From c80273033a541581a7aeed34c9923c24f8741735 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E9=99=88=E9=82=A3=E5=87=A0?= <2078634206@qq.com>
Date: Sat, 22 Aug 2026 01:01:19 +0800
Subject: [PATCH] tkernel: shield_mounts: filter mountstats for shielded mounts
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The shield mounts feature hooks show_vfsmnt() and
show_mountinfo() so that containers cannot see mounts marked
as shielded, but show_vfsstat() was left out when the feature
was introduced (7dbd79cf59e8).  A process inside a container
can therefore read the device name and mount point of a
shielded mount from /proc/self/mountstats, which is exactly
what the feature promises to hide.

Add the same is_mount_shielded() check at the top of
show_vfsstat() used by the other two show helpers.

Upstream status: downstream-only

Signed-off-by: 陈那几 <2078634206@qq.com>
---
 fs/proc_namespace.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/fs/proc_namespace.c b/fs/proc_namespace.c
index 999de76e44fa..93920026cd8d 100644
--- a/fs/proc_namespace.c
+++ b/fs/proc_namespace.c
@@ -207,7 +207,10 @@ static int show_vfsstat(struct seq_file *m, struct vfsmount *mnt)
 	struct mount *r = real_mount(mnt);
 	struct path mnt_path = { .dentry = mnt->mnt_root, .mnt = mnt };
 	struct super_block *sb = mnt_path.dentry->d_sb;
-	int err;
+	int err = 0;
+
+	if (is_mount_shielded(current, r->mnt_devname ? r->mnt_devname : "none", mnt))
+		goto out;
 
 	/* device */
 	if (sb->s_op->show_devname) {
-- 
Gitee