1. 19 11月, 2022 1 次提交
  2. 04 10月, 2022 1 次提交
    • A
      mm: fs: initialize fsdata passed to write_begin/write_end interface · 1468c6f4
      Alexander Potapenko 提交于
      Functions implementing the a_ops->write_end() interface accept the `void
      *fsdata` parameter that is supposed to be initialized by the corresponding
      a_ops->write_begin() (which accepts `void **fsdata`).
      
      However not all a_ops->write_begin() implementations initialize `fsdata`
      unconditionally, so it may get passed uninitialized to a_ops->write_end(),
      resulting in undefined behavior.
      
      Fix this by initializing fsdata with NULL before the call to
      write_begin(), rather than doing so in all possible a_ops implementations.
      
      This patch covers only the following cases found by running x86 KMSAN
      under syzkaller:
      
       - generic_perform_write()
       - cont_expand_zero() and generic_cont_expand_simple()
       - page_symlink()
      
      Other cases of passing uninitialized fsdata may persist in the codebase.
      
      Link: https://lkml.kernel.org/r/20220915150417.722975-43-glider@google.comSigned-off-by: NAlexander Potapenko <glider@google.com>
      Cc: Alexander Viro <viro@zeniv.linux.org.uk>
      Cc: Alexei Starovoitov <ast@kernel.org>
      Cc: Andrey Konovalov <andreyknvl@gmail.com>
      Cc: Andrey Konovalov <andreyknvl@google.com>
      Cc: Andy Lutomirski <luto@kernel.org>
      Cc: Arnd Bergmann <arnd@arndb.de>
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: Christoph Hellwig <hch@lst.de>
      Cc: Christoph Lameter <cl@linux.com>
      Cc: David Rientjes <rientjes@google.com>
      Cc: Dmitry Vyukov <dvyukov@google.com>
      Cc: Eric Biggers <ebiggers@google.com>
      Cc: Eric Biggers <ebiggers@kernel.org>
      Cc: Eric Dumazet <edumazet@google.com>
      Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
      Cc: Herbert Xu <herbert@gondor.apana.org.au>
      Cc: Ilya Leoshkevich <iii@linux.ibm.com>
      Cc: Ingo Molnar <mingo@redhat.com>
      Cc: Jens Axboe <axboe@kernel.dk>
      Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
      Cc: Kees Cook <keescook@chromium.org>
      Cc: Marco Elver <elver@google.com>
      Cc: Mark Rutland <mark.rutland@arm.com>
      Cc: Matthew Wilcox <willy@infradead.org>
      Cc: Michael S. Tsirkin <mst@redhat.com>
      Cc: Pekka Enberg <penberg@kernel.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Petr Mladek <pmladek@suse.com>
      Cc: Stephen Rothwell <sfr@canb.auug.org.au>
      Cc: Steven Rostedt <rostedt@goodmis.org>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: Vasily Gorbik <gor@linux.ibm.com>
      Cc: Vegard Nossum <vegard.nossum@oracle.com>
      Cc: Vlastimil Babka <vbabka@suse.cz>
      Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
      1468c6f4
  3. 24 9月, 2022 4 次提交
  4. 02 9月, 2022 2 次提交
  5. 21 7月, 2022 1 次提交
    • Y
      fs: move S_ISGID stripping into the vfs_*() helpers · 1639a49c
      Yang Xu 提交于
      Move setgid handling out of individual filesystems and into the VFS
      itself to stop the proliferation of setgid inheritance bugs.
      
      Creating files that have both the S_IXGRP and S_ISGID bit raised in
      directories that themselves have the S_ISGID bit set requires additional
      privileges to avoid security issues.
      
      When a filesystem creates a new inode it needs to take care that the
      caller is either in the group of the newly created inode or they have
      CAP_FSETID in their current user namespace and are privileged over the
      parent directory of the new inode. If any of these two conditions is
      true then the S_ISGID bit can be raised for an S_IXGRP file and if not
      it needs to be stripped.
      
      However, there are several key issues with the current implementation:
      
      * S_ISGID stripping logic is entangled with umask stripping.
      
        If a filesystem doesn't support or enable POSIX ACLs then umask
        stripping is done directly in the vfs before calling into the
        filesystem.
        If the filesystem does support POSIX ACLs then unmask stripping may be
        done in the filesystem itself when calling posix_acl_create().
      
