Eric W. Biederman 7f78e03513 fs: Limit sys_mount to only request filesystem modules. ... Modify the request_module to prefix the file system type with "fs-" and add aliases to all of the filesystems that can be built as modules to match. A common practice is to build all of the kernel code and leave code that is not commonly needed as modules, with the result that many users are exposed to any bug anywhere in the kernel. Looking for filesystems with a fs- prefix limits the pool of possible modules that can be loaded by mount to just filesystems trivially making things safer with no real cost. Using aliases means user space can control the policy of which filesystem modules are auto-loaded by editing /etc/modprobe.d/*.conf with blacklist and alias directives. Allowing simple, safe, well understood work-arounds to known problematic software. This also addresses a rare but unfortunate problem where the filesystem name is not the same as it's module name and module auto-loading would not work. While writing this patch I saw a handful of such cases. The most significant being autofs that lives in the module autofs4. This is relevant to user namespaces because we can reach the request module in get_fs_type() without having any special permissions, and people get uncomfortable when a user specified string (in this case the filesystem type) goes all of the way to request_module. After having looked at this issue I don't think there is any particular reason to perform any filtering or permission checks beyond making it clear in the module request that we want a filesystem module. The common pattern in the kernel is to call request_module() without regards to the users permissions. In general all a filesystem module does once loaded is call register_filesystem() and go to sleep. Which means there is not much attack surface exposed by loading a filesytem module unless the filesystem is mounted. In a user namespace filesystems are not mounted unless .fs_flags = FS_USERNS_MOUNT, which most filesystems do not set today. Acked-by: Serge Hallyn <serge.hallyn@canonical.com> Acked-by: Kees Cook <keescook@chromium.org> Reported-by: Kees Cook <keescook@google.com> Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>		2013-03-03 19:36:31 -08:00
..
Kconfig	fs/xfs: remove depends on CONFIG_EXPERIMENTAL	2013-01-11 11:39:04 -08:00
Makefile	xfs: remove xfs_flushinval_pages	2012-11-14 15:15:08 -06:00
kmem.c	xfs: switch to proper __bitwise type for KM_... flags	2012-05-29 23:28:32 -04:00
kmem.h	xfs: switch to proper __bitwise type for KM_... flags	2012-05-29 23:28:32 -04:00
mrlock.h	…
time.h	…
uuid.c	…
uuid.h	xfs: add CRC infrastructure	2012-11-19 20:11:24 -06:00
xfs.h	…
xfs_acl.c	userns: Pass a userns parameter into posix_acl_to_xattr and posix_acl_from_xattr	2012-09-18 01:01:35 -07:00
xfs_acl.h	…
xfs_ag.h	xfs: convert buffer verifiers to an ops structure.	2012-11-15 21:35:12 -06:00
xfs_alloc.c	xfs: don't zero structure members after a memset(0)	2013-01-03 16:00:07 -06:00
