[RFC,0/2] ovl: add override_creds mount option

Message

Christian Brauner Feb. 14, 2025, 4:45 p.m. UTC

Hey,

Currently overlayfs uses the mounter's credentials for it's
override_creds() calls. That provides a consistent permission model.

This patches allows a caller to instruct overlayfs to use its
credentials instead. The caller must be located in the same user
namespace as the user namespace the overlayfs instance will be mounted
in. This provides a consistent and simple security model.

With this it is possible to e.g., mount an overlayfs instance where the
mounter must have CAP_SYS_ADMIN but the credentials used for
override_creds() have dropped CAP_SYS_ADMIN. It also allows the usage of
custom fs{g,u}id different from the callers and other tweaks.

I'm marking this as RFC since I've written this down pretty quickly and
I'm not sure I've thought enough about all the possible pitfalls. I
think overall the concept is sound but there might be additional changes
needed in ovl_fill_super(). Right now I'm just calling override_creds()
when creating the index and work directories.

Thanks!
Christian

Signed-off-by: Christian Brauner <[e-mail]>
---
Christian Brauner (2):
      ovl: allow to specify override credentials
      selftests/ovl: add selftests for "override_creds"

 fs/overlayfs/ovl_entry.h                           |   1 +
 fs/overlayfs/params.c                              |  25 +++++
 fs/overlayfs/super.c                               |  13 ++-
 .../filesystems/overlayfs/set_layers_via_fds.c     | 109 +++++++++++++++++++++
 4 files changed, 147 insertions(+), 1 deletion(-)
---
base-commit: 7a54947e727b6df840780a66c970395ed9734ebe
change-id: 20250214-work-overlayfs-dfcfc4cd7ebd