In mount operations, cgroup device access permissions are checked only when a new super_block is created. If the device has already been mounted, no permission check is performed since the super_block already exists. As a result, a process belonging to a cgroup without access permissions to the device can still perform a mount operation successfully.
To reproduce: # mount /dev/loop0 /mnt/test0 # echo $$ > /sys/fs/cgroup/machine.slice/CTID/cgroup.procs # mount /dev/loop0 /mnt/test1 # If the device was not mounted before, the mount operation fails as expected: # echo $$ > /sys/fs/cgroup/machine.slice/CTID/cgroup.procs # mount /dev/loop0 /mnt/test1 mount: /mnt/test1: permission denied. This patch adds a cgroup permission check for the mounting process before obtaining the device's super_block. As a result, even if the device has already been mounted and the super_block exists, the mount operation will be denied when the process lacks the appropriate cgroup permissions. v2: removed redundant cgroup permission check when creating a new superblock in setup_dbev_super. https://virtuozzo.atlassian.net/browse/VSTOR-105978 Signed-off-by: Aleksei Oladko <[email protected]> --- block/bdev.c | 22 ++++++++++++++++------ block/blk.h | 1 - fs/super.c | 20 ++++++++++++++++++-- include/linux/blkdev.h | 4 ++++ 4 files changed, 38 insertions(+), 9 deletions(-) diff --git a/block/bdev.c b/block/bdev.c index 3ed6ea450554..b445ceeb18ac 100644 --- a/block/bdev.c +++ b/block/bdev.c @@ -992,18 +992,15 @@ static unsigned blk_to_file_flags(blk_mode_t mode) return flags; } -struct file *bdev_file_open_by_dev(dev_t dev, blk_mode_t mode, void *holder, - const struct blk_holder_ops *hops) +struct file *bdev_file_open_by_dev_nocheck(dev_t dev, blk_mode_t mode, + void *holder, + const struct blk_holder_ops *hops) { struct file *bdev_file; struct block_device *bdev; unsigned int flags; int ret; - ret = bdev_permission(dev, mode, holder); - if (ret) - return ERR_PTR(ret); - bdev = blkdev_get_no_open(dev); if (!bdev) return ERR_PTR(-ENXIO); @@ -1026,6 +1023,19 @@ struct file *bdev_file_open_by_dev(dev_t dev, blk_mode_t mode, void *holder, } return bdev_file; } +EXPORT_SYMBOL(bdev_file_open_by_dev_nocheck); + +struct file *bdev_file_open_by_dev(dev_t dev, blk_mode_t mode, void *holder, + const struct blk_holder_ops *hops) +{ + int ret; + + ret = bdev_permission(dev, mode, holder); + if (ret) + return ERR_PTR(ret); + + return bdev_file_open_by_dev_nocheck(dev, mode, holder, hops); +} EXPORT_SYMBOL(bdev_file_open_by_dev); struct file *bdev_file_open_by_path(const char *path, blk_mode_t mode, diff --git a/block/blk.h b/block/blk.h index c718e4291db0..8610d87e5050 100644 --- a/block/blk.h +++ b/block/blk.h @@ -727,7 +727,6 @@ static inline void bio_issue_init(struct bio_issue *issue, void bdev_release(struct file *bdev_file); int bdev_open(struct block_device *bdev, blk_mode_t mode, void *holder, const struct blk_holder_ops *hops, struct file *bdev_file); -int bdev_permission(dev_t dev, blk_mode_t mode, void *holder); void blk_integrity_generate(struct bio *bio); void blk_integrity_verify(struct bio *bio); diff --git a/fs/super.c b/fs/super.c index 5cdd1b28ac9f..b922fc978b6f 100644 --- a/fs/super.c +++ b/fs/super.c @@ -1408,6 +1408,17 @@ struct super_block *sget_dev(struct fs_context *fc, dev_t dev) } EXPORT_SYMBOL(sget_dev); +static struct super_block *sget_dev_check(struct fs_context *fc, dev_t dev) +{ + int ret; + + blk_mode_t mode = sb_open_mode(fc->sb_flags) | BLK_OPEN_MOUNT; + ret = bdev_permission(dev, mode, fc); + if (ret) + return ERR_PTR(ret); + return sget_dev(fc, dev); +} + #ifdef CONFIG_BLOCK /* * Lock the superblock that is holder of the bdev. Returns the superblock @@ -1597,7 +1608,8 @@ int setup_bdev_super(struct super_block *sb, int sb_flags, struct file *bdev_file; struct block_device *bdev; - bdev_file = bdev_file_open_by_dev(sb->s_dev, mode | BLK_OPEN_MOUNT, sb, &fs_holder_ops); + bdev_file = bdev_file_open_by_dev_nocheck(sb->s_dev, + mode, sb, &fs_holder_ops); if (IS_ERR(bdev_file)) { if (fc) errorf(fc, "%s: Can't open blockdev", fc->source); @@ -1665,7 +1677,7 @@ int get_tree_bdev_flags(struct fs_context *fc, return error; } fc->sb_flags |= SB_NOSEC; - s = sget_dev(fc, dev); + s = sget_dev_check(fc, dev); if (IS_ERR(s)) return PTR_ERR(s); @@ -1723,6 +1735,10 @@ struct dentry *mount_bdev(struct file_system_type *fs_type, if (error) return ERR_PTR(error); + error = bdev_permission(dev, sb_open_mode(flags) | BLK_OPEN_MOUNT, data); + if (error) + return ERR_PTR(error); + flags |= SB_NOSEC; s = sget(fs_type, test_bdev_super, set_bdev_super, flags, &dev); if (IS_ERR(s)) diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h index 64c28dbb44b4..0dee6b60b62d 100644 --- a/include/linux/blkdev.h +++ b/include/linux/blkdev.h @@ -1661,11 +1661,15 @@ extern const struct blk_holder_ops fs_holder_ops; struct file *bdev_file_open_by_dev(dev_t dev, blk_mode_t mode, void *holder, const struct blk_holder_ops *hops); +struct file *bdev_file_open_by_dev_nocheck(dev_t dev, blk_mode_t mode, + void *holder, + const struct blk_holder_ops *hops); struct file *bdev_file_open_by_path(const char *path, blk_mode_t mode, void *holder, const struct blk_holder_ops *hops); int bd_prepare_to_claim(struct block_device *bdev, void *holder, const struct blk_holder_ops *hops); void bd_abort_claiming(struct block_device *bdev, void *holder); +int bdev_permission(dev_t dev, blk_mode_t mode, void *holder); /* just for blk-cgroup, don't use elsewhere */ struct block_device *blkdev_get_no_open(dev_t dev); -- 2.43.0 _______________________________________________ Devel mailing list [email protected] https://lists.openvz.org/mailman/listinfo/devel