xfs_alloc.h	xfs: convert buffer verifiers to an ops structure.	2012-11-15 21:35:12 -06:00
xfs_alloc_btree.c	xfs: convert buffer verifiers to an ops structure.	2012-11-15 21:35:12 -06:00
xfs_alloc_btree.h	xfs: convert buffer verifiers to an ops structure.	2012-11-15 21:35:12 -06:00
xfs_aops.c	xfs: Fix possible use-after-free with AIO	2013-01-26 09:43:58 -06:00
xfs_aops.h	Prefix IO_XX flags with XFS_IO_XX to avoid namespace colision.	2012-07-22 11:00:55 -05:00
xfs_attr.c	xfs: refactor space log reservation for XFS_TRANS_ATTR_SET	2013-02-01 14:56:31 -06:00
xfs_attr.h	…
xfs_attr_leaf.c	xfs: convert buffer verifiers to an ops structure.	2012-11-15 21:35:12 -06:00
xfs_attr_leaf.h	xfs: convert buffer verifiers to an ops structure.	2012-11-15 21:35:12 -06:00
xfs_attr_sf.h	…
xfs_bit.c	…
xfs_bit.h	…
xfs_bmap.c	xfs: xfs_bmap_add_attrfork_local is too generic	2013-02-14 17:35:51 -06:00
xfs_bmap.h	xfs: move allocation stack switch up to xfs_bmapi_allocate	2012-10-18 17:42:48 -05:00
xfs_bmap_btree.c	xfs: convert buffer verifiers to an ops structure.	2012-11-15 21:35:12 -06:00
xfs_bmap_btree.h	xfs: convert buffer verifiers to an ops structure.	2012-11-15 21:35:12 -06:00
xfs_btree.c	xfs: convert buffer verifiers to an ops structure.	2012-11-15 21:35:12 -06:00
xfs_btree.h	xfs: convert buffer verifiers to an ops structure.	2012-11-15 21:35:12 -06:00
xfs_buf.c	xfs: remove log force from xfs_buf_trylock()	2013-02-14 17:24:53 -06:00
xfs_buf.h	xfs: use b_maps[] for discontiguous buffers	2013-01-16 16:07:11 -06:00
xfs_buf_item.c	xfs: recheck buffer pinned status after push trylock failure	2013-02-14 17:23:42 -06:00
xfs_buf_item.h	xfs: rename bli_format to avoid confusion with bli_formats	2013-01-16 16:07:37 -06:00
xfs_cksum.h	xfs: add CRC infrastructure	2012-11-19 20:11:24 -06:00
xfs_da_btree.c	xfs: convert buffer verifiers to an ops structure.	2012-11-15 21:35:12 -06:00
xfs_da_btree.h	xfs: convert buffer verifiers to an ops structure.	2012-11-15 21:35:12 -06:00
xfs_dfrag.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2013-02-26 20:16:07 -08:00
xfs_dfrag.h	…
xfs_dinode.h	xfs: fix typo in comment of xfs_dinode_t.	2012-06-14 12:28:26 -05:00
xfs_dir2.c	xfs: remove struct xfs_dabuf and infrastructure	2012-07-01 14:50:07 -05:00
xfs_dir2.h	…
xfs_dir2_block.c	xfs: recalculate leaf entry pointer after compacting a dir2 block	2013-01-16 16:08:55 -06:00
xfs_dir2_data.c	xfs: convert buffer verifiers to an ops structure.	2012-11-15 21:35:12 -06:00
xfs_dir2_format.h	…
xfs_dir2_leaf.c	xfs: convert buffer verifiers to an ops structure.	2012-11-15 21:35:12 -06:00
xfs_dir2_node.c	xfs: convert buffer verifiers to an ops structure.	2012-11-15 21:35:12 -06:00
xfs_dir2_priv.h	xfs: convert buffer verifiers to an ops structure.	2012-11-15 21:35:12 -06:00
xfs_dir2_sf.c	xfs: remove struct xfs_dabuf and infrastructure	2012-07-01 14:50:07 -05:00
xfs_discard.c	xfs: check for possible overflow in xfs_ioc_trim	2012-08-23 14:48:44 -05:00
