Unverified Commit bb49e9e7 authored Dec 03, 2021 by Christian Brauner

fs: add is_idmapped_mnt() helper

Multiple places open-code the same check to determine whether a given
mount is idmapped. Introduce a simple helper function that can be used
instead. This allows us to get rid of the fragile open-coding. We will
later change the check that is used to determine whether a given mount
is idmapped. Introducing a helper allows us to do this in a single
place instead of doing it for multiple places.

Link: https://lore.kernel.org/r/20211123114227.3124056-2-brauner@kernel.org (v1)
Link: https://lore.kernel.org/r/20211130121032.3753852-2-brauner@kernel.org (v2)
Link: https://lore.kernel.org/r/20211203111707.3901969-2-brauner@kernel.org


Cc: Seth Forshee <sforshee@digitalocean.com>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Al Viro <viro@zeniv.linux.org.uk>
CC: linux-fsdevel@vger.kernel.org
Reviewed-by: Amir Goldstein <amir73il@gmail.com>
Reviewed-by: Seth Forshee <sforshee@digitalocean.com>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

parent d58071a8

fs/cachefiles/bind.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -117,7 +117,7 @@ static int cachefiles_daemon_add_cache(struct cachefiles_cache *cache)
		root = path.dentry;

		ret = -EINVAL;
		if (mnt_user_ns(path.mnt) != &init_user_ns) {
		if (is_idmapped_mnt(path.mnt)) {
		pr_warn("File cache on idmapped mounts not supported");
		goto error_unsupported;
		}

fs/ecryptfs/main.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -537,7 +537,7 @@ static struct dentry ecryptfs_mount(struct file_system_type fs_type, int flags
		goto out_free;
		}

		if (mnt_user_ns(path.mnt) != &init_user_ns) {
		if (is_idmapped_mnt(path.mnt)) {
		rc = -EINVAL;
		printk(KERN_ERR "Mounting on idmapped mounts currently disallowed\n");
		goto out_free;

fs/namespace.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -3936,7 +3936,7 @@ static int can_idmap_mount(const struct mount_kattr kattr, struct mount mnt)
		* mapping. It makes things simpler and callers can just create
		* another bind-mount they can idmap if they want to.
		*/
		if (mnt_user_ns(m) != &init_user_ns)
		if (is_idmapped_mnt(m))
		return -EPERM;

		/* The underlying filesystem doesn't support idmapped mounts yet. */

fs/nfsd/export.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -427,7 +427,7 @@ static int check_export(struct path path, int flags, unsigned char *uuid)
		return -EINVAL;
		}

		if (mnt_user_ns(path->mnt) != &init_user_ns) {
		if (is_idmapped_mnt(path->mnt)) {
		dprintk("exp_export: export of idmapped mounts not yet supported.\n");
		return -EINVAL;
		}

fs/overlayfs/super.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -873,7 +873,7 @@ static int ovl_mount_dir_noesc(const char name, struct path path)
		pr_err("filesystem on '%s' not supported\n", name);
		goto out_put;
		}
		if (mnt_user_ns(path->mnt) != &init_user_ns) {
		if (is_idmapped_mnt(path->mnt)) {
		pr_err("idmapped layers are currently not supported\n");
		goto out_put;
		}