From: Christian Brauner Date: Wed, 18 Jun 2025 20:53:35 +0000 (+0200) Subject: pidfs: raise SB_I_NODEV and SB_I_NOEXEC X-Git-Tag: block-6.17-20250808~55^2~5^2~15 X-Git-Url: https://git.kernel.dk/?a=commitdiff_plain;h=1a1ad73aa1a66787f05f7f10f686b74bab77be72;p=linux-block.git pidfs: raise SB_I_NODEV and SB_I_NOEXEC Similar to commit 1ed95281c0c7 ("anon_inode: raise SB_I_NODEV and SB_I_NOEXEC"): it shouldn't be possible to execute pidfds via execveat(fd_anon_inode, "", NULL, NULL, AT_EMPTY_PATH) so raise SB_I_NOEXEC so that no one gets any creative ideas. Also raise SB_I_NODEV as we don't expect or support any devices on pidfs. Link: https://lore.kernel.org/20250618-work-pidfs-persistent-v2-1-98f3456fd552@kernel.org Reviewed-by: Alexander Mikhalitsyn Signed-off-by: Christian Brauner --- diff --git a/fs/pidfs.c b/fs/pidfs.c index c1f0a067be40..ff2560b34ed1 100644 --- a/fs/pidfs.c +++ b/fs/pidfs.c @@ -891,6 +891,8 @@ static int pidfs_init_fs_context(struct fs_context *fc) if (!ctx) return -ENOMEM; + fc->s_iflags |= SB_I_NOEXEC; + fc->s_iflags |= SB_I_NODEV; ctx->ops = &pidfs_sops; ctx->eops = &pidfs_export_operations; ctx->dops = &pidfs_dentry_operations;