git: 6f7815083ad6 - stable/11 - mount: Disallow mounting over a jail root

[Mark Johnston]

The branch stable/11 has been updated by markj:

URL: https://cgit.FreeBSD.org/src/commit/?id=6f7815083ad66c34bad0dfa08c7033ff670b3be1

commit 6f7815083ad66c34bad0dfa08c7033ff670b3be1
Author:     Mark Johnston <markj at FreeBSD.org>
AuthorDate: 2021-04-06 19:09:43 +0000
Commit:     Mark Johnston <markj at FreeBSD.org>
CommitDate: 2021-04-06 19:09:43 +0000

    mount: Disallow mounting over a jail root
    
    Discussed with: jamie
    Approved by:    so
    Security:       CVE-2020-25584
    Security:       FreeBSD-SA-21:10.jail_mount
---
 sys/kern/vfs_mount.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/sys/kern/vfs_mount.c b/sys/kern/vfs_mount.c
index 7885052c27d6..613872303982 100644
--- a/sys/kern/vfs_mount.c
+++ b/sys/kern/vfs_mount.c
@@ -830,6 +830,11 @@ vfs_domount_first(
 	ASSERT_VOP_ELOCKED(vp, __func__);
 	KASSERT((fsflags & MNT_UPDATE) == 0, ("MNT_UPDATE shouldn't be here"));
 
+	if (vp == td->td_ucred->cr_prison->pr_root) {
+		vput(vp);
+		return (EPERM);
+	}
+
 	/*
 	 * If the user is not root, ensure that they own the directory
 	 * onto which we are attempting to mount.