Patch "mnt: Modify fs_fully_visible to deal with locked ro nodev and atime" has been added to the 4.1-stable tree

This is a note to let you know that I've just added the patch titled

mnt: Modify fs_fully_visible to deal with locked ro nodev and atime

to the 4.1-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
mnt-modify-fs_fully_visible-to-deal-with-locked-ro-nodev-and-atime.patch
and it can be found in the queue-4.1 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: "Eric W. Biederman" <[email protected]>
Date: Fri, 8 May 2015 23:49:47 -0500
Subject: mnt: Modify fs_fully_visible to deal with locked ro nodev and atime

From: "Eric W. Biederman" <[email protected]>

commit 8c6cf9cc829fcd0b179b59f7fe288941d0e31108 upstream.

Ignore an existing mount if the locked readonly, nodev or atime attributes are less permissive than the desired attributes of the new mount.

On success ensure the new mount locks all of the same readonly, nodev and atime attributes as the old mount.

The nosuid and noexec attributes are not checked here as this change is destined for stable and enforcing those attributes causes a regression in lxc and libvirt-lxc where those applications will not start and there are no known executables on sysfs or proc and no known way to create exectuables without code modifications

---
 fs/namespace.c |   24 +++++++++++++++++++++---
 1 file changed, 21 insertions(+), 3 deletions(-)

@@ -2332,7 +2332,7 @@ unlock:
 	return err;
 }
 
-static bool fs_fully_visible(struct file_system_type *fs_type);
+static bool fs_fully_visible(struct file_system_type *fs_type, int *new_mnt_flags);
 
 /*
  * create a new mount for userspace and request it to be added into the

@@ -2366,7 +2366,7 @@ static int do_new_mount(struct path *pat
 			mnt_flags |= MNT_NODEV | MNT_LOCK_NODEV;
 		}
 		if (type->fs_flags & FS_USERNS_VISIBLE) {
-			if (!fs_fully_visible(type))
+			if (!fs_fully_visible(type, &mnt_flags))
 				return -EPERM;
 		}
 	}

@@ -3170,9 +3170,10 @@ bool current_chrooted(void)
 	return chrooted;
 }
 
-static bool fs_fully_visible(struct file_system_type *type)
+static bool fs_fully_visible(struct file_system_type *type, int *new_mnt_flags)
 {
 	struct mnt_namespace *ns = current->nsproxy->mnt_ns;
+	int new_flags = *new_mnt_flags;
 	struct mount *mnt;
 	bool visible = false;
 

@@ -3191,6 +3192,19 @@ static bool fs_fully_visible(struct file
 		if (mnt->mnt.mnt_root != mnt->mnt.mnt_sb->s_root)
 			continue;
 
+		/* Verify the mount flags are equal to or more permissive
+		 * than the proposed new mount.
+		 */
+		if ((mnt->mnt.mnt_flags & MNT_LOCK_READONLY) &&
+		    !(new_flags & MNT_READONLY))
+			continue;
+		if ((mnt->mnt.mnt_flags & MNT_LOCK_NODEV) &&
+		    !(new_flags & MNT_NODEV))
+			continue;
+		if ((mnt->mnt.mnt_flags & MNT_LOCK_ATIME) &&
+		    ((mnt->mnt.mnt_flags & MNT_ATIME_MASK) != (new_flags & MNT_ATIME_MASK)))
+			continue;
+
 		/* This mount is not fully visible if there are any
 		 * locked child mounts that cover anything except for
 		 * empty directories.

@@ -3204,6 +3218,10 @@ static bool fs_fully_visible(struct file
 			if (!is_empty_dir_inode(inode))
 				goto next;
 		}
+		/* Preserve the locked attributes */
+		*new_mnt_flags |= mnt->mnt.mnt_flags & (MNT_LOCK_READONLY | \
+							MNT_LOCK_NODEV    | \
+							MNT_LOCK_ATIME);
 		visible = true;
 		goto found;
 	next:	;

Patches currently in stable-queue which might be from [email protected] are

queue-4.1/sysfs-create-mountpoints-with-sysfs_create_mount_point.patch queue-4.1/sysfs-add-support-for-permanently-empty-directories-to-serve-as-mount-points.patch queue-4.1/mnt-update-fs_fully_visible-to-test-for-permanently-empty-directories.patch queue-4.1/mnt-refactor-the-logic-for-mounting-sysfs-and-proc-in-a-user-namespace.patch queue-4.1/mnt-modify-fs_fully_visible-to-deal-with-locked-ro-nodev-and-atime.patch queue-4.1/fs-add-helper-functions-for-permanently-empty-directories.patch queue-4.1/sysctl-allow-creating-permanently-empty-directories-that-serve-as-mountpoints.patch queue-4.1/kernfs-add-support-for-always-empty-directories.patch queue-4.1/proc-allow-creating-permanently-empty-directories-that-serve-as-mount-points.patch