From nobody Sat Feb 7 17:55:48 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EE2E738A9DC; Tue, 13 Jan 2026 09:21:14 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768296075; cv=none; b=soiR96W+a0aBlzHtWBPHXT+NOiipRewja+tFavbgoTeQTBoBfzGWQ8fFCb4Y73Orwhiy+k3B4vILHeNIBEetBRpUc3ro42H8zbJqjKVc4kEX4SfRQLpiUf44NqB47Im7HqUSbjQp3JEJIxaumzHeTt40duloqnI8wsMjp3LVN+A= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768296075; c=relaxed/simple; bh=PavkAtGzRbaSgNEDLK6uow9gBM/kII3UVi2ZmzfRCT0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=E7YjYwDICifE0OsxRsGu/Q1Zga9QxbQlK/BRr27zh9IwYzP41cmf10+VK34kfG7oL3qa8Kr3Q7hbBKxHGy0L5G3EAq05UtMHQEy8QgRYZG8tYbQkldbCiyDh3d0o+KBEGc7S86n+k11n/vXUaQGsjpinTSnoQ+cbX4GcyLjI9qg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=XRKCVzmf; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="XRKCVzmf" Received: by smtp.kernel.org (Postfix) with ESMTPSA id A30A3C19423; Tue, 13 Jan 2026 09:21:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1768296073; bh=PavkAtGzRbaSgNEDLK6uow9gBM/kII3UVi2ZmzfRCT0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=XRKCVzmf1euGZ7ZNDRXuahc+Y+sINTE8gd69z3BGCmrlkmYJwed2sn6UiasmwhkNt CsTfOZl5uROd96ps89eXXd6dFDu3d6XBm5mAalFdWBxmXLynJS5vY5rX0WSjx9x8ja AhWTYzGAr50TLq+5zyB/eSzWq4MwF4iX65RC48DEtJCY+X/Ugc8pJ4fp2sYApzbXQf oO5gFnFLhpLLlIXjRanKRDH1tvIUke9S1nCEf0Ar4tfvhB/IUy4ok2OK3r/dh3MAB6 28HvX8+DEVga+8rvMqlObER4qwKwoKH2b9ognl/ttcXrUyLGXT8ryKek1oFhkmwXmu A9IIwJUssBFKw== From: Alexey Gladkov To: Christian Brauner , Dan Klishch Cc: Al Viro , "Eric W . Biederman" , Kees Cook , containers@lists.linux-foundation.org, linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH v7 1/5] docs: proc: add documentation about mount restrictions Date: Tue, 13 Jan 2026 10:20:33 +0100 Message-ID: <654e021422520a7b25df0cc8591b7643519585fa.1768295900.git.legion@kernel.org> X-Mailer: git-send-email 2.52.0 In-Reply-To: References: <20251213050639.735940-1-danilklishch@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" procfs has a number of mounting restrictions that are not documented anywhere. Signed-off-by: Alexey Gladkov --- Documentation/filesystems/proc.rst | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/Documentation/filesystems/proc.rst b/Documentation/filesystems= /proc.rst index 8256e857e2d7..c8864fcbdec7 100644 --- a/Documentation/filesystems/proc.rst +++ b/Documentation/filesystems/proc.rst @@ -52,6 +52,7 @@ fixes/update part 1.1 Stefani Seibold June 9 2009 =20 4 Configuring procfs 4.1 Mount options + 4.2 Mount restrictions =20 5 Filesystem behavior =20 @@ -2410,6 +2411,19 @@ will use the calling process's active pid namespace.= Note that the pid namespace of an existing procfs instance cannot be modified (attempting to= do so will give an `-EBUSY` error). =20 +4.2 Mount restrictions +-------------------------- + +If user namespaces are in use, the kernel additionally checks the instance= s of +procfs available to the mounter and will not allow procfs to be mounted if: + + 1. This mount is not fully visible. + + a. It's root directory is not the root directory of the filesystem. + b. If