put_mnt_ns(): leave mounts connected

When a mount namespace is destroyed, put_mnt_ns() disconnects its mounts
from their mount points. A file descriptor still open on the parent of a
mount point can then be used to look under the mount point.

Locked mounts are kept connected to prevent this. However, a mount is
only locked when its tree is copied across a user namespace boundary. A
mount namespace set up by a privileged component has no locked mounts,
so its mounts are disconnected.

Pass UMOUNT_CONNECTED so every mount is kept connected, as locked mounts
already are.

Signed-off-by: Noah Orlando <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Christian Brauner (Amutable) <[email protected]>

fs/namespace.c

@@ -6283,7 +6283,7 @@ void put_mnt_ns(struct mnt_namespace *ns)
 	guard(namespace_excl)();
 	emptied_ns = ns;
 	guard(mount_writer)();
-	umount_tree(ns->root, 0);
+	umount_tree(ns->root, UMOUNT_CONNECTED);
 }
 
 struct vfsmount *kern_mount(struct file_system_type *type)