[PATCH bpf-next] bpf: use FS_USERNS_DELEGATABLE for bpffs

[PATCH bpf-next] bpf: use FS_USERNS_DELEGATABLE for bpffs

[Alexander Mikhalitsyn]

Instead of FS_USERNS_MOUNT we should use recently introduced [1]
FS_USERNS_DELEGATABLE cause it better expresses what we
really want to get there. Filesystem should not be allowed
to be mounted by an unprivileged user, but at the same time
we want to have sb->s_user_ns to point to the container's
user namespace, at the same time superblock should be allowed
be created only if capable(CAP_SYS_ADMIN) check is successful.

Tested and no regressions noticed.

No functional change intended.

Link: https://lore.kernel.org/all/20260129-twmount-v1-1-4874ed2a15c4@kernel.org/ [1]
Signed-off-by: Alexander Mikhalitsyn <alex@amutable.com>
---
 kernel/bpf/inode.c | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/kernel/bpf/inode.c b/kernel/bpf/inode.c
index c6f328e4752e..e8ec41f095fd 100644
--- a/kernel/bpf/inode.c
+++ b/kernel/bpf/inode.c
@@ -1188,10 +1188,6 @@ static int bpf_fill_super(struct super_block *sb, struct fs_context *fc)
 	struct bpf_mount_opts *opts = sb->s_fs_info;
 	struct inode *inode;
 
-	/* Mounting an instance of BPF FS requires privileges */
-	if (fc->user_ns != &init_user_ns && !capable(CAP_SYS_ADMIN))
-		return -EPERM;
-
 	sb->s_blocksize = PAGE_SIZE;
 	sb->s_blocksize_bits = PAGE_SHIFT;
 	sb->s_magic = BPF_FS_MAGIC;
@@ -1280,7 +1276,7 @@ static struct file_system_type bpf_fs_type = {
 	.init_fs_context = bpf_init_fs_context,
 	.parameters	= bpf_fs_parameters,
 	.kill_sb	= bpf_kill_super,
-	.fs_flags	= FS_USERNS_MOUNT,
+	.fs_flags	= FS_USERNS_DELEGATABLE,
 };
 
 static void bpf_fs_inode_init_once(void *foo)
-- 
2.47.3

Re: [PATCH bpf-next] bpf: use FS_USERNS_DELEGATABLE for bpffs

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to bpf/bpf-next.git (master)
by Alexei Starovoitov <ast@kernel.org>:

On Tue,  3 Nov 2026 11:14:05 +0100 you wrote:
> Instead of FS_USERNS_MOUNT we should use recently introduced [1]
> FS_USERNS_DELEGATABLE cause it better expresses what we
> really want to get there. Filesystem should not be allowed
> to be mounted by an unprivileged user, but at the same time
> we want to have sb->s_user_ns to point to the container's
> user namespace, at the same time superblock should be allowed
> be created only if capable(CAP_SYS_ADMIN) check is successful.
> 
> [...]

Here is the summary with links:
  - [bpf-next] bpf: use FS_USERNS_DELEGATABLE for bpffs
    https://git.kernel.org/bpf/bpf-next/c/cd8a2d402273

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html