Eric W. Biederman
7f78e03513
fs: Limit sys_mount to only request filesystem modules. ...
Modify the request_module to prefix the file system type with "fs-"
and add aliases to all of the filesystems that can be built as modules
to match.
A common practice is to build all of the kernel code and leave code
that is not commonly needed as modules, with the result that many
users are exposed to any bug anywhere in the kernel.
Looking for filesystems with a fs- prefix limits the pool of possible
modules that can be loaded by mount to just filesystems trivially
making things safer with no real cost.
Using aliases means user space can control the policy of which
filesystem modules are auto-loaded by editing /etc/modprobe.d/*.conf
with blacklist and alias directives. Allowing simple, safe,
well understood work-arounds to known problematic software.
This also addresses a rare but unfortunate problem where the filesystem
name is not the same as it's module name and module auto-loading
would not work. While writing this patch I saw a handful of such
cases. The most significant being autofs that lives in the module
autofs4.
This is relevant to user namespaces because we can reach the request
module in get_fs_type() without having any special permissions, and
people get uncomfortable when a user specified string (in this case
the filesystem type) goes all of the way to request_module.
After having looked at this issue I don't think there is any
particular reason to perform any filtering or permission checks beyond
making it clear in the module request that we want a filesystem
module. The common pattern in the kernel is to call request_module()
without regards to the users permissions. In general all a filesystem
module does once loaded is call register_filesystem() and go to sleep.
Which means there is not much attack surface exposed by loading a
filesytem module unless the filesystem is mounted. In a user
namespace filesystems are not mounted unless .fs_flags = FS_USERNS_MOUNT,
which most filesystems do not set today.
Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
Acked-by: Kees Cook <keescook@chromium.org>
Reported-by: Kees Cook <keescook@google.com>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
2013-03-03 19:36:31 -08:00
fs/xfs: remove depends on CONFIG_EXPERIMENTAL
2013-01-11 11:39:04 -08:00
xfs: switch to proper __bitwise type for KM_... flags
2012-05-29 23:28:32 -04:00
xfs: switch to proper __bitwise type for KM_... flags
2012-05-29 23:28:32 -04:00
xfs: remove xfs_flushinval_pages
2012-11-14 15:15:08 -06:00
xfs: add CRC infrastructure
2012-11-19 20:11:24 -06:00
userns: Pass a userns parameter into posix_acl_to_xattr and posix_acl_from_xattr
2012-09-18 01:01:35 -07:00
xfs: convert buffer verifiers to an ops structure.
2012-11-15 21:35:12 -06:00
xfs: don't zero structure members after a memset(0)
2013-01-03 16:00:07 -06:00
xfs: convert buffer verifiers to an ops structure.
2012-11-15 21:35:12 -06:00
xfs: convert buffer verifiers to an ops structure.
2012-11-15 21:35:12 -06:00
xfs: convert buffer verifiers to an ops structure.
2012-11-15 21:35:12 -06:00
xfs: Fix possible use-after-free with AIO
2013-01-26 09:43:58 -06:00
Prefix IO_XX flags with XFS_IO_XX to avoid namespace colision.
2012-07-22 11:00:55 -05:00
xfs: refactor space log reservation for XFS_TRANS_ATTR_SET
2013-02-01 14:56:31 -06:00
xfs: convert buffer verifiers to an ops structure.
2012-11-15 21:35:12 -06:00
xfs: convert buffer verifiers to an ops structure.
2012-11-15 21:35:12 -06:00
xfs: xfs_bmap_add_attrfork_local is too generic
2013-02-14 17:35:51 -06:00
xfs: move allocation stack switch up to xfs_bmapi_allocate
2012-10-18 17:42:48 -05:00
xfs: convert buffer verifiers to an ops structure.
2012-11-15 21:35:12 -06:00
xfs: convert buffer verifiers to an ops structure.
2012-11-15 21:35:12 -06:00
xfs: convert buffer verifiers to an ops structure.
2012-11-15 21:35:12 -06:00
xfs: convert buffer verifiers to an ops structure.
