2

I want to isolate a potentially dangerous process, without needing root privileges. However, the syscall pivot_root fails with EINVAL.

struct clone_args ca = {
    .flags = CLONE_NEWUSER | CLONE_NEWNS,
};
pid = syscall(SYS_clone3, &ca, sizeof ca);
if (pid == 0) {
    mount(NULL, "/", NULL, MS_REC | MS_PRIVATE, NULL);
    mount(".", ".", NULL, MS_BIND | MS_REC, NULL);
    mkdir("./oldroot", 0777);
    syscall(SYS_pivot_root, ".", "./oldroot"); // Fails with EINVAL
}

I added printk calls in my kernel and recompiled it, and I know it fails at this check: if (new_mnt->mnt.mnt_flags & MNT_LOCKED).

What does MNT_LOCKED mean? What can I do to make new_mnt not have this flag? Is it even possible to do that in a user namespace, as a regular user?

Improve this question

1 Answer 1

Reset to default
0

My interpretation of the Linux kernel source is that the target of a pivot_root must have been mounted from within the user namespace that it's in.

MNT_LOCKED seems to primarily be set by lock_mnt_tree, which is called in several places where mount namespaces are changed, and are guarded by branches such as if (child->mnt_parent->mnt_ns->user_ns != user_ns).

Comments in lock_mnt_tree say this is done to prevent a process in a user namespace from unmounting a mount and seeing what was obscured, as bind mounting an empty directory on top of a sensitive directory is a common way of preventing a container from accessing it.

I believe this can be subverted by waiting until after pivoting to unshare your user namespace. Just don't forget to unshare your mount namespace again while/after unsharing the user namespace so that the user namespace becomes the "owner" of the mount namespace.

Improve this answer
1
  • i'm hitting the same check in the kernel but not actually using any user namespace. any other idea what else triggers it? Commented Jan 12, 2024 at 9:35

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.