Suppose a process has its cwd pointing to a nullfs directory. Suppose
that the lower directory vnode is moved out from under the nullfs mount.
The nullfs vnode still shadows the lower vnode, and dotdot lookups
relative to that directory will instantiate new nullfs vnodes outside of
the nullfs mountpoint, effectively shadowing the lower filesystem.
This trick can be abused to escape a chroot, since the nullfs vnodes
instantiated by these dotdot lookups defeat the root vnode check in
vfs_lookup(), which uses vnode pointer equality to test for the process
root.
Fix this by extending nullfs and unionfs to perform the same check,
exploiting the fact that the passed componentname is embedded in a
nameidata structure to avoid changing the VOP_LOOKUP interface. That
is, add a flag to indicate that containerof can be used to get the full
nameidata structure, and perform the root vnode check on the lower vnode
when performing a dotdot lookup.
PR: 262180