• Eric W. Biederman's avatar
    mnt: Add a per mount namespace limit on the number of mounts · 1171afc4
    Eric W. Biederman authored
    [ Upstream commit d2921684 ]
    
    CAI Qian <caiqian@redhat.com> pointed out that the semantics
    of shared subtrees make it possible to create an exponentially
    increasing number of mounts in a mount namespace.
    
        mkdir /tmp/1 /tmp/2
        mount --make-rshared /
        for i in $(seq 1 20) ; do mount --bind /tmp/1 /tmp/2 ; done
    
    Will create create 2^20 or 1048576 mounts, which is a practical problem
    as some people have managed to hit this by accident.
    
    As such CVE-2016-6213 was assigned.
    
    Ian Kent <raven@themaw.net> described the situation for autofs users
    as follows:
    
    > The number of mounts for direct mount maps is usually not very large because of
    > the way they are implemented, large direct mount maps can have performance
    > problems. There can be anywhere from a few (likely case a few hundred) to less
    > than 10000, plus mounts that have been triggered and not yet expired.
    >
    > Indirect mounts have one autofs mount at the root plus the number of mounts that
    > have been triggered and not yet expired.
    >
    > The number of autofs indirect map entries can range from a few to the common
    > case of several thousand and in rare cases up to between 30000 and 50000. I've
    > not heard of people with maps larger than 50000 entries.
    >
    > The larger the number of map entries the greater the possibility for a large
    > number of active mounts so it's not hard to expect cases of a 1000 or somewhat
    > more active mounts.
    
    So I am setting the default number of mounts allowed per mount
    namespace at 100,000.  This is more than enough for any use case I
    know of, but small enough to quickly stop an exponential increase
    in mounts.  Which should be perfect to catch misconfigurations and
    malfunctioning programs.
    
    For anyone who needs a higher limit this can be changed by writing
    to the new /proc/sys/fs/mount-max sysctl.
    Tested-by: default avatarCAI Qian <caiqian@redhat.com>
    Signed-off-by: default avatar"Eric W. Biederman" <ebiederm@xmission.com>
    
    Conflicts:
    	fs/namespace.c
    	kernel/sysctl.c
    Signed-off-by: default avatarPhilipp Hahn <hahn@univention.de>
    Signed-off-by: default avatarSasha Levin <alexander.levin@verizon.com>
    1171afc4
fs.txt 12.4 KB