[PATCH RFC v3 48/90] fs: refuse a task of a cell a new mount namespace

[Josef Bacik]

OPEN_TREE_NAMESPACE and FSMOUNT_NAMESPACE create a mount namespace without
going through unshare(). A task of a cell could not enter such a
namespace, but it should not be able to create namespaces in the first
place. Refuse both flags for a task of a cell.

Signed-off-by: Josef Bacik <josef@xxxxxxxxxxxxxx>
---
 fs/namespace.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/fs/namespace.c b/fs/namespace.c
index 7298b589e10e..30167f8863bf 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -3353,6 +3353,9 @@ static struct file *vfs_open_tree(int dfd, const char __user *filename, unsigned
 	 * just care about being privileged over our current user namespace.
 	 * The new mount namespace will be owned by it.
 	 */
+	if ((flags & OPEN_TREE_NAMESPACE) && current_cell())
+		return ERR_PTR(-EPERM);
+
 	if ((flags & OPEN_TREE_NAMESPACE) &&
 	    !ns_capable(current_user_ns(), CAP_SYS_ADMIN))
 		return ERR_PTR(-EPERM);
@@ -4622,6 +4625,9 @@ SYSCALL_DEFINE3(fsmount, int, fs_fd, unsigned int, flags,
 	if ((flags & ~(FSMOUNT_CLOEXEC | FSMOUNT_NAMESPACE)) != 0)
 		return -EINVAL;
 
+	if ((flags & FSMOUNT_NAMESPACE) && current_cell())
+		return -EPERM;
+
 	if ((flags & FSMOUNT_NAMESPACE) &&
 	    !ns_capable(current_user_ns(), CAP_SYS_ADMIN))
 		return -EPERM;

-- 
2.55.0