any file or non-empty procfs directory is hidden by another mou= nt. + + 2. A new mount overrides the readonly option or any option from atime fa= milty. + Chapter 5: Filesystem behavior =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D =20 --=20 2.52.0 From nobody Sat Feb 7 17:55:48 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BB0382DCBF8; Tue, 13 Jan 2026 09:21:18 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768296079; cv=none; b=nVRJh8CE1D3yR+Me1eK4/9HF29k/y/MoIfiDZvtRvbyg23uY7agZjl6Mi6rH9Pmy+BFClaz3scsYqIatz6DVt4Hvx0EqjTU8k56h3H2GMYBnTgTEERRLVamYPzkGrVJm7pgEjCc0lsTcvILMaapW6hMcSS3mllOGClGnHQp3f5w= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768296079; c=relaxed/simple; bh=udmo2LCuIit5b9kJ4na+SmQh196MbKm4OupPlijFkDM=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=bZbOQZ1lVep+9wHueWku/grk25tgc26o8HTuX/uCypfK06qO0m8xqRF5fgYPkWuVaIBPMudLRGChT6O1MqlVTzHh6i07Ylwz/29p1NJwWzvlxJdK9TjgNMqnj/rlAOCboG+cGPJHjlPVbHqOKki2+9j3gDfiPqnKgPMWvPqxx5I= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=XlffVeKu; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="XlffVeKu" Received: by smtp.kernel.org (Postfix) with ESMTPSA id DFB93C116C6; Tue, 13 Jan 2026 09:21:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1768296075; bh=udmo2LCuIit5b9kJ4na+SmQh196MbKm4OupPlijFkDM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=XlffVeKuc7HdJL/E7SL3QSaJxFsCS44zPqOVN9deur/ORmRf4Rqcm7+g6ae9UychK HTCPmEnG7jgYoSCvwTn4s/HTY5nPD9xQ2SuAL6eNvonBBa9oFZEcXQZYlwrDq15ZNp qHtOAJzIJTQfXkbB0z2zKPqkOwRr/6HFAkEbeIfoonfXYwXEcX5cHwOMuSC615+ZNX WbsoT2qUMFgpBp6NIK0LNhfobLM3njY/igW5we+3DPiIXh/UDLC2jEyVcVhcuaPkpt vwCwrn5Wh9JHgcBpyBEGsqHeXZ+J12cdDsXIw6B1ndIIl2hHeuH/qW3uoUIWCUw+DI ZUNo1af/h4Rog== From: Alexey Gladkov To: Christian Brauner , Dan Klishch Cc: Al Viro , "Eric W . Biederman" , Kees Cook , containers@lists.linux-foundation.org, linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH v7 2/5] proc: subset=pid: Show /proc/self/net only for CAP_NET_ADMIN Date: Tue, 13 Jan 2026 10:20:34 +0100 Message-ID: X-Mailer: git-send-email 2.52.0 In-Reply-To: References: <20251213050639.735940-1-danilklishch@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Cache the mounters credentials and allow access to the net directories contingent of the permissions of the mounter of proc. Do not show /proc/self/net when proc is mounted with subset=3Dpid option and the mounter does not have CAP_NET_ADMIN. Signed-off-by: Alexey Gladkov --- fs/proc/proc_net.c | 8 ++++++++ fs/proc/root.c | 5 +++++ include/linux/proc_fs.h | 1 + 3 files changed, 14 insertions(+) diff --git a/fs/proc/proc_net.c b/fs/proc/proc_net.c index 52f0b75cbce2..6e0ccef0169f 100644 --- a/fs/proc/proc_net.c +++ b/fs/proc/proc_net.c @@ -23,6 +23,7 @@ #include #include #include +#include =20 #include "internal.h" =20 @@ -270,6 +271,7 @@ static struct net *get_proc_task_net(struct inode *dir) struct task_struct *task; struct nsproxy *ns; struct net *net =3D NULL; + struct proc_fs_info *fs_info =3D proc_sb_info(dir->i_sb); =20 rcu_read_lock(); task =3D pid_task(proc_pid(dir), PIDTYPE_PID); @@ -282,6 +284,12 @@ static struct net *get_proc_task_net(struct inode *dir) } rcu_read_unlock(); =20 + if (net && (fs_info->pidonly =3D=3D PROC_PIDONLY_ON) && + security_capable(fs_info->mounter_cred, net->user_ns, CAP_NET_ADMIN, = CAP_OPT_NONE) < 0) { + put_net(net); + net =3D NULL; + } + return net; } =20 diff --git a/fs/proc/root.c b/fs/proc/root.c index d8ca41d823e4..ed8a101d09d3 100644 --- a/fs/proc/root.c +++ b/fs/proc/root.c @@ -254,6 +254,7 @@ static int proc_fill_super(struct super_block *s, struc= t fs_context *fc) return -ENOMEM; =20 fs_info->pid_ns =3D get_pid_ns(ctx->pid_ns); + fs_info->mounter_cred =3D get_cred(fc->cred); proc_apply_options(fs_info, fc, current_user_ns()); =20 /* User space would break if executables or devices appear on proc */ @@ -303,6 +304,9 @@ static int proc_reconfigure(struct fs_context *fc) =20 sync_filesystem(sb); =20 + put_cred(fs_info->mounter_cred); + fs_info->mounter_cred =3D get_cred(fc->cred); + proc_apply_options(fs_info, fc, current_user_ns()); return 0; } @@ -350,6 +354,7 @@ static void proc_kill_sb(struct super_block *sb) kill_anon_super(sb); if (fs_info) { put_pid_ns(fs_info->pid_ns); + put_cred(fs_info->mounter_cred); kfree_rcu(fs_info, rcu); } } diff --git a/include/linux/proc_fs.h b/include/linux/proc_fs.h index 19d1c5e5f335..ec123c277d49 100644 --- a/include/linux/proc_fs.h +++ b/include/linux/proc_fs.h @@ -67,6 +67,7 @@ enum proc_pidonly { struct proc_fs_info { struct pid_namespace *pid_ns; kgid_t pid_gid; + const struct cred *mounter_cred; enum proc_hidepid hide_pid; enum proc_pidonly pidonly; struct rcu_head rcu; --=20 2.52.0 From nobody Sat Feb 7 17:55:48 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BF1792E6CC5; Tue, 13 Jan 2026 09:21:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768296079; cv=none; b=nJ9iFj0aqnOTQq66tDo0rMRi318wJyGHo5jl45TqinB69aqmriMztryRs3N4CrgKnGHZwpMJftolQCK6NdS4m/hhCTS7x+S02NJlzX9nNQxNHxDb7iJljcRj2ixK2Nnyy1aau4g9hXBGkPCFBlUrbYMJpwl8+gt+NPEzId3s2Ys= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768296079; c=relaxed/simple; bh=XHQnjvM0LtkUUMR+/A7ZTCIzseY7chbf3e5+hgmW1Kg=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=hnvX9nyJJ6WUUJsLJ4FzgS4yxtTW+ai0NdjL60oApS2JesPm7fWNyCKR83yN3sqCiTYFs/1Phw2tMd3B0RWt1bC496tWA3cUwrmguQoNBSelbXNU5eJ1alJgok3gRXRN+47wGbtFb38MRnKnjwr7Qeak+lCEUF3/joEGB4j3US8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=s1e/n43y; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="s1e/n43y" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2947AC19424; Tue, 13 Jan 2026 09:21:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1768296078; bh=XHQnjvM0LtkUUMR+/A7ZTCIzseY7chbf3e5+hgmW1Kg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=s1e/n43y8suHL4+FUfL7NEup+9/zPDPVam9cC2m1LFw2hnK81E3xjARib1/39Ar5f bPNfoO+smTKUO0hB7S07sGbC3/L9Mfkn3vJryrqeAt9GSTyJFCywm2CNcTsDtxGebP xolOyIA+fTZ8HgNO/udpnawS821IfUxa/xyscb5aylBZD9JfgAINqfzhJW7/qo93tt lno/U6VdH3dGdxZ6etYD/APhSF17KLOL9GxwbmWtex25bBR1TwAp6luKNGhN62kaJk ggKpi2O0WDK5ToMsDTs6ZnymaVh/6PnNBYIql/GOb2iF6MYo/b2wATdwITnwLL35Jr IC6WqWKoawREA== From: Alexey Gladkov To: Christian Brauner , Dan Klishch Cc: Al Viro , "Eric W . Biederman" , Kees Cook , containers@lists.linux-foundation.org, linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH v7 3/5] proc: Disable cancellation of subset=pid option Date: Tue, 13 Jan 2026 10:20:35 +0100 Message-ID: <568a0aec3be26f1f3ee1d10c657b56626d958bc5.1768295900.git.legion@kernel.org> X-Mailer: git-send-email 2.52.0 In-Reply-To: References: <20251213050639.735940-1-danilklishch@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" When procfs is mounted with subset=3Dpid option, where is no way to remount it with this option removed. This is done in order not to make visible what ever was hidden since some checks occur during mount. This patch makes the limitation explicit and prints an error message. Signed-off-by: Alexey Gladkov --- fs/proc/root.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/fs/proc/root.c b/fs/proc/root.c index ed8a101d09d3..b9f33b67cdd6 100644 --- a/fs/proc/root.c +++ b/fs/proc/root.c @@ -223,7 +223,7 @@ static int proc_parse_param(struct fs_context *fc, stru= ct fs_parameter *param) return 0; } =20 -static void proc_apply_options(struct proc_fs_info *fs_info, +static int proc_apply_options(struct proc_fs_info *fs_info, struct fs_context *fc, struct user_namespace *user_ns) { @@ -233,13 +233,17 @@ static void proc_apply_options(struct proc_fs_info *f= s_info, fs_info->pid_gid =3D make_kgid(user_ns, ctx->gid); if (ctx->mask & (1 << Opt_hidepid)) fs_info->hide_pid =3D ctx->hidepid; - if (ctx->mask & (1 << Opt_subset)) + if (ctx->mask & (1 << Opt_subset)) { + if (ctx->pidonly !=3D PROC_PIDONLY_ON && fs_info->pidonly =3D=3D PROC_PI= DONLY_ON) + return invalf(fc, "proc: subset=3Dpid cannot be unset\n"); fs_info->pidonly =3D ctx->pidonly; + } if (ctx->mask & (1 << Opt_pidns) && !WARN_ON_ONCE(fc->purpose =3D=3D FS_CONTEXT_FOR_RECONFIGURE)) { put_pid_ns(fs_info->pid_ns); fs_info->pid_ns =3D get_pid_ns(ctx->pid_ns); } + return 0; } =20 static int proc_fill_super(struct super_block *s, struct fs_context *fc) @@ -255,7 +259,9 @@ static int proc_fill_super(struct super_block *s, struc= t fs_context *fc) =20 fs_info->pid_ns =3D get_pid_ns(ctx->pid_ns); fs_info->mounter_cred =3D get_cred(fc->cred); - proc_apply_options(fs_info, fc, current_user_ns()); + ret =3D proc_apply_options(fs_info, fc, current_user_ns()); + if (ret) + return ret; =20 /* User space would break if executables or devices appear on proc */ s->s_iflags |=3D SB_I_USERNS_VISIBLE | SB_I_NOEXEC | SB_I_NODEV; @@ -307,8 +313,7 @@ static int proc_reconfigure(struct fs_context *fc) put_cred(fs_info->mounter_cred); fs_info->mounter_cred =3D get_cred(fc->cred); =20 - proc_apply_options(fs_info, fc, current_user_ns()); - return 0; + return proc_apply_options(fs_info, fc, current_user_ns()); } =20 static int proc_get_tree(struct fs_context *fc) --=20 2.52.0 From nobody Sat Feb 7 17:55:48 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 12CD2389DEB; Tue, 13 Jan 2026 