]> git.proxmox.com Git - mirror_ubuntu-disco-kernel.git/commit
sysfs: Restrict mounting sysfs
authorEric W. Biederman <ebiederm@xmission.com>
Tue, 26 Mar 2013 03:07:01 +0000 (20:07 -0700)
committerEric W. Biederman <ebiederm@xmission.com>
Thu, 29 Aug 2013 04:35:14 +0000 (21:35 -0700)
commit7dc5dbc879bd0779924b5132a48b731a0bc04a1e
treebcae7323006aa19fc91c27fdb156667c9a061809
parente51db73532955dc5eaba4235e62b74b460709d5b
sysfs: Restrict mounting sysfs

Don't allow mounting sysfs unless the caller has CAP_SYS_ADMIN rights
over the net namespace.  The principle here is if you create or have
capabilities over it you can mount it, otherwise you get to live with
what other people have mounted.

Instead of testing this with a straight forward ns_capable call,
perform this check the long and torturous way with kobject helpers,
this keeps direct knowledge of namespaces out of sysfs, and preserves
the existing sysfs abstractions.

Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
fs/sysfs/mount.c
include/linux/kobject_ns.h
lib/kobject.c
net/core/net-sysfs.c