When a process drops CAP_SYS_ADMIN and calls fsconfig(FSCONFIG_SET_FLAG,
"override_creds"), overlayfs saves those restricted credentials in
ofs->creator_cred. ovl_fill_super() then wrapped the entire mount setup
in with_ovl_creds(), switching to those restricted credentials for the
duration.
Mount setup calls clone_private_mount(), which checks CAP_SYS_ADMIN
against current credentials. With restricted credentials active, this
check fails with -EPERM and the mount fails even though the calling
process is fully privileged.
Mount setup is a one-time privileged operation and must run under the
caller's credentials. with_ovl_creds() belongs only in post-mount I/O
paths. Remove it from ovl_fill_super().
Fixes: 539a0879de47 ("ovl: allow to specify override credentials")
Cc: [email protected]
Signed-off-by: Disha Goel <[email protected]>
---
fs/overlayfs/super.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
index bd0a3f9039d2..29f9489b8242 100644
--- a/fs/overlayfs/super.c
+++ b/fs/overlayfs/super.c
@@ -1557,8 +1557,12 @@ int ovl_fill_super(struct super_block *sb, struct
fs_context *fc)
goto out_err;
}
- with_ovl_creds(sb)
- err = ovl_fill_super_creds(fc, sb);
+ /*
+ * Mount setup must run under the caller's credentials, not
+ * creator_cred: clone_private_mount() requires CAP_SYS_ADMIN,
+ * which override_creds may have dropped.
+ */
+ err = ovl_fill_super_creds(fc, sb);
out_err:
if (err) {
--
2.45.1