        Since umask stripping has an effect on S_ISGID inheritance, e.g., by
        stripping the S_IXGRP bit from the file to be created and all relevant
        filesystems have to call posix_acl_create() before inode_init_owner()
        where we currently take care of S_ISGID handling S_ISGID handling is
        order dependent. IOW, whether or not you get a setgid bit depends on
        POSIX ACLs and umask and in what order they are called.
      
        Note that technically filesystems are free to impose their own
        ordering between posix_acl_create() and inode_init_owner() meaning
        that there's additional ordering issues that influence S_SIGID
        inheritance.
      
      * Filesystems that don't rely on inode_init_owner() don't get S_ISGID
        stripping logic.
      
        While that may be intentional (e.g. network filesystems might just
        defer setgid stripping to a server) it is often just a security issue.
      
      This is not just ugly it's unsustainably messy especially since we do
      still have bugs in this area years after the initial round of setgid
      bugfixes.
      
      So the current state is quite messy and while we won't be able to make
      it completely clean as posix_acl_create() is still a filesystem specific
      call we can improve the S_SIGD stripping situation quite a bit by
      hoisting it out of inode_init_owner() and into the vfs creation
      operations. This means we alleviate the burden for filesystems to handle
      S_ISGID stripping correctly and can standardize the ordering between
      S_ISGID and umask stripping in the vfs.
      
      We add a new helper vfs_prepare_mode() so S_ISGID handling is now done
      in the VFS before umask handling. This has S_ISGID handling is
      unaffected unaffected by whether umask stripping is done by the VFS
      itself (if no POSIX ACLs are supported or enabled) or in the filesystem
      in posix_acl_create() (if POSIX ACLs are supported).
      
      The vfs_prepare_mode() helper is called directly in vfs_*() helpers that
      create new filesystem objects. We need to move them into there to make
      sure that filesystems like overlayfs hat have callchains like:
      
      sys_mknod()
      -> do_mknodat(mode)
         -> .mknod = ovl_mknod(mode)
            -> ovl_create(mode)
               -> vfs_mknod(mode)
      
      get S_ISGID stripping done when calling into lower filesystems via
      vfs_*() creation helpers. Moving vfs_prepare_mode() into e.g.
      vfs_mknod() takes care of that. This is in any case semantically cleaner
      because S_ISGID stripping is VFS security requirement.
      
      Security hooks so far have seen the mode with the umask applied but
      without S_ISGID handling done. The relevant hooks are called outside of
      vfs_*() creation helpers so by calling vfs_prepare_mode() from vfs_*()
      helpers the security hooks would now see the mode without umask
      stripping applied. For now we fix this by passing the mode with umask
      settings applied to not risk any regressions for LSM hooks. IOW, nothing
      changes for LSM hooks. It is worth pointing out that security hooks
      never saw the mode that is seen by the filesystem when actually creating
      the file. They have always been completely misplaced for that to work.
      
      The following filesystems use inode_init_owner() and thus relied on
      S_ISGID stripping: spufs, 9p, bfs, btrfs, ext2, ext4, f2fs, hfsplus,
      hugetlbfs, jfs, minix, nilfs2, ntfs3, ocfs2, omfs, overlayfs, ramfs,
      reiserfs, sysv, ubifs, udf, ufs, xfs, zonefs, bpf, tmpfs.
      
      All of the above filesystems end up calling inode_init_owner() when new
      filesystem objects are created through the ->mkdir(), ->mknod(),
      ->create(), ->tmpfile(), ->rename() inode operations.
      
      Since directories always inherit the S_ISGID bit with the exception of
      xfs when irix_sgid_inherit mode is turned on S_ISGID stripping doesn't
      apply. The ->symlink() and ->link() inode operations trivially inherit
      the mode from the target and the ->rename() inode operation inherits the
      mode from the source inode. All other creation inode operations will get
      S_ISGID handling via vfs_prepare_mode() when called from their relevant
      vfs_*() helpers.
      
