 3135 touch_mnt_namespace(current->nsproxy->mnt_ns); 3136 /* A moved mount should not expire automatically */ 3137 list_del_init(&new_mnt->mnt_expire); 3138 unlock_mount_hash(); 3139 chroot_fs_refs(&root, &new); 3140 put_mountpoint(root_mp); 3141 error = 0; 3142 out4: 3143 unlock_mount(old_mp); 3144 if (!error) { 3145 path_put(&root_parent); 3146 path_put(&parent_path); 3147 } 3148 out3: 3149 path_put(&root); 3150 out2: 3151 path_put(&old); 3152 out1: 3153 path_put(&new); 3154 out0: 3155 return error; 3156 } 3157 3158 static void __init init_mount_tree(void) 3159 { 3160 struct vfsmount *mnt; 3161 struct mnt_namespace *ns; 3162 struct path root; 3163 struct file_system_type *type; 3164 3165 type = get_fs_type("rootfs"); 3166 if (!type) 3167 panic("Can't find rootfs type"); 3168 mnt = vfs_kern_mount(type, 0, "rootfs", NULL); 3169 put_filesystem(type); 3170 if (IS_ERR(mnt)) 3171 panic("Can't create rootfs"); 3172 3173 ns = create_mnt_ns(mnt); 3174 if (IS_ERR(ns)) 3175 panic("Can't allocate initial namespace"); 3176 3177 init_task.nsproxy->mnt_ns = ns; 3178 get_mnt_ns(ns); 3179 3180 root.mnt = mnt; 3181 root.dentry = mnt->mnt_root; 3182 mnt->mnt_flags |= MNT_LOCKED; 3183 3184 set_fs_pwd(current->fs, &root); 3185 set_fs_root(current->fs, &root); 3186 } 3187 3188 void __init mnt_init(void) 3189 { 3190 unsigned u; 3191 int err; 3192 3193 mnt_cache = kmem_cache_create("mnt_cache", sizeof(struct mount), 3194 0, SLAB_HWCACHE_ALIGN | SLAB_PANIC, NULL); 3195 3196 mount_hashtable = alloc_large_system_hash("Mount-cache", 3197 sizeof(struct hlist_head), 3198 mhash_entries, 19, 3199 0, 3200 &m_hash_shift, &m_hash_mask, 0, 0); 3201 mountpoint_hashtable = alloc_large_system_hash("Mountpoint-cache", 3202 sizeof(struct hlist_head), 3203 mphash_entries, 19, 3204 0, 3205 &mp_hash_shift, &mp_hash_mask, 0, 0); 3206 3207 if (!mount_hashtable || !mountpoint_hashtable) 3208 panic("Failed to allocate mount hash table\n"); 3209 3210 for (u = 0; u <= m_hash_mask; u++) 3211 INIT_HLIST_HEAD(&mount_hashtable[u]); 3212 for (u = 0; u <= mp_hash_mask; u++) 3213 INIT_HLIST_HEAD(&mountpoint_hashtable[u]); 3214 3215 kernfs_init(); 3216 3217 err = sysfs_init(); 3218 if (err) 3219 printk(KERN_WARNING "%s: sysfs_init error: %d\n", 3220 __func__, err); 3221 fs_kobj = kobject_create_and_add("fs", NULL); 3222 if (!fs_kobj) 3223 printk(KERN_WARNING "%s: kobj create error\n", __func__); 3224 init_rootfs(); 3225 init_mount_tree(); 3226 } 3227 3228 void put_mnt_ns(struct mnt_namespace *ns) 3229 { 3230 if (!atomic_dec_and_test(&ns->count)) 3231 return; 3232 drop_collected_mounts(&ns->root->mnt); 3233 free_mnt_ns(ns); 3234 } 3235 3236 struct vfsmount *kern_mount_data(struct file_system_type *type, void *data) 3237 { 3238 struct vfsmount *mnt; 3239 mnt = vfs_kern_mount(type, MS_KERNMOUNT, type->name, data); 3240 if (!IS_ERR(mnt)) { 3241 /* 3242 * it is a longterm mount, don't release mnt until 3243 * we unmount before file sys is unregistered 3244 */ 3245 