fix(namespace): lock cross-user mount copies (#2128)

Downgrade shared mounts to slaves when a mount namespace is copied into a different user namespace, and preserve Linux-style topology and per-mount attribute locks across copies and propagation.

Require CAP_SYS_ADMIN in the superblock owner user namespace before ordinary remounts can reconfigure shared filesystem state. Keep bind remounts scoped to per-mount flags.

Prepare peer and slave registry capacity before publishing copied mounts so allocation failures cannot expose partial propagation state. Add focused failure-injection and dunitest coverage for ordering, propagation direction, locked attributes, remount permissions, and nested copies.

Closes #2103

Signed-off-by: longjin <longjin@dragonos.org>

Author: fslongjin

kernel/src/filesystem/vfs/mount/mod.rs

@@ -30,6 +30,7 @@ use crate::{
                 prepare_mount_propagation_locked, propagate_umount_sources,
                 propagation_umount_busy, MountPropagation,
             },
+            user_namespace::UserNamespace,
         },
         ProcessManager,
     },
@@ -45,7 +46,7 @@ use core::{
     cell::RefCell,
     fmt::Debug,
     hash::Hash,
-    sync::atomic::{compiler_fence, AtomicBool, AtomicUsize, Ordering},
+    sync::atomic::{compiler_fence, AtomicBool, AtomicU32, AtomicUsize, Ordering},
 };
 use hashbrown::HashMap;
 use ida::IdAllocator;
@@ -282,6 +283,23 @@ impl MountFlags {
     }
 }
 
+bitflags! {
+    /// Internal per-mount locks corresponding to Linux `MNT_LOCK_*` flags.
+    ///
+    /// These are deliberately separate from userspace-visible `MS_*` flags:
+    /// topology locking and attribute locking have different lifetimes. In
+    /// particular, a mount propagated across a user-namespace boundary may
+    /// have its topology lock cleared while retaining all attribute locks.
+    struct MountLockFlags: u32 {
+        const TOPOLOGY = 1 << 0;
+        const ATIME = 1 << 1;
+        const READONLY = 1 << 2;
+        const NODEV = 1 << 3;
+        const NOSUID = 1 << 4;
+        const NOEXEC = 1 << 5;
+    }
+}
+
 pub(crate) fn append_comma_options(base: &mut String, extra: String) {
     if extra.is_empty() {
         return;
@@ -357,8 +375,8 @@ pub struct MountFS {
     mount_flags: RwSem<MountFlags>,
     super_block_state: Arc<SuperBlockState>,
     mount_source: RwSem<Option<String>>,
-    /// Internal MNT_LOCKED equivalent; never exposed as a userspace MS_* bit.
-    locked: AtomicBool,
+    /// Internal `MNT_LOCK_*` state; never exposed as userspace `MS_*` bits.
+    mount_locks: AtomicU32,
     lifecycle: Mutex<MountLifecycle>,
 }
 
@@ -520,6 +538,9 @@ unsafe impl Sync for MountExternalGuard {}
 
 #[derive(Debug)]
 pub struct SuperBlockState {
+    /// User namespace that owns this superblock, matching Linux `s_user_ns`.
+    /// Bind mounts and mount-namespace copies retain the same owner.
+    owner_user_ns: Arc<UserNamespace>,
     flags: RwSem<MountFlags>,
     write_count: AtomicUsize,
     wb_error: ErrSeq,
@@ -696,6 +717,7 @@ struct MountStateInit {
 impl SuperBlockState {
     pub fn new(flags: MountFlags) -> Self {
         Self {
+            owner_user_ns: ProcessManager::current_user_ns(),
             flags: RwSem::new(flags & MountFlags::SB_SETTABLE_MASK),
             write_count: AtomicUsize::new(0),
             wb_error: ErrSeq::new(),
@@ -712,6 +734,10 @@ impl SuperBlockState {
         }
     }
 
+    pub fn owner_user_ns(&self) -> &Arc<UserNamespace> {
+        &self.owner_user_ns
+    }
+
     fn activate_mount(&self, construction_reserved: bool) -> Result<(), SystemError> {
         let mut lifecycle = self.lifecycle.lock();
         if lifecycle.state != SuperBlockLifecycleState::Active {
@@ -1117,7 +1143,7 @@ impl MountFS {
             mount_flags: RwSem::new(mount_flags),
             super_block_state: state_init.super_block_state,
             mount_source: RwSem::new(state_init.mount_source),
-            locked: AtomicBool::new(false),
+            mount_locks: AtomicU32::new(0),
             lifecycle: Mutex::new(MountLifecycle {
                 state: MountLifecycleState::Constructing,
                 external_pins: 0,
@@ -1162,7 +1188,7 @@ impl MountFS {
             mount_flags: RwSem::new(self.mount_flags()),
             super_block_state: self.super_block_state.clone(),
             mount_source: RwSem::new(mount_source),
-            locked: AtomicBool::new(self.locked.load(Ordering::Acquire)),
+            mount_locks: AtomicU32::new(self.mount_locks.load(Ordering::Acquire)),
             lifecycle: Mutex::new(MountLifecycle {
                 state: MountLifecycleState::Constructing,
                 external_pins: 0,
@@ -1793,15 +1819,61 @@ impl MountFS {
     }
 
