Allow a filesystem to control its visibility in /proc/filesystems.

PiperOrigin-RevId: 204508520
Change-Id: I09e5f8b6e69413370e1a0d39dbb7dc1ee0b6192d

pkg/sentry/fs/dev/fs.go

@@ -49,6 +49,11 @@ func (*filesystem) AllowUserMount() bool {
 	return true
 }
 
+// AllowUserList allows this filesystem to be listed in /proc/filesystems.
+func (*filesystem) AllowUserList() bool {
+	return true
+}
+
 // Flags returns that there is nothing special about this file system.
 //
 // In Linux, devtmpfs does the same thing.

pkg/sentry/fs/filesystems.go

@@ -55,6 +55,10 @@ type Filesystem interface {
 	// AllowUserMount determines whether mount(2) is allowed to mount a
 	// file system of this type.
 	AllowUserMount() bool
+
+	// AllowUserList determines whether this filesystem is listed in
+	// /proc/filesystems
+	AllowUserList() bool
 }
 
 // filesystems is the global set of registered file systems. It does not need

pkg/sentry/fs/gofer/fs.go

@@ -103,6 +103,11 @@ func (*filesystem) AllowUserMount() bool {
 	return false
 }
 
+// AllowUserList allows this filesystem to be listed in /proc/filesystems.
+func (*filesystem) AllowUserList() bool {
+	return true
+}
+
 // Flags returns that there is nothing special about this file system.
 //
 // The 9p Linux client returns FS_RENAME_DOES_D_MOVE, see fs/9p/vfs_super.c.

pkg/sentry/fs/host/fs.go

@@ -66,6 +66,11 @@ func (*Filesystem) AllowUserMount() bool {
 	return false
 }
 
+// AllowUserList allows this filesystem to be listed in /proc/filesystems.
+func (*Filesystem) AllowUserList() bool {
+	return true
+}
+
 // Flags returns that there is nothing special about this file system.
 func (*Filesystem) Flags() fs.FilesystemFlags {
 	return 0

pkg/sentry/fs/mount_overlay.go

@@ -89,6 +89,11 @@ func (ofs *overlayFilesystem) AllowUserMount() bool {
 	return false
 }
 
+// AllowUserList implements Filesystem.AllowUserList.
+func (*overlayFilesystem) AllowUserList() bool {
+	return true
+}
+
 // Mount implements Filesystem.Mount.
 func (ofs *overlayFilesystem) Mount(ctx context.Context, device string, flags MountSourceFlags, data string) (*Inode, error) {
 	panic("overlayFilesystem.Mount should not be called!")

pkg/sentry/fs/proc/filesystems.go

@@ -43,6 +43,9 @@ func (*filesystemsData) ReadSeqFileData(ctx context.Context, h seqfile.SeqHandle
 	// Generate the file contents.
 	var buf bytes.Buffer
 	for _, sys := range fs.GetFilesystems() {
+		if !sys.AllowUserList() {
+			continue
+		}
 		nodev := "nodev"
 		if sys.Flags()&fs.FilesystemRequiresDev != 0 {
 			nodev = ""

pkg/sentry/fs/proc/fs.go

@@ -42,6 +42,11 @@ func (*filesystem) AllowUserMount() bool {
 	return true
 }
 
+// AllowUserList allows this filesystem to be listed in /proc/filesystems.
+func (*filesystem) AllowUserList() bool {
+	return true
+}
+
 // Flags returns that there is nothing special about this file system.
 //
 // In Linux, proc returns FS_USERNS_VISIBLE | FS_USERNS_MOUNT, see fs/proc/root.c.

pkg/sentry/fs/sys/fs.go

@@ -40,6 +40,11 @@ func (*filesystem) AllowUserMount() bool {
 	return true
 }
 
+// AllowUserList allows this filesystem to be listed in /proc/filesystems.
+func (*filesystem) AllowUserList() bool {
+	return true
+}
+
 // Flags returns that there is nothing special about this file system.
 //
 // In Linux, sysfs returns FS_USERNS_VISIBLE | FS_USERNS_MOUNT, see fs/sysfs/mount.c.

pkg/sentry/fs/tmpfs/fs.go

@@ -67,6 +67,11 @@ func (*Filesystem) AllowUserMount() bool {
 	return true
 }
 
+// AllowUserList allows this filesystem to be listed in /proc/filesystems.
+func (*Filesystem) AllowUserList() bool {
+	return true
+}
+
 // Flags returns that there is nothing special about this file system.
 //
 // In Linux, tmpfs returns FS_USERNS_MOUNT, see mm/shmem.c.

pkg/sentry/fs/tty/fs.go

@@ -46,6 +46,11 @@ func (*filesystem) AllowUserMount() bool {
 	return false
 }
 
+// AllowUserList allows this filesystem to be listed in /proc/filesystems.
+func (*filesystem) AllowUserList() bool {
+	return true
+}
+
 // Flags returns that there is nothing special about this file system.
 func (*filesystem) Flags() fs.FilesystemFlags {
 	return 0