OPEN_TREE_NAMESPACE and FSMOUNT_NAMESPACE create a mount namespace without going through unshare(). A task of a cell could not enter such a namespace, but it should not be able to create namespaces in the first place. Refuse both flags for a task of a cell. Signed-off-by: Josef Bacik --- fs/namespace.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/fs/namespace.c b/fs/namespace.c index 7298b589e10e..30167f8863bf 100644 --- a/fs/namespace.c +++ b/fs/namespace.c @@ -3353,6 +3353,9 @@ static struct file *vfs_open_tree(int dfd, const char __user *filename, unsigned * just care about being privileged over our current user namespace. * The new mount namespace will be owned by it. */ + if ((flags & OPEN_TREE_NAMESPACE) && current_cell()) + return ERR_PTR(-EPERM); + if ((flags & OPEN_TREE_NAMESPACE) && !ns_capable(current_user_ns(), CAP_SYS_ADMIN)) return ERR_PTR(-EPERM); @@ -4622,6 +4625,9 @@ SYSCALL_DEFINE3(fsmount, int, fs_fd, unsigned int, flags, if ((flags & ~(FSMOUNT_CLOEXEC | FSMOUNT_NAMESPACE)) != 0) return -EINVAL; + if ((flags & FSMOUNT_NAMESPACE) && current_cell()) + return -EPERM; + if ((flags & FSMOUNT_NAMESPACE) && !ns_capable(current_user_ns(), CAP_SYS_ADMIN)) return -EPERM; -- 2.55.0