[ebiederm at xmission.com: [REVIEW][PATCH 3/3] vfs: Fix a regression in mounting proc]

[Serge Hallyn]

Hi,

This is the second patch needed in trusty's kernel for containers.  It
is in
https://git.kernel.org/cgit/linux/kernel/git/ebiederm/user-namespace.git/log/?h=for-next
(and I assume linux-next).  This fixes a regression recently introduced
which prevents using user namespaces for containers.

----- Forwarded message from "Eric W. Biederman" <ebiederm at xmission.com> -----

Date: Tue, 26 Nov 2013 16:17:36 -0800
From: "Eric W. Biederman" <ebiederm at xmission.com>
To: "Serge E. Hallyn" <serge at hallyn.com>
Cc: Gao feng <gaofeng at cn.fujitsu.com>, Containers <containers at lists.linux-foundation.org>,
	linux-fsdevel at vger.kernel.org, Aditya Kali <adityakali at google.com>, Oleg Nesterov
	<oleg at redhat.com>, Andy Lutomirski <luto at amacapital.net>
Subject: [REVIEW][PATCH 3/3] vfs: Fix a regression in mounting proc


Gao feng <gaofeng at cn.fujitsu.com> reported that commit
e51db73532955dc5eaba4235e62b74b460709d5b
userns: Better restrictions on when proc and sysfs can be mounted
caused a regression on mounting a new instance of proc in a mount
namespace created with user namespace privileges, when binfmt_misc
is mounted on /proc/sys/fs/binfmt_misc.

This is an unintended regression caused by the absolutely bogus empty
directory check in fs_fully_visible.  The check fs_fully_visible replaced
didn't even bother to attempt to verify proc was fully visible and
hiding proc files with any kind of mount is rare.  So for now fix
the userspace regression by allowing directory with nlink == 1
as /proc/sys/fs/binfmt_misc has.

I will have a better patch but it is not stable material, or
last minute kernel material.  So it will have to wait.

Cc: stable at vger.kernel.org
Signed-off-by: "Eric W. Biederman" <ebiederm at xmission.com>
---
 fs/namespace.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/fs/namespace.c b/fs/namespace.c
index ac2ce8a766e1..be32ebccdeb1 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -2886,7 +2886,7 @@ bool fs_fully_visible(struct file_system_type *type)
 			struct inode *inode = child->mnt_mountpoint->d_inode;
 			if (!S_ISDIR(inode->i_mode))
 				goto next;
-			if (inode->i_nlink != 2)
+			if (inode->i_nlink > 2)
 				goto next;
 		}
 		visible = true;
-- 
1.7.5.4

----- End forwarded message -----