     pub(crate) fn lock_mount(&self) {
-        self.locked.store(true, Ordering::Release);
+        self.mount_locks
+            .fetch_or(MountLockFlags::TOPOLOGY.bits(), Ordering::Release);
     }
 
     pub(crate) fn unlock_mount(&self) {
-        self.locked.store(false, Ordering::Release);
+        self.mount_locks
+            .fetch_and(!MountLockFlags::TOPOLOGY.bits(), Ordering::Release);
     }
 
     pub(crate) fn is_locked(&self) -> bool {
-        self.locked.load(Ordering::Acquire)
+        self.mount_locks.load(Ordering::Acquire) & MountLockFlags::TOPOLOGY.bits() != 0
+    }
+
+    /// Linux `lock_mnt_tree()` semantics for mounts copied across a user
+    /// namespace boundary. Attribute locks snapshot per-mount flags only;
+    /// superblock flags have separate ownership and reconfiguration rules.
+    pub(crate) fn lock_cross_user_mount(&self) {
+        let mount_flags = self.mount_flags();
+        let mut locks = MountLockFlags::TOPOLOGY | MountLockFlags::ATIME;
+        if mount_flags.contains(MountFlags::RDONLY) {
+            locks.insert(MountLockFlags::READONLY);
+        }
+        if mount_flags.contains(MountFlags::NODEV) {
+            locks.insert(MountLockFlags::NODEV);
+        }
+        if mount_flags.contains(MountFlags::NOSUID) {
+            locks.insert(MountLockFlags::NOSUID);
+        }
+        if mount_flags.contains(MountFlags::NOEXEC) {
+            locks.insert(MountLockFlags::NOEXEC);
+        }
+        self.mount_locks.fetch_or(locks.bits(), Ordering::Release);
+    }
+
+    /// Linux `can_change_locked_flags()` equivalent for remount admission.
+    /// Locks prevent relaxing attributes that were present at lock time and
+    /// prevent changing the atime policy, while still allowing stricter flags
+    /// that were not locked to be added.
+    pub(crate) fn can_reconfigure_mount_flags(&self, requested: MountFlags) -> bool {
+        let locks = MountLockFlags::from_bits_truncate(self.mount_locks.load(Ordering::Acquire));
+        if locks.contains(MountLockFlags::READONLY) && !requested.contains(MountFlags::RDONLY) {
+            return false;
+        }
+        if locks.contains(MountLockFlags::NODEV) && !requested.contains(MountFlags::NODEV) {
+            return false;
+        }
+        if locks.contains(MountLockFlags::NOSUID) && !requested.contains(MountFlags::NOSUID) {
+            return false;
+        }
+        if locks.contains(MountLockFlags::NOEXEC) && !requested.contains(MountFlags::NOEXEC) {
+            return false;
+        }
+        !locks.contains(MountLockFlags::ATIME)
+            || (self.mount_flags() & MountFlags::MNT_ATIME_MASK)
+                == (requested & MountFlags::MNT_ATIME_MASK)
     }
 
     #[inline(never)]
@@ -2021,6 +2093,11 @@ impl MountFS {
         self.lifecycle.lock().external_pins != 0
     }
 
+    #[cfg(test)]
+    pub(crate) fn superblock_external_pin_count(&self) -> usize {
+        self.super_block_state.lifecycle.lock().external_pins
+    }
+
     pub(crate) fn subtree_has_external_pins(&self) -> bool {
         let mut pending = vec![self.self_ref()];
         while let Some(mount) = pending.pop() {

kernel/src/filesystem/vfs/syscall/sys_mount.rs

@@ -324,6 +324,9 @@ fn do_reconfigure_bind_mount(
     if !target_mfs.is_live() || !target_mfs.is_belongs_to_mntns(&current_mntns) {
         return Err(SystemError::EINVAL);
     }
+    if !target_mfs.can_reconfigure_mount_flags(requested_flags) {
+        return Err(SystemError::EPERM);
+    }
     target_mfs.update_mount_flags(|mount_flags| {
         let preserved = *mount_flags & !MountFlags::MNT_USER_SETTABLE_MASK;
         let new_settable = requested_flags & MountFlags::MNT_USER_SETTABLE_MASK;
@@ -366,9 +369,17 @@ fn do_remount(
         if !target_mfs.is_live() || !target_mfs.is_belongs_to_mntns(&current_mntns) {
             return Err(SystemError::EINVAL);
         }
+        if !target_mfs.can_reconfigure_mount_flags(requested_mnt_flags) {
+            return Err(SystemError::EPERM);
+        }
     }
     let old_sb_flags = target_mfs.super_block_flags();
     let (data_sb_flags, data_sb_flags_mask, fs_private_data) = parse_remount_data(data.as_deref())?;
+    // Linux do_remount() requires CAP_SYS_ADMIN in sb->s_user_ns before a
+    // legacy remount may change shared superblock or filesystem-private state.
+    if !ns_capable(super_block_state.owner_user_ns(), CAPFlags::CAP_SYS_ADMIN) {
+        return Err(SystemError::EPERM);
+    }
     let sb_flags_mask = MountFlags::RMT_MASK | data_sb_flags_mask;
     let requested_sb_flags = (requested_sb_flags & !data_sb_flags_mask) | data_sb_flags;
     let new_sb_flags = (old_sb_flags & !sb_flags_mask) | (requested_sb_flags & sb_flags_mask);

