releases/4.4.14/bpf-inode-disallow-userns-mounts.patch

   1 From foo@baz Fri Jun 17 11:18:18 PDT 2016
   2 From: Daniel Borkmann <daniel@iogearbox.net>
   3 Date: Sun, 22 May 2016 23:16:18 +0200
   4 Subject: bpf, inode: disallow userns mounts
   5
   6 From: Daniel Borkmann <daniel@iogearbox.net>
   7
   8 [ Upstream commit 612bacad78ba6d0a91166fc4487af114bac172a8 ]
   9
  10 Follow-up to commit e27f4a942a0e ("bpf: Use mount_nodev not mount_ns
  11 to mount the bpf filesystem"), which removes the FS_USERNS_MOUNT flag.
  12
  13 The original idea was to have a per mountns instance instead of a
  14 single global fs instance, but that didn't work out and we had to
  15 switch to mount_nodev() model. The intent of that middle ground was
  16 that we avoid users who don't play nice to create endless instances
  17 of bpf fs which are difficult to control and discover from an admin
  18 point of view, but at the same time it would have allowed us to be
  19 more flexible with regard to namespaces.
  20
  21 Therefore, since we now did the switch to mount_nodev() as a fix
  22 where individual instances are created, we also need to remove userns
  23 mount flag along with it to avoid running into mentioned situation.
  24 I don't expect any breakage at this early point in time with removing
  25 the flag and we can revisit this later should the requirement for
  26 this come up with future users. This and commit e27f4a942a0e have
  27 been split to facilitate tracking should any of them run into the
  28 unlikely case of causing a regression.
  29
  30 Fixes: b2197755b263 ("bpf: add support for persistent maps/progs")
  31 Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
  32 Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
  33 Acked-by: Alexei Starovoitov <ast@kernel.org>
  34 Signed-off-by: David S. Miller <davem@davemloft.net>
  35 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  36 ---
  37  kernel/bpf/inode.c |    1 -
  38  1 file changed, 1 deletion(-)
  39
  40 --- a/kernel/bpf/inode.c
  41 +++ b/kernel/bpf/inode.c
  42 @@ -366,7 +366,6 @@ static struct file_system_type bpf_fs_ty
  43         .name           = "bpf",
  44         .mount          = bpf_mount,
  45         .kill_sb        = kill_litter_super,
  46 -       .fs_flags       = FS_USERNS_MOUNT,
  47  };
  48
  49  MODULE_ALIAS_FS("bpf");