From patchwork Mon Feb 17 10:20:29 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Christian Brauner X-Patchwork-Id: 13977502 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0E573217678; Mon, 17 Feb 2025 10:20:42 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1739787644; cv=none; b=DOLYlH/+DrfePR1AwmLHy06DXTtnISLid/BqCaNNcO2iEzzOFIzMeSpZ7NcNZ3b4/joGyHht91ZsF7MqXIj1CeCeoGumtgA458fVp0/bNtE+4TpTiUJpfROI5RarT67U9yf34fxFCBd4fiztcE62VnILTaYPOkd89+yQWraCCE0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1739787644; c=relaxed/simple; bh=WGm3EsRfuAsH/inUGgB8AWi/uc4avEW2hUSantZkxTE=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=eURigl+lzaNM4X3wmd/xL7sw+n/XzETsDzMMVOZI5mn5tQ6DIVyzPZaHZ5PV/4fdde1UPtpBhbviBwJQEgOa8uti/L1w0GloF11zehQRSu5vXOxXWYPC01FOxMlgNl/iYCGTsmw7WiJ2B8jFu13YCNB4EQbHa50ehpRD5b6zz28= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=U4BOodQY; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="U4BOodQY" Received: by smtp.kernel.org (Postfix) with ESMTPSA id EA945C4CEE4; Mon, 17 Feb 2025 10:20:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1739787642; bh=WGm3EsRfuAsH/inUGgB8AWi/uc4avEW2hUSantZkxTE=; h=From:Date:Subject:References:In-Reply-To:To:Cc:From; b=U4BOodQYZ3GkopGzVn6zzUIfwpNeuf/ezYHIiMZVg76tPNTrCWR5txOxOGWn7C+PF lA+2EhLjDunNMR9bhRH3EC/95fG2pp0RTPNkha59fO/MEAc8XtmZ8OSmxL4MhpYB5o Wa/VwXKpUenE/9f5gy2iC7QucegynUfaSmQ9g1nLGn/qxcX1HsA7q1IblIRQvW/5is 2mYOMA4B0v1buRdBK6c0/bq0unN9l/mtWQUQd1H6qjM8ddVUCUikpfVSzl+yi+THcf IehR2uFvIApnORxrh4/DE+yPoTds0aPTyce//cZCjmZ1exPS5F22mZTpzo+RieUbQk 76hoczcRL+GWg== From: Christian Brauner Date: Mon, 17 Feb 2025 11:20:29 +0100 Subject: [PATCH RFC v2 1/2] ovl: allow to specify override credentials Precedence: bulk X-Mailing-List: linux-fsdevel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Message-Id: <20250217-work-overlayfs-v2-1-41dfe7718963@kernel.org> References: <20250217-work-overlayfs-v2-0-41dfe7718963@kernel.org> In-Reply-To: <20250217-work-overlayfs-v2-0-41dfe7718963@kernel.org> To: Miklos Szeredi , Amir Goldstein , Seth Forshee Cc: Gopal Kakivaya , linux-unionfs@vger.kernel.org, linux-fsdevel@vger.kernel.org, Christian Brauner X-Mailer: b4 0.15-dev-d23a9 X-Developer-Signature: v=1; a=openpgp-sha256; l=3587; i=brauner@kernel.org; h=from:subject:message-id; bh=WGm3EsRfuAsH/inUGgB8AWi/uc4avEW2hUSantZkxTE=; b=owGbwMvMwCU28Zj0gdSKO4sYT6slMaRv5i2bZKGoM12ksX/xwYu/MxgmG+VcfRl10qKjL8rw8 CyWh35tHaUsDGJcDLJiiiwO7Sbhcst5KjYbZWrAzGFlAhnCwMUpABOplGdk+J38/NCdExXWK/MU Tlzq9tdLrow7aLTA+0r21+l9sVfr3zEyTBFKktD41q3PkxRU8+3a5VlJt5z+P/LmNG8IvG57pGc NKwA= X-Developer-Key: i=brauner@kernel.org; a=openpgp; fpr=4880B8C9BD0E5106FC070F4F7B3C391EFEA93624 Currently overlayfs uses the mounter's credentials for it's override_creds() calls. That provides a consistent permission model. This patches allows a caller to instruct overlayfs to use its credentials instead. The caller must be located in the same user namespace as the user namespace the overlayfs instance will be mounted in. This provides a consistent and simple security model. With this it is possible to e.g., mount an