real_mount(mnt)->mnt_ns = MNT_NS_INTERNAL; 3246 } 3247 return mnt; 3248 } 3249 EXPORT_SYMBOL_GPL(kern_mount_data); 3250 3251 void kern_unmount(struct vfsmount *mnt) 3252 { 3253 /* release long term mount so mount point can be released */ 3254 if (!IS_ERR_OR_NULL(mnt)) { 3255 real_mount(mnt)->mnt_ns = NULL; 3256 synchronize_rcu(); /* yecchhh... */ 3257 mntput(mnt); 3258 } 3259 } 3260 EXPORT_SYMBOL(kern_unmount); 3261 3262 bool our_mnt(struct vfsmount *mnt) 3263 { 3264 return check_mnt(real_mount(mnt)); 3265 } 3266 3267 bool current_chrooted(void) 3268 { 3269 /* Does the current process have a non-standard root */ 3270 struct path ns_root; 3271 struct path fs_root; 3272 bool chrooted; 3273 3274 /* Find the namespace root */ 3275 ns_root.mnt = ¤t->nsproxy->mnt_ns->root->mnt; 3276 ns_root.dentry = ns_root.mnt->mnt_root; 3277 path_get(&ns_root); 3278 while (d_mountpoint(ns_root.dentry) && follow_down_one(&ns_root)) 3279 ; 3280 3281 get_fs_root(current->fs, &fs_root); 3282 3283 chrooted = !path_equal(&fs_root, &ns_root); 3284 3285 path_put(&fs_root); 3286 path_put(&ns_root); 3287 3288 return chrooted; 3289 } 3290 3291 static bool mnt_already_visible(struct mnt_namespace *ns, struct vfsmount *new, 3292 int *new_mnt_flags) 3293 { 3294 int new_flags = *new_mnt_flags; 3295 struct mount *mnt; 3296 bool visible = false; 3297 3298 down_read(&namespace_sem); 3299 list_for_each_entry(mnt, &ns->list, mnt_list) { 3300 struct mount *child; 3301 int mnt_flags; 3302 3303 if (mnt->mnt.mnt_sb->s_type != new->mnt_sb->s_type) 3304 continue; 3305 3306 /* This mount is not fully visible if it's root directory 3307 * is not the root directory of the filesystem. 3308 */ 3309 if (mnt->mnt.mnt_root != mnt->mnt.mnt_sb->s_root) 3310 continue; 3311 3312 /* A local view of the mount flags */ 3313 mnt_flags = mnt->mnt.mnt_flags; 3314 3315 /* Don't miss readonly hidden in the superblock flags */ 3316 if (mnt->mnt.mnt_sb->s_flags & MS_RDONLY) 3317 mnt_flags |= MNT_LOCK_READONLY; 3318 3319 /* Verify the mount flags are equal to or more permissive 3320 * than the proposed new mount. 3321 */ 3322 if ((mnt_flags & MNT_LOCK_READONLY) && 3323 !(new_flags & MNT_READONLY)) 3324 continue; 3325 if ((mnt_flags & MNT_LOCK_ATIME) && 3326 ((mnt_flags & MNT_ATIME_MASK) != (new_flags & MNT_ATIME_MASK))) 3327 continue; 3328 3329 /* This mount is not fully visible if there are any 3330 * locked child mounts that cover anything except for 3331 * empty directories. 3332 */ 3333 list_for_each_entry(child, &mnt->mnt_mounts, mnt_child) { 3334 struct inode *inode = child->mnt_mountpoint->d_inode; 3335 /* Only worry about locked mounts */ 3336 if (!