xfs_discard.h	…
xfs_dquot.c	xfs: calculate XFS_TRANS_QM_DQALLOC space log reservation at mount time	2013-02-01 14:43:51 -06:00
xfs_dquot.h	xfs: convert buffer verifiers to an ops structure.	2012-11-15 21:35:12 -06:00
xfs_dquot_item.c	xfs: clean up xfs_bit.h includes	2012-05-14 16:21:00 -05:00
xfs_dquot_item.h	…
xfs_error.c	xfs: move xfsagino_t to xfs_types.h	2012-05-14 16:20:54 -05:00
xfs_error.h	…
xfs_export.c	fs: encode_fh: return FILEID_INVALID if invalid fid_type	2013-02-26 02:46:10 -05:00
xfs_export.h	…
xfs_extent_busy.c	xfs: make xfs_extent_busy_trim not static	2012-05-14 16:21:04 -05:00
xfs_extent_busy.h	xfs: make xfs_extent_busy_trim not static	2012-05-14 16:21:04 -05:00
xfs_extfree_item.c	xfs: move xfsagino_t to xfs_types.h	2012-05-14 16:20:54 -05:00
xfs_extfree_item.h	…
xfs_file.c	new helper: file_inode(file)	2013-02-22 23:31:31 -05:00
xfs_filestream.c	…
xfs_filestream.h	…
xfs_fs.h	xfs: add minimum file size filtering to eofblocks scan	2012-11-08 15:32:29 -06:00
xfs_fsops.c	xfs: make use of XFS_SB_LOG_RES() at xfs_fs_log_dummy()	2013-02-01 14:55:59 -06:00
xfs_fsops.h	…
xfs_globals.c	xfs: add background scanning to clear eofblocks inodes	2012-11-08 15:34:59 -06:00
xfs_ialloc.c	xfs: don't zero structure members after a memset(0)	2013-01-03 16:00:07 -06:00
xfs_ialloc.h	xfs: convert buffer verifiers to an ops structure.	2012-11-15 21:35:12 -06:00
xfs_ialloc_btree.c	xfs: convert buffer verifiers to an ops structure.	2012-11-15 21:35:12 -06:00
xfs_ialloc_btree.h	xfs: convert buffer verifiers to an ops structure.	2012-11-15 21:35:12 -06:00
xfs_icache.c	xfs: add background scanning to clear eofblocks inodes	2012-11-08 15:34:59 -06:00
xfs_icache.h	xfs: add background scanning to clear eofblocks inodes	2012-11-08 15:34:59 -06:00
xfs_inode.c	xfs remove the XFS_TRANS_DEBUG routines	2012-12-17 16:29:00 -06:00
xfs_inode.h	xfs: memory barrier before wake_up_bit()	2013-02-07 09:39:48 -06:00
xfs_inode_item.c	xfs remove the XFS_TRANS_DEBUG routines	2012-12-17 16:29:00 -06:00
xfs_inode_item.h	xfs remove the XFS_TRANS_DEBUG routines	2012-12-17 16:29:00 -06:00
xfs_inum.h	xfs: move xfsagino_t to xfs_types.h	2012-05-14 16:20:54 -05:00
xfs_ioctl.c	new helper: file_inode(file)	2013-02-22 23:31:31 -05:00
xfs_ioctl.h	…
xfs_ioctl32.c	new helper: file_inode(file)	2013-02-22 23:31:31 -05:00
xfs_ioctl32.h	…
xfs_iomap.c	xfs: limit speculative prealloc size on sparse files	2013-02-14 17:21:32 -06:00
xfs_iomap.h	…
xfs_iops.c	xfs: remove xfs_flush_pages	2012-11-14 15:12:45 -06:00
xfs_iops.h	…
xfs_itable.c	xfs: convert buffer verifiers to an ops structure.	2012-11-15 21:35:12 -06:00
xfs_itable.h	…
xfs_linux.h	xfs: add CRC infrastructure	2012-11-19 20:11:24 -06:00
xfs_log.c	xfs: fix fs/xfs/xfs_log.c:1740:39: error: 'B_TRUE' undeclared	2013-01-18 15:11:57 -06:00
xfs_log.h	xfs: xfs_quiesce_attr() should quiesce the log like unmount	2012-10-17 13:39:14 -05:00
xfs_log_cil.c	xfs: rename log structure to xlog	2012-06-21 14:21:11 -05:00
