From: Christian Brauner Date: Wed, 18 Jun 2025 20:53:35 +0000 (+0200) Subject: pidfs: raise SB_I_NODEV and SB_I_NOEXEC X-Git-Tag: v6.12.43~352 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=a482e56b2a73ed75f6a46a1e10a77a9982dc9253;p=thirdparty%2Fkernel%2Fstable.git pidfs: raise SB_I_NODEV and SB_I_NOEXEC [ Upstream commit 1a1ad73aa1a66787f05f7f10f686b74bab77be72 ] Similar to commit 1ed95281c0c7 ("anon_inode: raise SB_I_NODEV and SB_I_NOEXEC"): it shouldn't be possible to execute pidfds via execveat(fd_anon_inode, "", NULL, NULL, AT_EMPTY_PATH) so raise SB_I_NOEXEC so that no one gets any creative ideas. Also raise SB_I_NODEV as we don't expect or support any devices on pidfs. Link: https://lore.kernel.org/20250618-work-pidfs-persistent-v2-1-98f3456fd552@kernel.org Reviewed-by: Alexander Mikhalitsyn Signed-off-by: Christian Brauner Signed-off-by: Sasha Levin --- diff --git a/fs/pidfs.c b/fs/pidfs.c index 52b7e4f767327..5a8d8eb8df23b 100644 --- a/fs/pidfs.c +++ b/fs/pidfs.c @@ -382,6 +382,8 @@ static int pidfs_init_fs_context(struct fs_context *fc) if (!ctx) return -ENOMEM; + fc->s_iflags |= SB_I_NOEXEC; + fc->s_iflags |= SB_I_NODEV; ctx->ops = &pidfs_sops; ctx->dops = &pidfs_dentry_operations; fc->s_fs_info = (void *)&pidfs_stashed_ops;