09:21:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768296086; cv=none; b=fm6m5WTerWhkwnDg8ZW3f989y0AUIP+nnAzwc8MmTXl7FBZr8hTJ/nBFkdxwjW2Gr1i93onBPZ/F9ggyHCKW0l4kFU4XG0u4ygxW1RnN5UN3qNa0L+qRz0EhmnRNp+6BpG3nwcBLEvv64v3o3Z/HNz6trzIbb/aSmDmGOX8+oG0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768296086; c=relaxed/simple; bh=eX+w5EfcvclBT2LFvZ5gN3ESzAkXLUYEfvQmmraqHgg=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=M6y4aN3YpbhjmDcl2mWyHICKEfnnqp/VMUY0xLAaKKPDKjK2QCbDQU2rV36Ajpp9hIbl04bDShx5AdmccoLw8ltltgyDKgKT/DYRYTOSjmUp2M4zmj8hu1yBtg583s04VaUhAoY/C+vwx+6S3l9YyAqRmtSK73f3Y39ojmlZCJ4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=QfDsoafi; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="QfDsoafi" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 66AA6C19423; Tue, 13 Jan 2026 09:21:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1768296080; bh=eX+w5EfcvclBT2LFvZ5gN3ESzAkXLUYEfvQmmraqHgg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=QfDsoafiTkOGF4vw0oyVCqdL7p+zyeEKemegkohPRr79xGLYwKj1x3Ub7Sy41k57h oDem4+PXn44UZFDHb5HOqEjGNb874EnIa5NRZoLUyRrmu+hbnteJftXZ4lh2Fct9nu QSd05NzohgmiidgpF34AFXwU6ydLtgp1phHlYXg36csG3gY92GY+tn/FySfp8QKQNa yqcn3rzn9cxCBjLWiB6ExbllpI8SaGEa7A+bVRAYBEZEyoTniCvoP5JbdfIEG38qs8 U858jrobTnSnUxnXJgaGVy4YZjigGD0id+4QJNhRbEOYgqB7zn4bH71uN6KF/tHXzC 7G1kIgXEeAzCA== From: Alexey Gladkov To: Christian Brauner , Dan Klishch Cc: Al Viro , "Eric W . Biederman" , Kees Cook , containers@lists.linux-foundation.org, linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH v7 4/5] proc: Relax check of mount visibility Date: Tue, 13 Jan 2026 10:20:36 +0100 Message-ID: X-Mailer: git-send-email 2.52.0 In-Reply-To: References: <20251213050639.735940-1-danilklishch@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" When /proc is mounted with the subset=3Dpid option, all system files from the root of the file system are not accessible in userspace. Only dynamic information about processes is available, which cannot be hidden with overmount. For this reason, checking for full visibility is not relevant if mounting is performed with the subset=3Dpid option. Signed-off-by: Alexey Gladkov --- fs/namespace.c | 29 ++++++++++++++++------------- fs/proc/root.c | 16 ++++++++++------ include/linux/fs/super_types.h | 2 ++ 3 files changed, 28 insertions(+), 19 deletions(-) diff --git a/fs/namespace.c b/fs/namespace.c index c58674a20cad..7daa86315c05 100644 --- a/fs/namespace.c +++ b/fs/namespace.c @@ -6116,7 +6116,8 @@ static bool mnt_already_visible(struct mnt_namespace = *ns, /* This mount is not fully visible if it's root directory * is not the root directory of the filesystem. */ - if (mnt->mnt.mnt_root !=3D mnt->mnt.mnt_sb->s_root) + if (!(sb->s_iflags & SB_I_USERNS_ALLOW_REVEALING) && + mnt->mnt.mnt_root !=3D mnt->mnt.mnt_sb->s_root) continue; =20 /* A local view of the mount flags */ @@ -6136,18 +6137,20 @@ static bool mnt_already_visible(struct mnt_namespac= e *ns, ((mnt_flags & MNT_ATIME_MASK) !=3D (new_flags & MNT_ATIME_MASK))) continue; =20 - /* This mount is not fully visible if there are any - * locked child mounts that cover anything except for - * empty directories. - */ - list_for_each_entry(child, &mnt->mnt_mounts, mnt_child) { - struct inode *inode =3D child->mnt_mountpoint->d_inode; - /* Only worry about locked mounts */ - if (!