      In addition to this there are filesystems which allow the creation of
      filesystem objects through ioctl()s or - in the case of spufs -
      circumventing the vfs in other ways. If filesystem objects are created
      through ioctl()s the vfs doesn't know about it and can't apply regular
      permission checking including S_ISGID logic. Therfore, a filesystem
      relying on S_ISGID stripping in inode_init_owner() in their ioctl()
      callpath will be affected by moving this logic into the vfs. We audited
      those filesystems:
      
      * btrfs allows the creation of filesystem objects through various
        ioctls(). Snapshot creation literally takes a snapshot and so the mode
        is fully preserved and S_ISGID stripping doesn't apply.
      
        Creating a new subvolum relies on inode_init_owner() in
        btrfs_new_subvol_inode() but only creates directories and doesn't
        raise S_ISGID.
      
      * ocfs2 has a peculiar implementation of reflinks. In contrast to e.g.
        xfs and btrfs FICLONE/FICLONERANGE ioctl() that is only concerned with
        the actual extents ocfs2 uses a separate ioctl() that also creates the
        target file.
      
        Iow, ocfs2 circumvents the vfs entirely here and did indeed rely on
        inode_init_owner() to strip the S_ISGID bit. This is the only place
        where a filesystem needs to call mode_strip_sgid() directly but this
        is self-inflicted pain.
      
      * spufs doesn't go through the vfs at all and doesn't use ioctl()s
        either. Instead it has a dedicated system call spufs_create() which
        allows the creation of filesystem objects. But spufs only creates
        directories and doesn't allo S_SIGID bits, i.e. it specifically only
        allows 0777 bits.
      
      * bpf uses vfs_mkobj() but also doesn't allow S_ISGID bits to be created.
      
      The patch will have an effect on ext2 when the EXT2_MOUNT_GRPID mount
      option is used, on ext4 when the EXT4_MOUNT_GRPID mount option is used,
      and on xfs when the XFS_FEAT_GRPID mount option is used. When any of
      these filesystems are mounted with their respective GRPID option then
      newly created files inherit the parent directories group
      unconditionally. In these cases non of the filesystems call
      inode_init_owner() and thus did never strip the S_ISGID bit for newly
      created files. Moving this logic into the VFS means that they now get
      the S_ISGID bit stripped. This is a user visible change. If this leads
      to regressions we will either need to figure out a better way or we need
      to revert. However, given the various setgid bugs that we found just in
      the last two years this is a regression risk we should take.
      
      Associated with this change is a new set of fstests to enforce the
      semantics for all new filesystems.
      
      Link: https://lore.kernel.org/ceph-devel/20220427092201.wvsdjbnc7b4dttaw@wittgenstein [1]
      Link: e014f37d ("xfs: use setattr_copy to set vfs inode attributes") [2]
      Link: 01ea173e ("xfs: fix up non-directory creation in SGID directories") [3]
      Link: fd84bfdd ("ceph: fix up non-directory creation in SGID directories") [4]
      Link: https://lore.kernel.org/r/1657779088-2242-3-git-send-email-xuyang2018.jy@fujitsu.comSuggested-by: NDave Chinner <david@fromorbit.com>
      Suggested-by: NChristian Brauner (Microsoft) <brauner@kernel.org>
      Reviewed-by: NDarrick J. Wong <djwong@kernel.org>
      Reviewed-and-Tested-by: NJeff Layton <jlayton@kernel.org>
      Signed-off-by: NYang Xu <xuyang2018.jy@fujitsu.com>
      [<brauner@kernel.org>: rewrote commit message]
      Signed-off-by: NChristian Brauner (Microsoft) <brauner@kernel.org>
      1639a49c
  6. 19 7月, 2022 1 次提交
  7. 07 7月, 2022 6 次提交
    • A
      step_into(): move fetching ->d_inode past handle_mounts() · 3bd8bc89
      Al Viro 提交于
      ... and lose messing with it in __follow_mount_rcu()
      Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>
      3bd8bc89
    • A
      lookup_fast(): don't bother with inode · 4cb64024
      Al Viro 提交于
      Note that validation of ->d_seq after ->d_inode fetch is gone, along
      with fetching of ->d_inode itself.
      Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>
      4cb64024
    • A
      follow_dotdot{,_rcu}(): don't bother with inode · b16c001d
      Al Viro 提交于
      step_into() will fetch it, TYVM.
      Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>
      b16c001d
    • A
      step_into(): lose inode argument · a4f5b521
      Al Viro 提交于
      make handle_mounts() always fetch it.  This is just the first step -
      the callers of step_into() will stop trying to calculate the sucker,
      etc.
      
