From nobody Mon Jun 29 18:38:02 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7ADD9C433EF for ; Fri, 4 Feb 2022 06:55:03 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245357AbiBDGzC (ORCPT ); Fri, 4 Feb 2022 01:55:02 -0500 Received: from vmicros1.altlinux.org ([194.107.17.57]:60744 "EHLO vmicros1.altlinux.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233514AbiBDGzB (ORCPT ); Fri, 4 Feb 2022 01:55:01 -0500 Received: from imap.altlinux.org (imap.altlinux.org [194.107.17.38]) by vmicros1.altlinux.org (Postfix) with ESMTP id C3E2672C905; Fri, 4 Feb 2022 09:54:59 +0300 (MSK) Received: from boyarsh.office.basealt.ru (unknown [193.43.10.250]) by imap.altlinux.org (Postfix) with ESMTPSA id 997514A46F0; Fri, 4 Feb 2022 09:54:59 +0300 (MSK) From: "Anton V. Boyarshinov" To: viro@zeniv.linux.org.uk, linux-fsdevel@vger.kernel.org Cc: "Anton V. Boyarshinov" , ebiederm@xmission.com, legion@kernel.org, ldv@altlinux.org, linux-kernel@vger.kernel.org, kernel-hardening@lists.openwall.com Subject: [PATCH] Add ability to disallow idmapped mounts Date: Fri, 4 Feb 2022 09:53:38 +0300 Message-Id: <20220204065338.251469-1-boyarsh@altlinux.org> X-Mailer: git-send-email 2.25.4 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" Idmapped mounts may have security implications [1] and have no knobs to be disallowed at runtime or compile time. This patch adds a sysctl and a config option to set its default value. [1] https://lore.kernel.org/all/m18s7481xc.fsf@fess.ebiederm.org/ Based on work from Alexey Gladkov . Signed-off-by: Anton V. Boyarshinov --- Documentation/admin-guide/sysctl/fs.rst | 12 ++++++++++++ fs/Kconfig | 8 ++++++++ fs/namespace.c | 21 ++++++++++++++++++++- 3 files changed, 40 insertions(+), 1 deletion(-) diff --git a/Documentation/admin-guide/sysctl/fs.rst b/Documentation/admin-= guide/sysctl/fs.rst index 2a501c9ddc55..f758c4ae5f66 100644 --- a/Documentation/admin-guide/sysctl/fs.rst +++ b/Documentation/admin-guide/sysctl/fs.rst @@ -105,6 +105,18 @@ you have some awesome number of simultaneous system us= ers, you might want to raise the limit. =20 =20 +idmap_mounts +------------ + +Idmapped mounts may have security implications. +This knob controls whether creation of idmapped mounts is allowed. +When set to "1", creation of idmapped mounts is allowed. +When set to "0", creation of idmapped mounts is not allowed. + +The default value is +* 0, if ``IDMAP_MOUNTS_DEFAULT_OFF`` is enabled in the kernel configuratio= n; +* 1, otherwise. + file-max & file-nr ------------------ =20 diff --git a/fs/Kconfig b/fs/Kconfig index 7a2b11c0b803..d2203ba0183d 100644 --- a/fs/Kconfig +++ b/fs/Kconfig @@ -385,4 +385,12 @@ source "fs/unicode/Kconfig" config IO_WQ bool =20 +config IDMAP_MOUNTS_DEFAULT_OFF + bool "Disallow idmappad mounts by default" + help + Idmapped mounts may have security implications. + Enable this to disallow idmapped mounts by setting + the default value of /proc/sys/fs/idmap_mounts to 0. + + endmenu diff --git a/fs/namespace.c b/fs/namespace.c index 40b994a29e90..66501ad75537 100644 --- a/fs/namespace.c +++ b/fs/namespace.c @@ -39,6 +39,10 @@ /* Maximum number of mounts in a mount namespace */ static unsigned int sysctl_mount_max __read_mostly =3D 100000; =20 +/* Whether idmapped mounts are allowed. */ +static int sysctl_idmap_mounts __read_mostly =3D + IS_ENABLED(CONFIG_IDMAP_MOUNTS_DEFAULT_OFF) ? 0 : 1; + static unsigned int m_hash_mask __read_mostly; static unsigned int m_hash_shift __read_mostly; static unsigned int mp_hash_mask __read_mostly; @@ -3965,7 +3969,13 @@ static int can_idmap_mount(const struct mount_kattr = *kattr, struct mount *mnt) if (!is_anon_ns(mnt->mnt_ns)) return -EINVAL; =20 - return 0; + /* So far, there are concerns about the safety of idmaps. */ + if (!sysctl_idmap_mounts) { + pr_warn_once("VFS: idmapped mounts are not allowed.\n"); + return -EPERM; + } else { + return 0; + } } =20 static struct mount *mount_setattr_prepare(struct mount_kattr *kattr, @@ -4631,6 +4641,15 @@ static struct ctl_table fs_namespace_sysctls[] =3D { .proc_handler =3D proc_dointvec_minmax, .extra1 =3D SYSCTL_ONE, }, + { + .procname =3D "idmap_mounts", + .data =3D &sysctl_idmap_mounts, + .maxlen =3D sizeof(int), + .mode =3D 0644, + .proc_handler =3D proc_dointvec_minmax, + .extra1 =3D SYSCTL_ZERO, + .extra2 =3D SYSCTL_ONE, + }, { } }; =20 --=20 2.33.0