(child->mnt.mnt_flags & MNT_LOCKED)) 3337 continue; 3338 /* Is the directory permanetly empty? */ 3339 if (!is_empty_dir_inode(inode)) 3340 goto next; 3341 } 3342 /* Preserve the locked attributes */ 3343 *new_mnt_flags |= mnt_flags & (MNT_LOCK_READONLY | \ 3344 MNT_LOCK_ATIME); 3345 visible = true; 3346 goto found; 3347 next: ; 3348 } 3349 found: 3350 up_read(&namespace_sem); 3351 return visible; 3352 } 3353 3354 static bool mount_too_revealing(struct vfsmount *mnt, int *new_mnt_flags) 3355 { 3356 const unsigned long required_iflags = SB_I_NOEXEC | SB_I_NODEV; 3357 struct mnt_namespace *ns = current->nsproxy->mnt_ns; 3358 unsigned long s_iflags; 3359 3360 if (ns->user_ns == &init_user_ns) 3361 return false; 3362 3363 /* Can this filesystem be too revealing? */ 3364 s_iflags = mnt->mnt_sb->s_iflags; 3365 if (!(s_iflags & SB_I_USERNS_VISIBLE)) 3366 return false; 3367 3368 if ((s_iflags & required_iflags) != required_iflags) { 3369 WARN_ONCE(1, "Expected s_iflags to contain 0x%lx\n", 3370 required_iflags); 3371 return true; 3372 } 3373 3374 return !mnt_already_visible(ns, mnt, new_mnt_flags); 3375 } 3376 3377 bool mnt_may_suid(struct vfsmount *mnt) 3378 { 3379 /* 3380 * Foreign mounts (accessed via fchdir or through /proc 3381 * symlinks) are always treated as if they are nosuid. This 3382 * prevents namespaces from trusting potentially unsafe 3383 * suid/sgid bits, file caps, or security labels that originate 3384 * in other namespaces. 3385 */ 3386 return !(mnt->mnt_flags & MNT_NOSUID) && check_mnt(real_mount(mnt)) && 3387 current_in_userns(mnt->mnt_sb->s_user_ns); 3388 } 3389 3390 static struct ns_common *mntns_get(struct task_struct *task) 3391 { 3392 struct ns_common *ns = NULL; 3393 struct nsproxy *nsproxy; 3394 3395 task_lock(task); 3396 nsproxy = task->nsproxy; 3397 if (nsproxy) { 3398 ns = &nsproxy->mnt_ns->ns; 3399 get_mnt_ns(to_mnt_ns(ns)); 3400 } 3401 task_unlock(task); 3402 3403 return ns; 3404 } 3405 3406 static void mntns_put(struct ns_common *ns) 3407 { 3408 put_mnt_ns(to_mnt_ns(ns)); 3409 } 3410 3411 static int mntns_install(struct nsproxy *nsproxy, struct ns_common *ns) 3412 { 3413 struct fs_struct *fs = current->fs; 3414 struct mnt_namespace *mnt_ns = to_mnt_ns(ns); 3415 struct path root; 3416 3417 if (!ns_capable(mnt_ns->user_ns, CAP_SYS_ADMIN) || 3418 !ns_capable(current_user_ns(), CAP_SYS_CHROOT) || 3419 !ns_capable(current_user_ns(), CAP_SYS_ADMIN)) 3420 return -EPERM; 3421 3422 if (fs->users != 1) 3423 return -EINVAL; 3424 3425 get_mnt_ns(mnt_ns); 3426 put_mnt_ns(nsproxy->mnt_ns); 3427 nsproxy->mnt_ns = mnt_ns; 3428 3429 /* Find the root */ 3430 root.mnt = &mnt_ns->root->mnt; 3431 root.dentry = mnt_ns->root->mnt.mnt_root; 3432 path_get(&root); 3433 while(d_mountpoint(root.dentry) && follow_down_one(&root)) 3434 ; 3435 3436 /* Update the pwd and root */ 3437 set_fs_pwd(fs, &root); 3438 set_fs_root(fs, &root); 3439 3440 path_put(&root); 3441 return 0; 3442 } 3443 3444 static struct user_namespace *mntns_owner(struct ns_common *ns) 3445 { 3446 return to_mnt_ns(ns)->user_ns; 3447 } 3448 3449 const struct proc_ns_operations mntns_operations = { 3450 .name = "mnt", 3451 .type = CLONE_NEWNS, 3452 .get = mntns_get, 3453 .put = mntns_put, 3454 .install = mntns_install, 3455 .owner = mntns_owner, 3456 }; 3457