git: e59bfcaa37fc - releng/11.4 - mount: Disallow mounting over a jail root

[Mark Johnston]

The branch releng/11.4 has been updated by markj:

URL: https://cgit.FreeBSD.org/src/commit/?id=e59bfcaa37fc8fe5c6e200e53aa6daa841751cb7

commit e59bfcaa37fc8fe5c6e200e53aa6daa841751cb7
Author:     Mark Johnston <markj at FreeBSD.org>
AuthorDate: 2021-04-06 19:09:43 +0000
Commit:     Mark Johnston <markj at FreeBSD.org>
CommitDate: 2021-04-06 19:10:21 +0000

    mount: Disallow mounting over a jail root
    
    Discussed with: jamie
    Approved by:    so
    Security:       CVE-2020-25584
    Security:       FreeBSD-SA-21:10.jail_mount
    
    (cherry picked from commit 6f7815083ad66c34bad0dfa08c7033ff670b3be1)
---
 sys/kern/vfs_mount.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/sys/kern/vfs_mount.c b/sys/kern/vfs_mount.c
index 3e5ebe715a42..c88f2be54d02 100644
--- a/sys/kern/vfs_mount.c
+++ b/sys/kern/vfs_mount.c
@@ -830,6 +830,11 @@ vfs_domount_first(
 	ASSERT_VOP_ELOCKED(vp, __func__);
 	KASSERT((fsflags & MNT_UPDATE) == 0, ("MNT_UPDATE shouldn't be here"));
 
+	if (vp == td->td_ucred->cr_prison->pr_root) {
+		vput(vp);
+		return (EPERM);
+	}
+
 	/*
 	 * If the user is not root, ensure that they own the directory
 	 * onto which we are attempting to mount.