Denying access from sb_umount issue

[Alexander Ivanov]

On Mon, 27 Jan 2020 12:58 -08:00, James Morris <jmorris at namei.org> wrote:
> On Mon, 27 Jan 2020, Alexander Ivanov wrote:
> 
> > The lsm module implementes sb_umount() hook to disable lazy umounts. When access is denied, all consecutive umounts fail. It looks like mount reference count is messed up when sb_umount() return -EPERM. Is it possible that umount syscall assumes do_umount() touches those references and it calls 
> > 
> >  dput(path.dentry);
> >  mntput_no_expire(mnt);
> > 
> > regardless of what do_mount() returns?
> 
> You mean do_umount()?
> 

yes, typo, sorry.


> There are several other do_umount() error cases which would have the same 
> behavior, right after security_sb_umount().
> 

We do umount with MNT_DETACH, thus those early returns seem not applicable?


> What error codes are you seeing for the consecutive failures?
> 

We got EBUSY.

Thanks,
--Alex