From: "KONDO KAZUMA(近藤 和真)" <kazuma-kondo@nec.com>
To: "viro@zeniv.linux.org.uk" <viro@zeniv.linux.org.uk>,
"brauner@kernel.org" <brauner@kernel.org>,
"jack@suse.cz" <jack@suse.cz>
Cc: "mike@mbaynton.com" <mike@mbaynton.com>,
"miklos@szeredi.hu" <miklos@szeredi.hu>,
"amir73il@gmail.com" <amir73il@gmail.com>,
"linux-fsdevel@vger.kernel.org" <linux-fsdevel@vger.kernel.org>,
"linux-unionfs@vger.kernel.org" <linux-unionfs@vger.kernel.org>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
"KONDO KAZUMA(近藤 和真)" <kazuma-kondo@nec.com>
Subject: [PATCH] fs: allow clone_private_mount() for a path on real rootfs
Date: Wed, 14 May 2025 00:25:58 +0000 [thread overview]
Message-ID: <20250514002650.118278-1-kazuma-kondo@nec.com> (raw)
Mounting overlayfs with a directory on real rootfs (initramfs)
as upperdir has failed with following message since commit [1].
[ 4.080134] overlayfs: failed to clone upperpath
Overlayfs mount uses clone_private_mount() to create internal mount
for the underlying layers.
The commit [1] made clone_private_mount() reject real rootfs because
it does not have a parent mount and is in the initial mount namespace,
that is not an anonymous mount namespace.
This issue can be fixed by relaxing the permission check
of clone_private_mount(), similar to [2].
[1] commit db04662e2f4f ("fs: allow detached mounts in clone_private_mount()")
[2] commit 46f5ab762d04 ("fs: relax mount_setattr() permission checks")
Fixes: db04662e2f4f ("fs: allow detached mounts in clone_private_mount()")
Signed-off-by: Kazuma Kondo <kazuma-kondo@nec.com>
---
fs/namespace.c | 12 ++++--------
1 file changed, 4 insertions(+), 8 deletions(-)
diff --git a/fs/namespace.c b/fs/namespace.c
index 1b466c54a357..277dbf18e160 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -2482,17 +2482,13 @@ struct vfsmount *clone_private_mount(const struct path *path)
if (IS_MNT_UNBINDABLE(old_mnt))
return ERR_PTR(-EINVAL);
- if (mnt_has_parent(old_mnt)) {
+ if (!is_mounted(&old_mnt->mnt))
+ return ERR_PTR(-EINVAL);
+
+ if (mnt_has_parent(old_mnt) || !is_anon_ns(old_mnt->mnt_ns)) {
if (!check_mnt(old_mnt))
return ERR_PTR(-EINVAL);
} else {
- if (!is_mounted(&old_mnt->mnt))
- return ERR_PTR(-EINVAL);
-
- /* Make sure this isn't something purely kernel internal. */
- if (!is_anon_ns(old_mnt->mnt_ns))
- return ERR_PTR(-EINVAL);
-
/* Make sure we don't create mount namespace loops. */
if (!check_for_nsfs_mounts(old_mnt))
return ERR_PTR(-EINVAL);
--
2.49.0
next reply other threads:[~2025-05-14 0:26 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-05-14 0:25 KONDO KAZUMA(近藤 和真) [this message]
2025-05-14 2:43 ` [PATCH] fs: allow clone_private_mount() for a path on real rootfs Al Viro
2025-05-14 8:37 ` KONDO KAZUMA(近藤 和真)
2025-05-14 19:02 ` Al Viro
2025-05-15 12:12 ` KONDO KAZUMA(近藤 和真)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20250514002650.118278-1-kazuma-kondo@nec.com \
--to=kazuma-kondo@nec.com \
--cc=amir73il@gmail.com \
--cc=brauner@kernel.org \
--cc=jack@suse.cz \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-unionfs@vger.kernel.org \
--cc=mike@mbaynton.com \
--cc=miklos@szeredi.hu \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).