Patch "bpf, inode: disallow userns mounts" has been added to the 4.4-stable tree

This is a note to let you know that I've just added the patch titled

bpf, inode: disallow userns mounts

to the 4.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
bpf-inode-disallow-userns-mounts.patch
and it can be found in the queue-4.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Daniel Borkmann <[email protected]>
Date: Sun, 22 May 2016 23:16:18 +0200
Subject: bpf, inode: disallow userns mounts

From: Daniel Borkmann <[email protected]>

[ Upstream commit 612bacad78ba6d0a91166fc4487af114bac172a8 ]

Follow-up to commit e27f4a942a0e ("bpf: Use mount_nodev not mount_ns to mount the bpf filesystem"), which removes the FS_USERNS_MOUNT flag.

The original idea was to have a per mountns instance instead of a single global fs instance, but that didn't work out and we had to switch to mount_nodev() model. The intent of that middle ground was that we avoid users who don't play nice to create endless instances of bpf fs which are difficult to control and discover from an admin point of view, but at the same time it would have allowed us to be more flexible with regard to namespaces.

Therefore, since we now did the switch to mount_nodev() as a fix where individual instances are created, we also need to remove userns mount flag along with it to avoid running into mentioned situation. I don't expect any breakage at this early point in time with removing the flag and we can revisit this later should the requirement for this come up with future users. This and commit e27f4a942a0e have been split to facilitate tracking should any of them run into the unlikely case of causing a regression.

---
 kernel/bpf/inode.c |    1 -
 1 file changed, 1 deletion(-)

@@ -366,7 +366,6 @@ static struct file_system_type bpf_fs_ty
 	.name		= "bpf",
 	.mount		= bpf_mount,
 	.kill_sb	= kill_litter_super,
-	.fs_flags	= FS_USERNS_MOUNT,
 };
 
 MODULE_ALIAS_FS("bpf");

Patches currently in stable-queue which might be from [email protected] are

queue-4.4/bpf-use-mount_nodev-not-mount_ns-to-mount-the-bpf-filesystem.patch queue-4.4/bpf-inode-disallow-userns-mounts.patch