overlayfs instance where the mounter must have CAP_SYS_ADMIN but the credentials used for override_creds() have dropped CAP_SYS_ADMIN. It also allows the usage of custom fs{g,u}id different from the callers and other tweaks. Signed-off-by: Christian Brauner Reviewed-by: Amir Goldstein --- fs/overlayfs/params.c | 22 ++++++++++++++++++++++ fs/overlayfs/super.c | 11 ++++++++++- 2 files changed, 32 insertions(+), 1 deletion(-) diff --git a/fs/overlayfs/params.c b/fs/overlayfs/params.c index 1115c22deca0..f2bc8acf6bf1 100644 --- a/fs/overlayfs/params.c +++ b/fs/overlayfs/params.c @@ -59,6 +59,7 @@ enum ovl_opt { Opt_metacopy, Opt_verity, Opt_volatile, + Opt_override_creds, }; static const struct constant_table ovl_parameter_bool[] = { @@ -155,6 +156,7 @@ const struct fs_parameter_spec ovl_parameter_spec[] = { fsparam_enum("metacopy", Opt_metacopy, ovl_parameter_bool), fsparam_enum("verity", Opt_verity, ovl_parameter_verity), fsparam_flag("volatile", Opt_volatile), + fsparam_flag_no("override_creds", Opt_override_creds), {} }; @@ -662,6 +664,26 @@ static int ovl_parse_param(struct fs_context *fc, struct fs_parameter *param) case Opt_userxattr: config->userxattr = true; break; + case Opt_override_creds: { + const struct cred *cred = ofs->creator_cred; + + if (!result.negated) { + if (fc->user_ns != current_user_ns()) { + err = -EINVAL; + break; + } + + ofs->creator_cred = prepare_creds(); + if (!ofs->creator_cred) { + err = -EINVAL; + break; + } + } else { + ofs->creator_cred = NULL; + } + put_cred(cred); + break; + } default: pr_err("unrecognized mount option \"%s\" or missing value\n", param->key); diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c index 86ae6f6da36b..a85071fe18fd 100644 --- a/fs/overlayfs/super.c +++ b/fs/overlayfs/super.c @@ -1305,6 +1305,7 @@ int ovl_fill_super(struct super_block *sb, struct fs_context *fc) { struct ovl_fs *ofs = sb->s_fs_info; struct ovl_fs_context *ctx = fc->fs_private; + const struct cred *old_cred = NULL; struct dentry *root_dentry; struct ovl_entry *oe; struct ovl_layer *layers; @@ -1318,10 +1319,15 @@ int ovl_fill_super(struct super_block *sb, struct fs_context *fc) sb->s_d_op = &ovl_dentry_operations; err = -ENOMEM; - ofs->creator_cred = cred = prepare_creds(); + if (!ofs->creator_cred) + ofs->creator_cred = cred = prepare_creds(); + else + cred = (struct cred *)ofs->creator_cred; if (!cred) goto out_err; + old_cred = ovl_override_creds(sb); + err = ovl_fs_params_verify(ctx, &ofs->config); if (err) goto out_err; @@ -1481,6 +1487,7 @@ int ovl_fill_super(struct super_block *sb, struct fs_context *fc) sb->s_root = root_dentry; + ovl_revert_creds(old_cred); return 0; out_free_oe: @@ -1488,6 +1495,8 @@ int ovl_fill_super(struct super_block *sb, struct fs_context *fc) out_err: ovl_free_fs(ofs); sb->s_fs_info = NULL; + if (old_cred) + ovl_revert_creds(old_cred); return err; } From patchwork Mon Feb 17 10:20:30 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Christian Brauner X-Patchwork-Id: 13977503 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1E395217678; Mon, 17 Feb 2025 