diff options
| author | Al Viro <viro@zeniv.linux.org.uk> | 2026-06-02 03:04:44 +0100 |
|---|---|---|
| committer | Christian Brauner <brauner@kernel.org> | 2026-06-02 16:56:27 +0200 |
| commit | 6dd3c6884cd9defb511284b566cef5ac8f657dbf (patch) | |
| tree | b8a59eb17e80e7db9d02896adc78b5b1c0afeadb | |
| parent | 00633c4683828acd5256fa8d5163f440d74bbe71 (diff) | |
| download | linux-6dd3c6884cd9defb511284b566cef5ac8f657dbf.tar.gz linux-6dd3c6884cd9defb511284b566cef5ac8f657dbf.zip | |
mount: honour SB_NOUSER in the new mount API
One should *not* be allowed to mount one of those, new API or not.
Reported-by: Denis Arefev <arefev@swemel.ru>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Link: https://patch.msgid.link/20260602020444.GP2636677@ZenIV
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
| -rw-r--r-- | fs/namespace.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/fs/namespace.c b/fs/namespace.c index d67c2f61b3df..71ae1e9a1266 100644 --- a/fs/namespace.c +++ b/fs/namespace.c @@ -4498,6 +4498,10 @@ SYSCALL_DEFINE3(fsmount, int, fs_fd, unsigned int, flags, new_mnt = vfs_create_mount(fc); if (IS_ERR(new_mnt)) return PTR_ERR(new_mnt); + if (new_mnt->mnt_sb->s_flags & SB_NOUSER) { + mntput(new_mnt); + return -EINVAL; + } new_mnt->mnt_flags = mnt_flags; new_path.dentry = dget(fc->root); |