      The passed value should be equal to dentry->d_inode in all cases;
      in RCU mode - fetched after we'd sampled ->d_seq.  Might as well
      fetch it here.  We do need to validate ->d_seq, which duplicates
      the check currently done in lookup_fast(); that duplication will
      go away shortly.
      
      After that change handle_mounts() always ignores the initial value of
      *inode and always sets it on success.
      Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>
      a4f5b521
    • A
      namei: stash the sampled ->d_seq into nameidata · 03fa86e9
      Al Viro 提交于
      New field: nd->next_seq.  Set to 0 outside of RCU mode, holds the sampled
      value for the next dentry to be considered.  Used instead of an arseload
      of local variables, arguments, etc.
      
      step_into() has lost seq argument; nd->next_seq is used, so dentry passed
      to it must be the one ->next_seq is about.
      
      There are two requirements for RCU pathwalk:
      	1) it should not give a hard failure (other than -ECHILD) unless
      non-RCU pathwalk might fail that way given suitable timings.
      	2) it should not succeed unless non-RCU pathwalk might succeed
      with the same end location given suitable timings.
      
      The use of seq numbers is the way we achieve that.  Invariant we want
      to maintain is:
      	if RCU pathwalk can reach the state with given nd->path, nd->inode
      and nd->seq after having traversed some part of pathname, it must be possible
      for non-RCU pathwalk to reach the same nd->path and nd->inode after having
      traversed the same part of pathname, and observe the nd->path.dentry->d_seq
      equal to what RCU pathwalk has in nd->seq
      
      	For transition from parent to child, we sample child's ->d_seq
      and verify that parent's ->d_seq remains unchanged.  Anything that
      disrupts parent-child relationship would've bumped ->d_seq on both.
      	For transitions from child to parent we sample parent's ->d_seq
      and verify that child's ->d_seq has not changed.  Same reasoning as
      for the previous case applies.
      	For transition from mountpoint to root of mounted we sample
      the ->d_seq of root and verify that nobody has touched mount_lock since
      the beginning of pathwalk.  That guarantees that mount we'd found had
      been there all along, with these mountpoint and root of the mounted.
      It would be possible for a non-RCU pathwalk to reach the previous state,
      find the same mount and observe its root at the moment we'd sampled
      ->d_seq of that
      	For transitions from root of mounted to mountpoint we sample
      ->d_seq of mountpoint and verify that mount_lock had not been touched
      since the beginning of pathwalk.  The same reasoning as in the
      previous case applies.
      Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>
      03fa86e9
    • A
      namei: move clearing LOOKUP_RCU towards rcu_read_unlock() · 6e180327
      Al Viro 提交于
      try_to_unlazy()/try_to_unlazy_next() drop LOOKUP_RCU in the
      very beginning and do rcu_read_unlock() only at the very end.
      However, nothing done in between even looks at the flag in
      question; might as well clear it at the same time we unlock.
      
      Note that try_to_unlazy_next() used to call legitimize_mnt(),
      which might drop/regain rcu_read_lock() in some cases.  This
      is no longer true, so we really have rcu_read_lock() held
      all along until the end.
      Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>
      6e180327
  8. 06 7月, 2022 4 次提交
    • A
      switch try_to_unlazy_next() to __legitimize_mnt() · 7e4745a0
      Al Viro 提交于
      The tricky case (__legitimize_mnt() failing after having grabbed
      a reference) can be trivially dealt with by leaving nd->path.mnt
      non-NULL, for terminate_walk() to drop it.
      
