mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed
* [PATCH 1/2] ovl: fix mount setup failing when override_creds drops CAP_SYS_ADMIN
@ 2026-09-24 11:28 Disha Goel
  2026-09-24 11:28 ` [PATCH 2/2] ovl: fix wrong layer paths in mountinfo for detached mount FDs Disha Goel
  0 siblings, 1 reply; 2+ messages in thread
From: Disha Goel @ 2026-09-24 11:28 UTC (permalink / raw)
  To: miklos, amir73il
  Cc: brauner, viro, jack, shuah, linux-unionfs, linux-fsdevel,
	linux-kselftest, linux-kernel, Disha Goel, stable

When a process drops CAP_SYS_ADMIN and calls fsconfig(FSCONFIG_SET_FLAG,
"override_creds"), overlayfs saves those restricted credentials in
ofs->creator_cred.  ovl_fill_super() then wrapped the entire mount setup
in with_ovl_creds(), switching to those restricted credentials for the
duration.

Mount setup calls clone_private_mount(), which checks CAP_SYS_ADMIN
against current credentials.  With restricted credentials active, this
check fails with -EPERM and the mount fails even though the calling
process is fully privileged.

Mount setup is a one-time privileged operation and must run under the
caller's credentials.  with_ovl_creds() belongs only in post-mount I/O
paths.  Remove it from ovl_fill_super().

Fixes: 539a0879de47 ("ovl: allow to specify override credentials")
Cc: stable@vger.kernel.org
Signed-off-by: Disha Goel <disgoel@linux.ibm.com>
---
 fs/overlayfs/super.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
index bd0a3f9039d2..29f9489b8242 100644
--- a/fs/overlayfs/super.c
+++ b/fs/overlayfs/super.c
@@ -1557,8 +1557,12 @@ int ovl_fill_super(struct super_block *sb, struct fs_context *fc)
 			goto out_err;
 	}
 
-	with_ovl_creds(sb)
-		err = ovl_fill_super_creds(fc, sb);
+	/*
+	 * Mount setup must run under the caller's credentials, not
+	 * creator_cred: clone_private_mount() requires CAP_SYS_ADMIN,
+	 * which override_creds may have dropped.
+	 */
+	err = ovl_fill_super_creds(fc, sb);
 
 out_err:
 	if (err) {
-- 
2.45.1


^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, other threads:[~2026-09-24 11:29 UTC | newest]

Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-09-24 11:28 [PATCH 1/2] ovl: fix mount setup failing when override_creds drops CAP_SYS_ADMIN Disha Goel
2026-09-24 11:28 ` [PATCH 2/2] ovl: fix wrong layer paths in mountinfo for detached mount FDs Disha Goel

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox

all inboxes | Powered by JetHome®