On 10/14/2014 07:25 AM, Seth Forshee wrote: > Cc: Eric W. Biederman <[email protected]> > Cc: Serge H. Hallyn <[email protected]> > Signed-off-by: Seth Forshee <[email protected]> > --- > fs/fuse/inode.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c > index 5e00a6a76049..6522926b14e4 100644 > --- a/fs/fuse/inode.c > +++ b/fs/fuse/inode.c > @@ -1212,7 +1212,7 @@ static void fuse_kill_sb_anon(struct super_block *sb) > static struct file_system_type fuse_fs_type = { > .owner = THIS_MODULE, > .name = "fuse", > - .fs_flags = FS_HAS_SUBTYPE, > + .fs_flags = FS_HAS_SUBTYPE | FS_USERNS_MOUNT, > .mount = fuse_mount, > .kill_sb = fuse_kill_sb_anon, > }; > @@ -1244,7 +1244,7 @@ static struct file_system_type fuseblk_fs_type = { > .name = "fuseblk", > .mount = fuse_mount_blk, > .kill_sb = fuse_kill_sb_blk, > - .fs_flags = FS_REQUIRES_DEV | FS_HAS_SUBTYPE, > + .fs_flags = FS_REQUIRES_DEV | FS_HAS_SUBTYPE | FS_USERNS_MOUNT,
I think it's decision time -- if these patches are applied, then FUSE will be the first filesystem for which userns nodev behavior matters for security, so applying this patch will enshrine an API decision. I would very much prefer to make this patch depend on this: http://lkml.kernel.org/g/2686c32f00b14148379e8cfee9c028c794d4aa1a.1407974494.git.l...@amacapital.net That change will require that anyone who tries to mount one of these things explicitly requests MS_NODEV instead of keeping the current behavior of implicitly setting MS_NODEV and possibly confusing user code that tries to remount. If you like my patch, feel free to fold it in to your series, or Eric can apply it directly (pretty please). For background, with your patches as is, if you mount a FUSE fs and then remount it with identical flags, the remount is likely to fail. --Andy > }; > MODULE_ALIAS_FS("fuseblk"); > > -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