      legitimize_mnt() becomes static after that.
      Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>
      7e4745a0
    • A
      follow_dotdot{,_rcu}(): change calling conventions · 51c6546c
      Al Viro 提交于
      Instead of returning NULL when we are in root, just make it return
      the current position (and set *seqp and *inodep accordingly).
      That collapses the calls of step_into() in handle_dots()
      Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>
      51c6546c
    • A
      namei: get rid of pointless unlikely(read_seqcount_retry(...)) · 82ef0698
      Al Viro 提交于
      read_seqcount_retry() et.al. are inlined and there's enough annotations
      for compiler to figure out that those are unlikely to return non-zero.
      Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>
      82ef0698
    • A
      __follow_mount_rcu(): verify that mount_lock remains unchanged · 20aac6c6
      Al Viro 提交于
      Validate mount_lock seqcount as soon as we cross into mount in RCU
      mode.  Sure, ->mnt_root is pinned and will remain so until we
      do rcu_read_unlock() anyway, and we will eventually fail to unlazy if
      the mount_lock had been touched, but we might run into a hard error
      (e.g. -ENOENT) before trying to unlazy.  And it's possible to end
      up with RCU pathwalk racing with rename() and umount() in a way
      that would fail with -ENOENT while non-RCU pathwalk would've
      succeeded with any timings.
      
      Once upon a time we hadn't needed that, but analysis had been subtle,
      brittle and went out of window as soon as RENAME_EXCHANGE had been
      added.
      
      It's narrow, hard to hit and won't get you anything other than
      stray -ENOENT that could be arranged in much easier way with the
      same priveleges, but it's a bug all the same.
      
      Cc: stable@kernel.org
      X-sky-is-falling: unlikely
      Fixes: da1ce067 "vfs: add cross-rename"
      Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>
      20aac6c6
  9. 20 5月, 2022 3 次提交
    • T
      namei: cleanup double word in comment · 30476f7e
      Tom Rix 提交于
      Remove the second 'to'.
      Signed-off-by: NTom Rix <trix@redhat.com>
      Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>
      30476f7e
    • A
      get rid of dead code in legitimize_root() · 52dba645
      Al Viro 提交于
      Combination of LOOKUP_IS_SCOPED and NULL nd->root.mnt is impossible
      after successful path_init().  All places where ->root.mnt might
      become NULL do that only if LOOKUP_IS_SCOPED is not there and
      path_init() itself can return success without setting nd->root
      only if ND_ROOT_PRESET had been set (in which case nd->root
      had been set by caller and never changed) or if the name had
      been a relative one *and* none of the bits in LOOKUP_IS_SCOPED
      had been present.
      
      Since all calls of legitimize_root() must be downstream of successful
      path_init(), the check for !nd->root.mnt && (nd->flags & LOOKUP_IS_SCOPED)
      is pure paranoia.
      
      FWIW, it had been discussed (and agreed upon) with Aleksa back when
      scoped lookups had been merged; looks like that had fallen through the
      cracks back then.
      Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>
      52dba645
    • A
      fs/namei.c:reserve_stack(): tidy up the call of try_to_unlazy() · e5ca024e
      Al Viro 提交于
      !foo() != 0 is a strange way to spell !foo(); fallout from
      "fs: make unlazy_walk() error handling consistent"...
      Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>
      e5ca024e
  10. 14 5月, 2022 1 次提交
  11. 09 5月, 2022 3 次提交
  12. 28 4月, 2022 1 次提交
  13. 15 4月, 2022 1 次提交
    • N
      VFS: filename_create(): fix incorrect intent. · b3d4650d
      NeilBrown 提交于
      When asked to create a path ending '/', but which is not to be a
      directory (LOOKUP_DIRECTORY not set), filename_create() will never try
      to create the file.  If it doesn't exist, -ENOENT is reported.
      
      However, it still passes LOOKUP_CREATE|LOOKUP_EXCL to the filesystems
      ->lookup() function, even though there is no intent to create.  This is
      misleading and can cause incorrect behaviour.
      
      If you try
      
         ln -s foo /path/dir/
      
      where 'dir' is a directory on an NFS filesystem which is not currently
      known in the dcache, this will fail with ENOENT.
      
      But as the name is not in the dcache, nfs_lookup gets called with
      LOOKUP_CREATE|LOOKUP_EXCL and so it returns NULL without performing any
      lookup, with the expectation that a subsequent call to create the target
      will be made, and the lookup can be combined with the creation.  In the
      case with a trailing '/' and no LOOKUP_DIRECTORY, that call is never
      made.  Instead filename_create() sees that the dentry is not (yet)
      positive and returns -ENOENT - even though the directory actually
      exists.
      
      So only set LOOKUP_CREATE|LOOKUP_EXCL if there really is an intent to
      create, and use the absence of these flags to decide if -ENOENT should
      be returned.
      