2012-11-15 21:35:12 -06:00
xfs: remove log force from xfs_buf_trylock()
2013-02-14 17:24:53 -06:00
xfs: use b_maps[] for discontiguous buffers
2013-01-16 16:07:11 -06:00
xfs: recheck buffer pinned status after push trylock failure
2013-02-14 17:23:42 -06:00
xfs: rename bli_format to avoid confusion with bli_formats
2013-01-16 16:07:37 -06:00
xfs: add CRC infrastructure
2012-11-19 20:11:24 -06:00
xfs: convert buffer verifiers to an ops structure.
2012-11-15 21:35:12 -06:00
xfs: convert buffer verifiers to an ops structure.
2012-11-15 21:35:12 -06:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2013-02-26 20:16:07 -08:00
xfs: fix typo in comment of xfs_dinode_t.
2012-06-14 12:28:26 -05:00
xfs: remove struct xfs_dabuf and infrastructure
2012-07-01 14:50:07 -05:00
xfs: recalculate leaf entry pointer after compacting a dir2 block
2013-01-16 16:08:55 -06:00
xfs: convert buffer verifiers to an ops structure.
2012-11-15 21:35:12 -06:00
xfs: convert buffer verifiers to an ops structure.
2012-11-15 21:35:12 -06:00
xfs: convert buffer verifiers to an ops structure.
2012-11-15 21:35:12 -06:00
xfs: convert buffer verifiers to an ops structure.
2012-11-15 21:35:12 -06:00
xfs: remove struct xfs_dabuf and infrastructure
2012-07-01 14:50:07 -05:00
xfs: check for possible overflow in xfs_ioc_trim
2012-08-23 14:48:44 -05:00
xfs: calculate XFS_TRANS_QM_DQALLOC space log reservation at mount time
2013-02-01 14:43:51 -06:00
xfs: convert buffer verifiers to an ops structure.
2012-11-15 21:35:12 -06:00
xfs: clean up xfs_bit.h includes
2012-05-14 16:21:00 -05:00
xfs: move xfsagino_t to xfs_types.h
2012-05-14 16:20:54 -05:00
fs: encode_fh: return FILEID_INVALID if invalid fid_type
2013-02-26 02:46:10 -05:00
xfs: make xfs_extent_busy_trim not static
2012-05-14 16:21:04 -05:00
xfs: make xfs_extent_busy_trim not static
2012-05-14 16:21:04 -05:00
xfs: move xfsagino_t to xfs_types.h
2012-05-14 16:20:54 -05:00
new helper: file_inode(file)
2013-02-22 23:31:31 -05:00
xfs: add minimum file size filtering to eofblocks scan
2012-11-08 15:32:29 -06:00
xfs: make use of XFS_SB_LOG_RES() at xfs_fs_log_dummy()
2013-02-01 14:55:59 -06:00
xfs: add background scanning to clear eofblocks inodes
2012-11-08 15:34:59 -06:00
xfs: don't zero structure members after a memset(0)
2013-01-03 16:00:07 -06:00
xfs: convert buffer verifiers to an ops structure.
2012-11-15 21:35:12 -06:00
xfs: convert buffer verifiers to an ops structure.
2012-11-15 21:35:12 -06:00
xfs: convert buffer verifiers to an ops structure.
2012-11-15 21:35:12 -06:00
xfs: add background scanning to clear eofblocks inodes
2012-11-08 15:34:59 -06:00
xfs: add background scanning to clear eofblocks inodes
2012-11-08 15:34:59 -06:00
xfs remove the XFS_TRANS_DEBUG routines
2012-12-17 16:29:00 -06:00
xfs: memory barrier before wake_up_bit()
2013-02-07 09:39:48 -06:00
xfs remove the XFS_TRANS_DEBUG routines
2012-12-17 16:29:00 -06:00
xfs remove the XFS_TRANS_DEBUG routines
2012-12-17 16:29:00 -06:00
xfs: move xfsagino_t to xfs_types.h
2012-05-14 16:20:54 -05:00
new helper: file_inode(file)
2013-02-22 23:31:31 -05:00
new helper: file_inode(file)
2013-02-22 23:31:31 -05:00
xfs: limit speculative prealloc size on sparse files
2013-02-14 17:21:32 -06:00
xfs: remove xfs_flush_pages
2012-11-14 15:12:45 -06:00
xfs: convert buffer verifiers to an ops structure.