10:20:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1739787646; cv=none; b=ldXCGBklU9eq8aoQwhmCDVsXg0jPW6tI8oKCEKPSDGCetyDa14svPnzzs9wlzeeNxgq+3TC04Zh7rmMZMdLpmyNp5WJ+BPQCwBI68T6JULWIefG5J9sp14nztlZQBmEr4gB6XtdmSr1TQWbLqmX6DHlMvZaoNgT/cNDPuR5zFp0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1739787646; c=relaxed/simple; bh=hhlmQBgSfHwKmRW6xFe03YCHZsaMERLa/kMgHcJ1vtc=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=ENlf8+2Sza+wECFoxi86DJvUn+4GhSO32p81YRt7oafOXa/l69KnhfM9PBEEjI896uYDfRNFJYPYOicU3LQOoWHXQRRrVYcuQhu6QkyAnixuCAHEDRgjaitX9AxQiT/PjnljqqvE+EQEaIKJ/ExjFgPx7GM2Jvn03ocfvB8rCc4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=LE9cN0cy; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="LE9cN0cy" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 00136C4CEE2; Mon, 17 Feb 2025 10:20:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1739787644; bh=hhlmQBgSfHwKmRW6xFe03YCHZsaMERLa/kMgHcJ1vtc=; h=From:Date:Subject:References:In-Reply-To:To:Cc:From; b=LE9cN0cypZm9VIb1bSxYMKzGmlW5uWpURkHtFv/2kYBfDTcYwHpoSxQAy5suSczTi fCkmzpia1p7lC6/A3WYI7B6JbI17fCPJPJMc5XGetjbEhsGxOWDvLScOGOuPdgfh1J XiPkRIdLAMlh+EkboLaPMHpbLhfLsL1+G+Hi5WdhXYSPqqxqd6ySkG6JXuFpCnPmNg WVy+QyoNHFYRTqKUo3AEr4fA6cUMicyQVgsdTE/YDeCyPcH5J7wrmNSW2I3dJQhQHO 1dqKjRAOi9OA8/MVbEdzKLxj6GmDZpi56dVpLAy5R7qOODgOBciCYudCIaEiz0Xsj5 w2BXDuwRiqxyg== From: Christian Brauner Date: Mon, 17 Feb 2025 11:20:30 +0100 Subject: [PATCH RFC v2 2/2] selftests/ovl: add selftests for "override_creds" Precedence: bulk X-Mailing-List: linux-fsdevel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Message-Id: <20250217-work-overlayfs-v2-2-41dfe7718963@kernel.org> References: <20250217-work-overlayfs-v2-0-41dfe7718963@kernel.org> In-Reply-To: <20250217-work-overlayfs-v2-0-41dfe7718963@kernel.org> To: Miklos Szeredi , Amir Goldstein , Seth Forshee Cc: Gopal Kakivaya , linux-unionfs@vger.kernel.org, linux-fsdevel@vger.kernel.org, Christian Brauner X-Mailer: b4 0.15-dev-d23a9 X-Developer-Signature: v=1; a=openpgp-sha256; l=3988; i=brauner@kernel.org; h=from:subject:message-id; bh=hhlmQBgSfHwKmRW6xFe03YCHZsaMERLa/kMgHcJ1vtc=; b=owGbwMvMwCU28Zj0gdSKO4sYT6slMaRv5i27/3YFx6f8hf9i/a6sdkz20FTeom15SPyXIbtno b/YwZseHaUsDGJcDLJiiiwO7Sbhcst5KjYbZWrAzGFlAhnCwMUpABNRPs7IsNzzRLVUPdezRdOk Odis1Exj725gkdxVnrDc62TOu7geeUaGe5+rhPO+v4t39mP+vuXgl+JWffkTW+e9fb3zpe2zf4F n2AE= X-Developer-Key: i=brauner@kernel.org; a=openpgp; fpr=4880B8C9BD0E5106FC070F4F7B3C391EFEA93624 Add a simple test to verify that the new "override_creds" option works. Signed-off-by: Christian Brauner Reviewed-by: Amir Goldstein --- .../filesystems/overlayfs/set_layers_via_fds.c | 89 ++++++++++++++++++++++ 1 file changed, 89 insertions(+) diff --git a/tools/testing/selftests/filesystems/overlayfs/set_layers_via_fds.c b/tools/testing/selftests/filesystems/overlayfs/set_layers_via_fds.c index e65d95d97846..6c9f4df5df8d 100644 --- a/tools/testing/selftests/filesystems/overlayfs/set_layers_via_fds.c +++ b/tools/testing/selftests/filesystems/overlayfs/set_layers_via_fds.c @@ -6,11 +6,13 @@ #include #include #include +#include #include #include #include #include "../../kselftest_harness.h" +#include "../../pidfd/pidfd.h" #include "log.h" #include "wrappers.h" @@ -409,4 +411,91 @@ TEST_F(set_layers_via_fds, set_layers_via_detached_mount_fds) ASSERT_EQ(fclose(f_mountinfo), 0); } +TEST_F(set_layers_via_fds, set_override_creds) +{ + int fd_context, fd_tmpfs, fd_overlay; + int layer_fds[] = { [0 ... 