Denying access from sb_umount issue

[James Morris]

On Mon, 27 Jan 2020, Alexander Ivanov wrote:

> The lsm module implementes sb_umount() hook to disable lazy umounts. When access is denied, all consecutive umounts fail. It looks like mount reference count is messed up when sb_umount() return -EPERM. Is it possible that umount syscall assumes do_umount() touches those references and it calls 
> 
>  dput(path.dentry);
>  mntput_no_expire(mnt);
> 
> regardless of what do_mount() returns?

You mean do_umount()?

There are several other do_umount() error cases which would have the same 
behavior, right after security_sb_umount().

What error codes are you seeing for the consecutive failures?

-- 
James Morris
<jmorris at namei.org>