xfs_log_priv.h	xfs: fix sparse reported log CRC endian issue	2012-12-03 12:10:59 -06:00
xfs_log_recover.c	hlist: drop the node parameter from iterators	2013-02-27 19:10:24 -08:00
xfs_log_recover.h	…
xfs_message.c	xfs: move xfsagino_t to xfs_types.h	2012-05-14 16:20:54 -05:00
xfs_message.h	…
xfs_mount.c	xfs: make use of XFS_SB_LOG_RES() at xfs_mount_log_sb()	2013-02-01 14:55:08 -06:00
xfs_mount.h	xfs: refactor space log reservation for XFS_TRANS_ATTR_SET	2013-02-01 14:56:31 -06:00
xfs_mru_cache.c	…
xfs_mru_cache.h	…
xfs_qm.c	xfs: calculate xfs_qm_write_sb_changes() space log reservation at mount time	2013-02-01 14:42:32 -06:00
xfs_qm.h	…
xfs_qm_bhv.c	xfs: Remove boolean_t typedef completely.	2013-01-17 17:32:57 -06:00
xfs_qm_syscalls.c	xfs: calculate XFS_TRANS_QM_QUOTAOFF_END space log reservation at mount time	2013-02-01 14:45:50 -06:00
xfs_quota.h	…
xfs_quota_priv.h	…
xfs_quotaops.c	userns: Convert qutoactl	2012-09-18 01:01:39 -07:00
xfs_rename.c	xfs: move xfsagino_t to xfs_types.h	2012-05-14 16:20:54 -05:00
xfs_rtalloc.c	xfs: uncached buffer reads need to return an error	2012-11-15 21:34:05 -06:00
xfs_rtalloc.h	…
xfs_sb.h	xfs: add CRC infrastructure	2012-11-19 20:11:24 -06:00
xfs_stats.c	…
xfs_stats.h	…
xfs_super.c	fs: Limit sys_mount to only request filesystem modules.	2013-03-03 19:36:31 -08:00
xfs_super.h	xfs: xfs_sync_data is redundant.	2012-10-17 12:01:25 -05:00
xfs_sysctl.c	xfs: add background scanning to clear eofblocks inodes	2012-11-08 15:34:59 -06:00
xfs_sysctl.h	xfs: add background scanning to clear eofblocks inodes	2012-11-08 15:34:59 -06:00
xfs_trace.c	xfs: clean up xfs_bit.h includes	2012-05-14 16:21:00 -05:00
xfs_trace.h	xfs: fix shutdown hang on invalid inode during create	2013-01-26 09:34:38 -06:00
xfs_trans.c	xfs: refactor space log reservation for XFS_TRANS_ATTR_SET	2013-02-01 14:56:31 -06:00
xfs_trans.h	xfs: refactor space log reservation for XFS_TRANS_ATTR_SET	2013-02-01 14:56:31 -06:00
xfs_trans_ail.c	xfs remove the XFS_TRANS_DEBUG routines	2012-12-17 16:29:00 -06:00
xfs_trans_buf.c	xfs: fix the multi-segment log buffer format	2013-01-16 16:08:08 -06:00
xfs_trans_dquot.c	xfs: Remove boolean_t typedef completely.	2013-01-17 17:32:57 -06:00
xfs_trans_extfree.c	xfs: move xfsagino_t to xfs_types.h	2012-05-14 16:20:54 -05:00
xfs_trans_inode.c	xfs remove the XFS_TRANS_DEBUG routines	2012-12-17 16:29:00 -06:00
xfs_trans_priv.h	xfs: re-enable xfsaild idle mode and fix associated races	2012-07-29 16:27:57 -05:00
xfs_trans_space.h	…
xfs_types.h	xfs: Remove boolean_t typedef completely.	2013-01-17 17:32:57 -06:00
xfs_utils.c	xfs: remove the alloc_done argument to xfs_dialloc	2012-07-29 16:00:31 -05:00
xfs_utils.h	…
xfs_vnode.h	xfs: remove remaining scraps of struct xfs_iomap	2012-03-15 13:40:16 -05:00
xfs_vnodeops.c	xfs: Remove boolean_t typedef completely.	2013-01-17 17:32:57 -06:00
xfs_vnodeops.h	xfs: byte range granularity for XFS_IOC_ZERO_RANGE	2012-11-29 14:21:46 -06:00
xfs_xattr.c	…