[PATCH 1/1] squashfs: enable idmapped mounts

[PATCH 1/1] squashfs: enable idmapped mounts

[Michael Weiß]

For squashfs all needed functionality for idmapped mounts is already
implemented by the generic handlers in the VFS. Thus, it is sufficient
to just enable the corresponding FS_ALLOW_IDMAP flag to support
idmapped mounts.

We use this for unprivileged (user namespaced) containers based on
squashfs images as rootfs in GyroidOS.

A simple test using the mount-idmapped tool executed as user with
uid=1000 looks as follows:

$ mkdir test
$ echo "test" > test/test_file
$ mksquashfs test/ fs.img
$ sudo mkdir /mnt/test
$ sudo mkdir /mnt/mapped
$ sudo mount fs.img -o loop /mnt/test/
$ sudo ./mount-idmapped --map-mount b:1000:2000:1 /mnt/test/ /mnt/mapped/

$ mount | tail -n2
fs.img on /mnt/test type squashfs (ro,relatime,errors=continue)
fs.img on /mnt/mapped type squashfs (ro,relatime,idmapped,errors=continue)

$ ls -lan /mnt/test/
total 5
drwxr-xr-x 2 1000 1000   32 Okt 24 13:36 .
drwxr-xr-x 6    0    0 4096 Okt 24 13:38 ..
-rw-r--r-- 1 1000 1000    5 Okt 24 13:36 test_file

$ ls -lan /mnt/mapped/
total 5
drwxr-xr-x 2 2000 2000   32 Okt 24 13:36 .
drwxr-xr-x 6    0    0 4096 Okt 24 13:38 ..
-rw-r--r-- 1 2000 2000    5 Okt 24 13:36 test_file

Signed-off-by: Michael Weiß <michael.weiss@aisec.fraunhofer.de>
---
 fs/squashfs/super.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/squashfs/super.c b/fs/squashfs/super.c
index 32565dafa7f3..2636cb354435 100644
--- a/fs/squashfs/super.c
+++ b/fs/squashfs/super.c
@@ -568,7 +568,7 @@ static struct file_system_type squashfs_fs_type = {
 	.init_fs_context = squashfs_init_fs_context,
 	.parameters = squashfs_fs_parameters,
 	.kill_sb = kill_block_super,
-	.fs_flags = FS_REQUIRES_DEV
+	.fs_flags = FS_REQUIRES_DEV | FS_ALLOW_IDMAP,
 };
 MODULE_ALIAS_FS("squashfs");
 
-- 
2.30.2

Re: [PATCH 1/1] squashfs: enable idmapped mounts

[Christian Brauner]

On Mon, Oct 24, 2022 at 09:15:52PM +0200, Michael Weiß wrote:
> For squashfs all needed functionality for idmapped mounts is already
> implemented by the generic handlers in the VFS. Thus, it is sufficient
> to just enable the corresponding FS_ALLOW_IDMAP flag to support
> idmapped mounts.
> 
> We use this for unprivileged (user namespaced) containers based on
> squashfs images as rootfs in GyroidOS.
> 
> A simple test using the mount-idmapped tool executed as user with
> uid=1000 looks as follows:
> 
> $ mkdir test
> $ echo "test" > test/test_file
> $ mksquashfs test/ fs.img
> $ sudo mkdir /mnt/test
> $ sudo mkdir /mnt/mapped
> $ sudo mount fs.img -o loop /mnt/test/
> $ sudo ./mount-idmapped --map-mount b:1000:2000:1 /mnt/test/ /mnt/mapped/
> 
> $ mount | tail -n2
> fs.img on /mnt/test type squashfs (ro,relatime,errors=continue)
> fs.img on /mnt/mapped type squashfs (ro,relatime,idmapped,errors=continue)
> 
> $ ls -lan /mnt/test/
> total 5
> drwxr-xr-x 2 1000 1000   32 Okt 24 13:36 .
> drwxr-xr-x 6    0    0 4096 Okt 24 13:38 ..
> -rw-r--r-- 1 1000 1000    5 Okt 24 13:36 test_file
> 
> $ ls -lan /mnt/mapped/
> total 5
> drwxr-xr-x 2 2000 2000   32 Okt 24 13:36 .
> drwxr-xr-x 6    0    0 4096 Okt 24 13:38 ..
> -rw-r--r-- 1 2000 2000    5 Okt 24 13:36 test_file
> 
> Signed-off-by: Michael Weiß <michael.weiss@aisec.fraunhofer.de>
> ---