kernel/src/process/namespace/mnt.rs

@@ -17,8 +17,7 @@ use super::{
     nsproxy::NsCommon,
     propagation::{
         abort_moved_tree_propagation_locked, commit_moved_tree_propagation_locked,
-        prepare_moved_tree_propagation_locked, register_peer, register_slave_with_master,
-        MountPropagation,
+        prepare_moved_tree_propagation_locked, MountPropagation, PreparedRegistrations,
     },
     user_namespace::UserNamespace,
     NamespaceOps,
@@ -29,6 +28,10 @@ static mut INIT_MNT_NAMESPACE: Option<Arc<MntNamespace>> = None;
 const DEFAULT_MOUNT_MAX: u32 = 100_000;
 static MOUNT_MAX: AtomicU32 = AtomicU32::new(DEFAULT_MOUNT_MAX);
 
+#[cfg(test)]
+static FAIL_COPY_REGISTRATION_PREPARE: core::sync::atomic::AtomicBool =
+    core::sync::atomic::AtomicBool::new(false);
+
 pub fn mount_max() -> u32 {
     MOUNT_MAX.load(Ordering::Relaxed)
 }
@@ -569,6 +572,20 @@ impl MntNamespace {
             }
         };
 
+        #[cfg(test)]
+        if FAIL_COPY_REGISTRATION_PREPARE.swap(false, Ordering::AcqRel) {
+            MountFS::deactivate_disconnected_subtree(&new_root_mntfs);
+            return Err(SystemError::ENOMEM);
+        }
+        let prepared_registrations =
+            match PreparedRegistrations::prepare_iter(copied_mounts.iter().map(|(_, copy)| copy)) {
+                Ok(registrations) => registrations,
+                Err(error) => {
+                    MountFS::deactivate_disconnected_subtree(&new_root_mntfs);
+                    return Err(error);
+                }
+            };
+
         let mut ns_common = self.ns_common.clone();
         ns_common.level += 1;
         let new_mntns = Arc::new_cyclic(|self_ref| Self {
@@ -594,17 +611,11 @@ impl MntNamespace {
         for (_old_mount, new_mount) in copied_mounts {
             new_mount.set_namespace(Arc::downgrade(&new_mntns));
             new_mount.mark_namespace_accounted(&new_mntns);
-            let propagation = new_mount.propagation();
-            if propagation.is_shared() {
-                register_peer(propagation.peer_group_id(), &new_mount);
-            }
-            if propagation.is_slave() {
-                register_slave_with_master(&new_mount);
-            }
             new_mount
                 .activate()
                 .expect("a detached namespace copy is published exactly once");
         }
+        prepared_registrations.commit();
 
         Ok(new_mntns)
     }
@@ -810,7 +821,7 @@ fn restrict_cross_user_propagation(
     if !cross_user_namespace {
         return;
     }
-    copy.lock_mount();
+    copy.lock_cross_user_mount();
     if !source.propagation().is_shared() {
         return;
     }
@@ -830,6 +841,42 @@ impl ProcessManager {
     }
 }
 
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::process::namespace::{
+        propagation::{get_peers, register_peer},
+        user_namespace::INIT_USER_NAMESPACE,
+    };
+
+    #[test]
+    fn registration_prepare_failure_cleans_namespace_copy() {
+        let namespace = MntNamespace::new_root();
+        let root = namespace.root_mntfs();
+        root.propagation().set_shared().unwrap();
+        let group_id = root.propagation().peer_group_id();
+        register_peer(group_id, &root);
+        let peers_before = get_peers(group_id, &root).len();
+        let slaves_before = root.propagation().slaves().len();
+        let pins_before = root.superblock_external_pin_count();
+        let mount_count_before = namespace.inner.read().mount_count.mounts;
+
+        FAIL_COPY_REGISTRATION_PREPARE.store(true, Ordering::Release);
+        let result = namespace.copy_mnt_ns(&CloneFlags::CLONE_NEWNS, INIT_USER_NAMESPACE.clone());
+
+        assert!(matches!(result, Err(SystemError::ENOMEM)));
+        assert_eq!(root.superblock_external_pin_count(), pins_before);
+        assert_eq!(get_peers(group_id, &root).len(), peers_before);
+        assert_eq!(root.propagation().slaves().len(), slaves_before);
+        assert_eq!(
+            namespace.inner.read().mount_count.mounts,
+            mount_count_before
+        );
+        assert!(root.is_live());
+        assert!(root.is_belongs_to_mntns(&namespace));
+    }
+}
+
 impl Drop for MntNamespace {
     fn drop(&mut self) {
         // Namespace destruction is a topology teardown, not filesystem I/O.