On Thu, Sep 24, 2026 at 1:29 PM Disha Goel <[email protected]> wrote:
>
> When a process drops CAP_SYS_ADMIN and calls fsconfig(FSCONFIG_SET_FLAG,
> "override_creds"), overlayfs saves those restricted credentials in
> ofs->creator_cred. ovl_fill_super() then wrapped the entire mount setup
> in with_ovl_creds(), switching to those restricted credentials for the
> duration.
>
> Mount setup calls clone_private_mount(), which checks CAP_SYS_ADMIN
> against current credentials. With restricted credentials active, this
> check fails with -EPERM and the mount fails even though the calling
> process is fully privileged.
>
> Mount setup is a one-time privileged operation and must run under the
> caller's credentials. with_ovl_creds() belongs only in post-mount I/O
> paths. Remove it from ovl_fill_super().
>
> Fixes: 539a0879de47 ("ovl: allow to specify override credentials")
> Cc: [email protected]
> Signed-off-by: Disha Goel <[email protected]>
> ---
Hi Disha,
Thanks for the report!
> fs/overlayfs/super.c | 8 ++++++--
> 1 file changed, 6 insertions(+), 2 deletions(-)
>
> diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
> index bd0a3f9039d2..29f9489b8242 100644
> --- a/fs/overlayfs/super.c
> +++ b/fs/overlayfs/super.c
> @@ -1557,8 +1557,12 @@ int ovl_fill_super(struct super_block *sb, struct
> fs_context *fc)
> goto out_err;
> }
>
> - with_ovl_creds(sb)
> - err = ovl_fill_super_creds(fc, sb);
> + /*
> + * Mount setup must run under the caller's credentials, not
> + * creator_cred: clone_private_mount() requires CAP_SYS_ADMIN,
> + * which override_creds may have dropped.
> + */
> + err = ovl_fill_super_creds(fc, sb);
Without ovl creds, the name of this helper is a bit odd..
>
> out_err:
> if (err) {
> --
> 2.45.1
>
Chritian,
I see that selftests are failing on upstream:
# RUN set_layers_via_fds.set_override_creds_nomknod ...
[520332.680688] overlayfs: failed to clone upperpath
# set_layers_via_fds.c:516:set_override_creds_nomknod:Expected
sys_fsconfig(fd_context, FSCONFIG_CMD_CREATE, NULL, NULL, 0) (-1) == 0
(0)
# set_override_creds_nomknod: Test terminated by assertion
# FAIL set_layers_via_fds.set_override_creds_nomknod
# RUN set_layers_via_fds.set_layers_via_detached_mount_fds ...
# set_layers_via_fds.c:711:set_layers_via_detached_mount_fds:Expected
layers_found[i] (0) == true (1)
# set_layers_via_fds.c:39:set_layers_via_detached_mount_fds:Expected
rmdir("/set_layers_via_fds") (-1) == 0 (0)
# set_layers_via_detached_mount_fds: Test terminated by assertion
# FAIL set_layers_via_fds.set_layers_via_detached_mount_fds
not ok 7 set_layers_via_fds.set_layers_via_detached_mount_fds
oops, I thought these were running in CI...
Apparently failing since v6.16-rc1
c28f922c9dcee ("clone_private_mnt(): make sure that caller has
CAP_SYS_ADMIN in the right userns")
The question is whether doing the guts of ovl_fill_super() with checks like
int ovl_can_decode_fh(struct super_block *sb)
{
if (!capable(CAP_DAC_READ_SEARCH))
Without the user provided override_cred is the right thing to do.
Could lead to confusing state post mount.
Thoughts?
Thanks,
Amir.
