From: Linus Torvalds <torvalds@linux-foundation.org>
Date: Tue, 14 Oct 2014 06:35:01 +0000 (+0200)
Subject: Merge branch 'CVE-2014-7975' of git://git.kernel.org/pub/scm/linux/kernel/git/luto... 
X-Git-Tag: v3.18-rc1~49
X-Git-Url: https://git.kernel.dk/?a=commitdiff_plain;h=0ef3a56b1c466629cd0bf482b09c7b0e5a085bb5;p=linux-2.6-block.git

Merge branch 'CVE-2014-7975' of git://git./linux/kernel/git/luto/linux

Pull do_umount fix from Andy Lutomirski:
 "This fix really ought to be safe.  Inside a mountns owned by a
  non-root user namespace, the namespace root almost always has
  MNT_LOCKED set (if it doesn't, then there's a bug, because rootfs
  could be exposed).  In that case, calling umount on "/" will return
  -EINVAL with or without this patch.

  Outside a userns, this patch will have no effect.  may_mount, required
  by umount, already checks
     ns_capable(current->nsproxy->mnt_ns->user_ns, CAP_SYS_ADMIN)
  so an additional capable(CAP_SYS_ADMIN) check will have no effect.

  That leaves anything that calls umount on "/" in a non-root userns
  while chrooted.  This is the case that is currently broken (it
  remounts ro, which shouldn't be allowed) and that my patch changes to
  -EPERM.  If anything relies on *that*, I'd be surprised"

* 'CVE-2014-7975' of git://git.kernel.org/pub/scm/linux/kernel/git/luto/linux:
  fs: Add a missing permission check to do_umount
---

0ef3a56b1c466629cd0bf482b09c7b0e5a085bb5