3] = -EBADF }; + pid_t pid; + int pidfd; + + ASSERT_EQ(unshare(CLONE_NEWNS), 0); + ASSERT_EQ(sys_mount(NULL, "/", NULL, MS_SLAVE | MS_REC, NULL), 0); + + fd_context = sys_fsopen("tmpfs", 0); + ASSERT_GE(fd_context, 0); + + ASSERT_EQ(sys_fsconfig(fd_context, FSCONFIG_CMD_CREATE, NULL, NULL, 0), 0); + fd_tmpfs = sys_fsmount(fd_context, 0, 0); + ASSERT_GE(fd_tmpfs, 0); + ASSERT_EQ(close(fd_context), 0); + + ASSERT_EQ(mkdirat(fd_tmpfs, "w", 0755), 0); + ASSERT_EQ(mkdirat(fd_tmpfs, "u", 0755), 0); + ASSERT_EQ(mkdirat(fd_tmpfs, "l1", 0755), 0); + ASSERT_EQ(mkdirat(fd_tmpfs, "l2", 0755), 0); + + layer_fds[0] = openat(fd_tmpfs, "w", O_DIRECTORY); + ASSERT_GE(layer_fds[0], 0); + + layer_fds[1] = openat(fd_tmpfs, "u", O_DIRECTORY); + ASSERT_GE(layer_fds[1], 0); + + layer_fds[2] = openat(fd_tmpfs, "l1", O_DIRECTORY); + ASSERT_GE(layer_fds[2], 0); + + layer_fds[3] = openat(fd_tmpfs, "l2", O_DIRECTORY); + ASSERT_GE(layer_fds[3], 0); + + ASSERT_EQ(sys_move_mount(fd_tmpfs, "", -EBADF, "/tmp", MOVE_MOUNT_F_EMPTY_PATH), 0); + ASSERT_EQ(close(fd_tmpfs), 0); + + fd_context = sys_fsopen("overlay", 0); + ASSERT_GE(fd_context, 0); + + ASSERT_NE(sys_fsconfig(fd_context, FSCONFIG_SET_FD, "lowerdir", NULL, layer_fds[2]), 0); + + ASSERT_EQ(sys_fsconfig(fd_context, FSCONFIG_SET_FD, "workdir", NULL, layer_fds[0]), 0); + ASSERT_EQ(sys_fsconfig(fd_context, FSCONFIG_SET_FD, "upperdir", NULL, layer_fds[1]), 0); + ASSERT_EQ(sys_fsconfig(fd_context, FSCONFIG_SET_FD, "lowerdir+", NULL, layer_fds[2]), 0); + ASSERT_EQ(sys_fsconfig(fd_context, FSCONFIG_SET_FD, "lowerdir+", NULL, layer_fds[3]), 0); + + ASSERT_EQ(sys_fsconfig(fd_context, FSCONFIG_SET_STRING, "metacopy", "on", 0), 0); + + pid = create_child(&pidfd, CLONE_NEWUSER); + EXPECT_GE(pid, 0); + if (pid == 0) { + if (!sys_fsconfig(fd_context, FSCONFIG_SET_FLAG, "override_creds", NULL, 0)) { + TH_LOG("sys_fsconfig should have failed"); + _exit(EXIT_FAILURE); + } + + _exit(EXIT_SUCCESS); + } + EXPECT_EQ(sys_waitid(P_PID, pid, NULL, WEXITED), 0); + EXPECT_EQ(close(pidfd), 0); + + pid = create_child(&pidfd, 0); + EXPECT_GE(pid, 0); + if (pid == 0) { + if (sys_fsconfig(fd_context, FSCONFIG_SET_FLAG, "override_creds", NULL, 0)) { + TH_LOG("sys_fsconfig should have succeeded"); + _exit(EXIT_FAILURE); + } + + _exit(EXIT_SUCCESS); + } + EXPECT_EQ(sys_waitid(P_PID, pid, NULL, WEXITED), 0); + EXPECT_EQ(close(pidfd), 0); + + ASSERT_EQ(sys_fsconfig(fd_context, FSCONFIG_CMD_CREATE, NULL, NULL, 0), 0); + + fd_overlay = sys_fsmount(fd_context, 0, 0); + ASSERT_GE(fd_overlay, 0); + + ASSERT_EQ(sys_move_mount(fd_overlay, "", -EBADF, "/set_layers_via_fds", MOVE_MOUNT_F_EMPTY_PATH), 0); + + ASSERT_EQ(close(fd_context), 0); + ASSERT_EQ(close(fd_overlay), 0); +} + TEST_HARNESS_MAIN