      Note that filename_parentat() is only interested in LOOKUP_REVAL, so we
      split that out and store it in 'reval_flag'.  __lookup_hash() then gets
      reval_flag combined with whatever create flags were determined to be
      needed.
      Reviewed-by: NDavid Disseldorp <ddiss@suse.de>
      Reviewed-by: NJeff Layton <jlayton@kernel.org>
      Signed-off-by: NNeilBrown <neilb@suse.de>
      Cc: Al Viro <viro@zeniv.linux.org.uk>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      b3d4650d
  14. 24 1月, 2022 1 次提交
    • A
      fsnotify: invalidate dcache before IN_DELETE event · a37d9a17
      Amir Goldstein 提交于
      Apparently, there are some applications that use IN_DELETE event as an
      invalidation mechanism and expect that if they try to open a file with
      the name reported with the delete event, that it should not contain the
      content of the deleted file.
      
      Commit 49246466 ("fsnotify: move fsnotify_nameremove() hook out of
      d_delete()") moved the fsnotify delete hook before d_delete() so fsnotify
      will have access to a positive dentry.
      
      This allowed a race where opening the deleted file via cached dentry
      is now possible after receiving the IN_DELETE event.
      
      To fix the regression, create a new hook fsnotify_delete() that takes
      the unlinked inode as an argument and use a helper d_delete_notify() to
      pin the inode, so we can pass it to fsnotify_delete() after d_delete().
      
      Backporting hint: this regression is from v5.3. Although patch will
      apply with only trivial conflicts to v5.4 and v5.10, it won't build,
      because fsnotify_delete() implementation is different in each of those
      versions (see fsnotify_link()).
      
      A follow up patch will fix the fsnotify_unlink/rmdir() calls in pseudo
      filesystem that do not need to call d_delete().
      
      Link: https://lore.kernel.org/r/20220120215305.282577-1-amir73il@gmail.comReported-by: NIvan Delalande <colona@arista.com>
      Link: https://lore.kernel.org/linux-fsdevel/YeNyzoDM5hP5LtGW@visor/
      Fixes: 49246466 ("fsnotify: move fsnotify_nameremove() hook out of d_delete()")
      Cc: stable@vger.kernel.org # v5.3+
      Signed-off-by: NAmir Goldstein <amir73il@gmail.com>
      Signed-off-by: NJan Kara <jack@suse.cz>
      a37d9a17
  15. 22 1月, 2022 1 次提交
    • L
      fs: move namei sysctls to its own file · 9c011be1
      Luis Chamberlain 提交于
      kernel/sysctl.c is a kitchen sink where everyone leaves their dirty
      dishes, this makes it very difficult to maintain.
      
      To help with this maintenance let's start by moving sysctls to places
      where they actually belong.  The proc sysctl maintainers do not want to
      know what sysctl knobs you wish to add for your own piece of code, we
      just care about the core logic.
      
      So move namei's own sysctl knobs to its own file.
      
      Other than the move we also avoid initializing two static variables to 0
      as this is not needed:
      
        * sysctl_protected_symlinks
        * sysctl_protected_hardlinks
      
      Link: https://lkml.kernel.org/r/20211129205548.605569-8-mcgrof@kernel.orgSigned-off-by: NLuis Chamberlain <mcgrof@kernel.org>
      Cc: Al Viro <viro@zeniv.linux.org.uk>
      Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
      Cc: Antti Palosaari <crope@iki.fi>
      Cc: Eric Biederman <ebiederm@xmission.com>
      Cc: Iurii Zaikin <yzaikin@google.com>
      Cc: "J. Bruce Fields" <bfields@fieldses.org>
      Cc: Jeff Layton <jlayton@kernel.org>
      Cc: Kees Cook <keescook@chromium.org>
      Cc: Lukas Middendorf <kernel@tuxforce.de>
      Cc: Stephen Kitt <steve@sk2.org>
      Cc: Xiaoming Ni <nixiaoming@huawei.com>
      Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      9c011be1
  16. 07 1月, 2022 1 次提交
  17. 27 10月, 2021 1 次提交
  18. 08 9月, 2021 5 次提交
  19. 04 9月, 2021 1 次提交
  20. 24 8月, 2021 1 次提交