2012-11-15 21:35:12 -06:00
xfs: add CRC infrastructure
2012-11-19 20:11:24 -06:00
xfs: fix fs/xfs/xfs_log.c:1740:39: error: 'B_TRUE' undeclared
2013-01-18 15:11:57 -06:00
xfs: xfs_quiesce_attr() should quiesce the log like unmount
2012-10-17 13:39:14 -05:00
xfs: rename log structure to xlog
2012-06-21 14:21:11 -05:00
xfs: fix sparse reported log CRC endian issue
2012-12-03 12:10:59 -06:00
hlist: drop the node parameter from iterators
2013-02-27 19:10:24 -08:00
xfs: move xfsagino_t to xfs_types.h
2012-05-14 16:20:54 -05:00
xfs: make use of XFS_SB_LOG_RES() at xfs_mount_log_sb()
2013-02-01 14:55:08 -06:00
xfs: refactor space log reservation for XFS_TRANS_ATTR_SET
2013-02-01 14:56:31 -06:00
xfs: calculate xfs_qm_write_sb_changes() space log reservation at mount time
2013-02-01 14:42:32 -06:00
xfs: Remove boolean_t typedef completely.
2013-01-17 17:32:57 -06:00
xfs: calculate XFS_TRANS_QM_QUOTAOFF_END space log reservation at mount time
2013-02-01 14:45:50 -06:00
userns: Convert qutoactl
2012-09-18 01:01:39 -07:00
xfs: move xfsagino_t to xfs_types.h
2012-05-14 16:20:54 -05:00
xfs: uncached buffer reads need to return an error
2012-11-15 21:34:05 -06:00
xfs: add CRC infrastructure
2012-11-19 20:11:24 -06:00
fs: Limit sys_mount to only request filesystem modules.
2013-03-03 19:36:31 -08:00
xfs: xfs_sync_data is redundant.
2012-10-17 12:01:25 -05:00
xfs: add background scanning to clear eofblocks inodes
2012-11-08 15:34:59 -06:00
xfs: add background scanning to clear eofblocks inodes
2012-11-08 15:34:59 -06:00
xfs: clean up xfs_bit.h includes
2012-05-14 16:21:00 -05:00
xfs: fix shutdown hang on invalid inode during create
2013-01-26 09:34:38 -06:00
xfs: refactor space log reservation for XFS_TRANS_ATTR_SET
2013-02-01 14:56:31 -06:00
xfs: refactor space log reservation for XFS_TRANS_ATTR_SET
2013-02-01 14:56:31 -06:00
xfs remove the XFS_TRANS_DEBUG routines
2012-12-17 16:29:00 -06:00
xfs: fix the multi-segment log buffer format
2013-01-16 16:08:08 -06:00
xfs: Remove boolean_t typedef completely.
2013-01-17 17:32:57 -06:00
xfs: move xfsagino_t to xfs_types.h
2012-05-14 16:20:54 -05:00
xfs remove the XFS_TRANS_DEBUG routines
2012-12-17 16:29:00 -06:00
xfs: re-enable xfsaild idle mode and fix associated races
2012-07-29 16:27:57 -05:00
xfs: Remove boolean_t typedef completely.
2013-01-17 17:32:57 -06:00
xfs: remove the alloc_done argument to xfs_dialloc
2012-07-29 16:00:31 -05:00
xfs: remove remaining scraps of struct xfs_iomap
2012-03-15 13:40:16 -05:00
xfs: Remove boolean_t typedef completely.
2013-01-17 17:32:57 -06:00
xfs: byte range granularity for XFS_IOC_ZERO_RANGE
2012-11-29 14:21:46 -06:00
7f78e03513