nfs: don't share mounts between network namespaces
authorJ. Bruce Fields <bfields@redhat.com>
Tue, 3 May 2016 19:16:02 +0000 (15:16 -0400)
committerAnna Schumaker <Anna.Schumaker@Netapp.com>
Mon, 9 May 2016 13:05:40 +0000 (09:05 -0400)
commit7e3fcf61abde92a895533b1c6932ad17e073a49c
tree271dfb0c8d63d67a024d50e9c2db21c31bd649ac
parent11476e9dec39d90fe1e9bf12abc6f3efe35a073d
nfs: don't share mounts between network namespaces

There's no guarantee that an IP address in a different network namespace
actually represents the same endpoint.

Also, if we allow unprivileged nfs mounts some day then this might allow
an unprivileged user in another network namespace to misdirect somebody
else's nfs mounts.

If sharing between containers is really what's wanted then that could
still be arranged explicitly, for example with bind mounts.

Reported-by: "Eric W. Biederman" <ebiederm@redhat.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
fs/nfs/super.c