introduce a uid/gid shifting bind mount

Submitted by James Bottomley on Jan. 4, 2020, 8:39 p.m.

Details

Reviewer None
Submitted Jan. 4, 2020, 8:39 p.m.
Last Updated Feb. 18, 2020, 7:59 a.m.
Revision 2

Cover Letter

The object of this series is to replace shiftfs with a proper uid/gid
shifting bind mount instead of the shiftfs hack of introducing
something that looks similar to an overlay filesystem to do it.

The VFS still has the problem that in order to tell what vfsmount a
dentry belongs to, struct path would have to be threaded everywhere
struct dentry currently is.  However, this patch is structured only to
require a rethreading of notify_change.  The rest of the knowledge
that a shift is in operation is carried in the task structure by
caching the unshifted credentials.

Note that although it is currently dependent on the new configfd
interface for bind mounts, only patch 3/3 relies on this, and the
whole thing could be redone as a syscall or any other mechanism
(depending on how people eventually want to fix the problem with the
new fsconfig mechanism being unable to reconfigure bind mounts).

The changes from v2 are I've added Amir's reviewed-by for the
notify_change rethreading and I've implemented Serge's request for a
base offset shift for the image.  It turned out to be much harder to
implement a simple linear shift than simply to do it through a
different userns, so that's how I've done it.  The userns you need to
set up for the offset shifted image is one where the interior uid
would see the shifted image as fake root.  I've introduced an
additional "ns" config parameter, which must be specified when
building the allow shift mount point (so it's done by the admin, not
by the unprivileged user).  I've also taken care that the image
shifted to zero (real root) is never visible in the filesystem.  Patch
3/3 explains how to use the additional "ns" parameter.

James

---

James Bottomley (3):
  fs: rethread notify_change to take a path instead of a dentry
  fs: introduce uid/gid shifting bind mount
  fs: expose shifting bind mount to userspace

 drivers/base/devtmpfs.c   |   8 ++-
 fs/attr.c                 | 131 ++++++++++++++++++++++++++++++++++++++--------
 fs/bind.c                 | 105 +++++++++++++++++++++++++++++++++----
 fs/cachefiles/interface.c |   6 ++-
 fs/coredump.c             |   4 +-
 fs/ecryptfs/inode.c       |   9 ++--
 fs/exec.c                 |   3 +-
 fs/inode.c                |  17 +++---
 fs/internal.h             |   2 +
 fs/mount.h                |   3 ++
 fs/namei.c                | 114 +++++++++++++++++++++++++++++++++-------
 fs/namespace.c            |   6 +++
 fs/nfsd/vfs.c             |  13 +++--
 fs/open.c                 |  44 ++++++++++++----
 fs/overlayfs/copy_up.c    |  40 ++++++++------
 fs/overlayfs/dir.c        |  10 +++-
 fs/overlayfs/inode.c      |   6 ++-
 fs/overlayfs/overlayfs.h  |   2 +-
 fs/overlayfs/super.c      |   3 +-
 fs/posix_acl.c            |   4 +-
 fs/proc_namespace.c       |   4 ++
 fs/stat.c                 |  32 +++++++++--
 fs/utimes.c               |   2 +-
 include/linux/cred.h      |  12 +++++
 include/linux/fs.h        |   7 ++-
 include/linux/mount.h     |   4 +-
 include/linux/sched.h     |   5 ++
 kernel/capability.c       |   9 +++-
 kernel/cred.c             |  20 +++++++
 29 files changed, 507 insertions(+), 118 deletions(-)
  

Revisions