This should indeed be all that is needed. Looks good to me,
Reviewed-by: Christian Brauner <brauner@kernel.org>

Re: [PATCH 1/1] squashfs: enable idmapped mounts

[Christian Brauner]

From: Christian Brauner (Microsoft) <brauner@kernel.org>

On Mon, 24 Oct 2022 21:15:52 +0200, Michael Weiß wrote:
> For squashfs all needed functionality for idmapped mounts is already
> implemented by the generic handlers in the VFS. Thus, it is sufficient
> to just enable the corresponding FS_ALLOW_IDMAP flag to support
> idmapped mounts.
> 
> We use this for unprivileged (user namespaced) containers based on
> squashfs images as rootfs in GyroidOS.
> 
> [...]

Hey Phillip,

Michael reminded me about this patch just now. I've picked this up now so it
can make it into the next mw. Phillip, in case you'll pick this up just tell me
and I'll drop it.

[1/1] squashfs: enable idmapped mounts
      commit: 01546f1d7142f27002789e8626a32b20d5853a48

Thanks!
Christian

Re: [PATCH 1/1] squashfs: enable idmapped mounts

[Phillip Lougher]

On 24/10/2022 20:15, Michael Weiß wrote:
> For squashfs all needed functionality for idmapped mounts is already
> implemented by the generic handlers in the VFS. Thus, it is sufficient
> to just enable the corresponding FS_ALLOW_IDMAP flag to support
> idmapped mounts.
> 
> We use this for unprivileged (user namespaced) containers based on
> squashfs images as rootfs in GyroidOS.
> 
> A simple test using the mount-idmapped tool executed as user with
> uid=1000 looks as follows:
> 
> $ mkdir test
> $ echo "test" > test/test_file
> $ mksquashfs test/ fs.img
> $ sudo mkdir /mnt/test
> $ sudo mkdir /mnt/mapped
> $ sudo mount fs.img -o loop /mnt/test/
> $ sudo ./mount-idmapped --map-mount b:1000:2000:1 /mnt/test/ /mnt/mapped/
> 
> $ mount | tail -n2
> fs.img on /mnt/test type squashfs (ro,relatime,errors=continue)
> fs.img on /mnt/mapped type squashfs (ro,relatime,idmapped,errors=continue)
> 
> $ ls -lan /mnt/test/
> total 5
> drwxr-xr-x 2 1000 1000   32 Okt 24 13:36 .
> drwxr-xr-x 6    0    0 4096 Okt 24 13:38 ..
> -rw-r--r-- 1 1000 1000    5 Okt 24 13:36 test_file
> 
> $ ls -lan /mnt/mapped/
> total 5
> drwxr-xr-x 2 2000 2000   32 Okt 24 13:36 .
> drwxr-xr-x 6    0    0 4096 Okt 24 13:38 ..
> -rw-r--r-- 1 2000 2000    5 Okt 24 13:36 test_file
> 
> Signed-off-by: Michael Weiß <michael.weiss@aisec.fraunhofer.de>

Looks OK.

Reviewed-by: Phillip Lougher <phillip@squashfs.org.uk>

> ---
>   fs/squashfs/super.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/fs/squashfs/super.c b/fs/squashfs/super.c
> index 32565dafa7f3..2636cb354435 100644
> --- a/fs/squashfs/super.c
> +++ b/fs/squashfs/super.c
> @@ -568,7 +568,7 @@ static struct file_system_type squashfs_fs_type = {
>   	.init_fs_context = squashfs_init_fs_context,
>   	.parameters = squashfs_fs_parameters,
>   	.kill_sb = kill_block_super,
> -	.fs_flags = FS_REQUIRES_DEV
> +	.fs_flags = FS_REQUIRES_DEV | FS_ALLOW_IDMAP,
>   };
>   MODULE_ALIAS_FS("squashfs");
>