(child->mnt.mnt_flags & MNT_LOCKED)) - continue; - /* Is the directory permanently empty? */ - if (!is_empty_dir_inode(inode)) - goto next; + if (!(sb->s_iflags & SB_I_USERNS_ALLOW_REVEALING)) { + /* This mount is not fully visible if there are any + * locked child mounts that cover anything except for + * empty directories. + */ + list_for_each_entry(child, &mnt->mnt_mounts, mnt_child) { + struct inode *inode =3D child->mnt_mountpoint->d_inode; + /* Only worry about locked mounts */ + if (!IS_MNT_LOCKED(child)) + continue; + /* Is the directory permanently empty? */ + if (!is_empty_dir_inode(inode)) + goto next; + } } /* Preserve the locked attributes */ *new_mnt_flags |=3D mnt_flags & (MNT_LOCK_READONLY | \ diff --git a/fs/proc/root.c b/fs/proc/root.c index b9f33b67cdd6..354dc13417e3 100644 --- a/fs/proc/root.c +++ b/fs/proc/root.c @@ -223,18 +223,21 @@ static int proc_parse_param(struct fs_context *fc, st= ruct fs_parameter *param) return 0; } =20 -static int proc_apply_options(struct proc_fs_info *fs_info, +static int proc_apply_options(struct super_block *s, struct fs_context *fc, struct user_namespace *user_ns) { struct proc_fs_context *ctx =3D fc->fs_private; + struct proc_fs_info *fs_info =3D proc_sb_info(s); =20 if (ctx->mask & (1 << Opt_gid)) fs_info->pid_gid =3D make_kgid(user_ns, ctx->gid); if (ctx->mask & (1 << Opt_hidepid)) fs_info->hide_pid =3D ctx->hidepid; if (ctx->mask & (1 << Opt_subset)) { - if (ctx->pidonly !=3D PROC_PIDONLY_ON && fs_info->pidonly =3D=3D PROC_PI= DONLY_ON) + if (ctx->pidonly =3D=3D PROC_PIDONLY_ON) + s->s_iflags |=3D SB_I_USERNS_ALLOW_REVEALING; + else if (fs_info->pidonly =3D=3D PROC_PIDONLY_ON) return invalf(fc, "proc: subset=3Dpid cannot be unset\n"); fs_info->pidonly =3D ctx->pidonly; } @@ -259,9 +262,6 @@ static int proc_fill_super(struct super_block *s, struc= t fs_context *fc) =20 fs_info->pid_ns =3D get_pid_ns(ctx->pid_ns); fs_info->mounter_cred =3D get_cred(fc->cred); - ret =3D proc_apply_options(fs_info, fc, current_user_ns()); - if (ret) - return ret; =20 /* User space would break if executables or devices appear on proc */ s->s_iflags |=3D SB_I_USERNS_VISIBLE | SB_I_NOEXEC | SB_I_NODEV; @@ -273,6 +273,10 @@ static int proc_fill_super(struct super_block *s, stru= ct fs_context *fc) s->s_time_gran =3D 1; s->s_fs_info =3D fs_info; =20 + ret =3D proc_apply_options(s, fc, current_user_ns()); + if (ret) + return ret; + /* * procfs isn't actually a stacking filesystem; however, there is * too much magic going on inside it to permit stacking things on @@ -313,7 +317,7 @@ static int proc_reconfigure(struct fs_context *fc) put_cred(fs_info->mounter_cred); fs_info->mounter_cred =3D get_cred(fc->cred); =20 - return proc_apply_options(fs_info, fc, current_user_ns()); + return proc_apply_options(sb, fc, current_user_ns()); } =20 static int proc_get_tree(struct fs_context *fc) diff --git a/include/linux/fs/super_types.h b/include/linux/fs/super_types.h index 6bd3009e09b3..5e640b9140df 100644 --- a/include/linux/fs/super_types.h +++ b/include/linux/fs/super_types.h @@ -333,4 +333,6 @@ struct super_block { #define SB_I_NOIDMAP 0x00002000 /* No idmapped mounts on this superblock */ #define SB_I_ALLOW_HSM 0x00004000 /* Allow HSM events on this superblock */ =20 +#define SB_I_USERNS_ALLOW_REVEALING 0x00008000 /* Skip full visibility che= ck */ + #endif /* _LINUX_FS_SUPER_TYPES_H */ --=20 2.52.0 From nobody Sat Feb 7 17:55:48 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 12E84389E01; Tue, 13 Jan 2026 09:21:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768296086; cv=none; b=dlm4w1/7hX77Bc5oF3Zh8j6ODcYTf02POU7NoTtGQYoaXQmzeUXU5sh3V/+09DbJhtQQNjDvTHj4ZBDKQ/ymfzYb0nMeK54GKN6gE64rft+LNR900Dz6AfXwoEd2tW+fgZNu8RGTWFumzKhGNIWLMp18JM6271BFpx8KL8FDwWY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768296086; c=relaxed/simple; bh=ROVKdQmr+DawgPpCxGcE1IpjtvRSKTzHsnNOpgWpY9E=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=oIHxEa9vPz8Ut6J10nRh/vBdMzWjZzTr94p9mCPnBW+5gGE1MvihdwqG+UhEk6DgBlAlWc230+xC3YfNluU2hsjrytAKyoU320uawx+1GBTofncIHYTx/jOZ8gbWmaZQi9kz/JDkI3BDe4HE91goP5grD1BV7tw2xCESpDY52FI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=XKeGm3Z3; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="XKeGm3Z3" Received: by smtp.kernel.org (Postfix) with ESMTPSA id A39F7C19422; Tue, 13 Jan 2026 09:21:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1768296082; bh=ROVKdQmr+DawgPpCxGcE1IpjtvRSKTzHsnNOpgWpY9E=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=XKeGm3Z37swapz8yNgLzUItd/+DekYmVc63BE1ZBTbzbWTbnVUm2+nank76dYy72d 9XjcP5DCtOdb8LTREGlnqsQHy43V73VlZOQgD46419Su7zAXcs3w4mGdmVERkmh/Fk AALmm4tTutZESfelEfh1dfiaQycBPZZDO49oOBCzaC2QvFvStEJgx7nLFjPNgzUN2O pmz0AgmR2pYLY2KtulJZmqOQH8UVl6sbOn/AnjcsNwQp0rYZ5ijlHXy1fPsr4IQQuB NbSfHt990gCQI0Q5PxDz/8hF/YTMHjomYx48zuI3XCwUrhEeX3FeIp6xWhS+KGdbOs 0v2I8CiG+l4DQ== From: Alexey Gladkov To: Christian Brauner , Dan Klishch Cc: Al Viro , "Eric W . Biederman" , Kees Cook , containers@lists.linux-foundation.org, linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH v7 5/5] docs: proc: add documentation about relaxing visibility restrictions Date: Tue, 13 Jan 2026 10:20:37 +0100 Message-ID: X-Mailer: git-send-email 2.52.0 In-Reply-To: References: <20251213050639.735940-1-danilklishch@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Signed-off-by: Alexey Gladkov --- Documentation/filesystems/proc.rst | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/Documentation/filesystems/proc.rst b/Documentation/filesystems= /proc.rst index c8864fcbdec7..3acf178c1202 100644 --- a/Documentation/filesystems/proc.rst +++ b/Documentation/filesystems/proc.rst @@ -2417,7 +2417,8 @@ so will give an `-EBUSY` error). If user namespaces are in use, the kernel additionally checks the instance= s of procfs available to the mounter and will not allow procfs to be mounted if: =20 - 1. This mount is not fully visible. + 1. This mount is not fully visible unless the new procfs is going to be + mounted with subset=3Dpid option. =20 a. It's root directory is not the root directory of the filesystem. b. If any file or non-empty procfs directory is hidden by another mou= nt. --=20 2.52.0