From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.openvz.org (mail.openvz.org [69.168.225.77]) by lore.virtuozzo.com (Postfix) with ESMTPS id 3D6848017D for ; Mon, 9 Nov 2026 19:57:59 +0000 (UTC) Received: from mail.openvz.org (localhost [127.0.0.1]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 6A9Jui6p003516; Mon, 9 Nov 2026 22:56:45 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 6A9Jui6p003516 Authentication-Results: mail.openvz.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=virtuozzo.com header.i=@virtuozzo.com header.b="PIBbpPSZ" Received: from mail-pg1-f197.google.com (mail-pg1-f197.google.com [209.85.215.197]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 6A9Jugi1003510 (version=TLSv1/SSLv3 cipher=AES128-GCM-SHA256 bits=128 verify=FAIL) for ; Mon, 9 Nov 2026 22:56:43 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 6A9Jugi1003510 Received: by mail-pg1-f197.google.com with SMTP id 41be03b00d2f7-cc7361c62b9so813046a12.3 for ; Mon, 09 Nov 2026 11:56:42 -0800 (PST) X-Gm-Message-State: APuU4Z/hc2EQda0mrzFMoDU7WKmnajDKo4+75Zs6XeOhsRL8phyzn3RX L5MaG2+LObbG0MOzZ5Ekqo90dy2rpbqCecpj7Hu8G+BUHVx5tO9ETmJS91kSMQs5y1jqqTynDuH 9O+6mESEQ0Fnxjv7xLG7iH/cADvEolavQ22cD3jHkeh5kcvS3NNad/g== X-Gm-Gg: AYBFou3nqsMOsfkosRGMC1mQdaiLBmBi9Z327rssHwA37Jp1tLt4Ymi82lyPka391vv vsNXTldJuuaWRCcADYSKH5Kj9Kv39tUtBPBieVE8WwLuFVqo75+f3FztOwoatiSYD0iKEruU7lc /HAspeLXt6peZJKta00Pyh23HyaKeq1iN9+PXLrT4l3rR+JRDtkdDlBgoDbbtn1MsepvOwJdFey btsQfa2zlu96DSUcb2CKkOhCDODj8BJR8z0xzLRWoU0Rn+M/yktW94GkEhCkKo2GDts6IgXsxsR BHKgqpHY3hjjZr/0EzE8sB1je+E14RduOay1t1SCeSehzA1Ony8kYsb8vvTpHvpg27nOLjA6jJv 5kIP5vtm1/BUjyIYuyk9b8nSh8UL1c6rmqYrdksM/KcbV5lTSzzHI0XLXoYZib7nafqP6TFZMow lwfaBSSeowRrOuwlX+0CXrvmqdYI4rQlzy5Q== X-Received: by 2002:a05:6a20:9595:b0:3e2:8c8f:f11a with SMTP id adf61e73a8af0-3f18f892340mr191989637.59.1794254201603; Mon, 09 Nov 2026 11:56:41 -0800 (PST) X-Received: by 2002:a05:6a20:9595:b0:3e2:8c8f:f11a with SMTP id adf61e73a8af0-3f18f892340mr191968637.59.1794254201105; Mon, 09 Nov 2026 11:56:41 -0800 (PST) ARC-Seal: i=2; a=rsa-sha256; t=1794254201; cv=pass; d=google.com; s=arc-20260327; b=KsgbUhP0VlhSBFYNynPSvmF7ihCDyM8yNJKt12Be51wBaxs9kAfCNYiexmItUhht4Z JiFOOmOOfwPuqbetGE+LlZm/WtGc41nSpshThm/+MYOJWtEH78IljiXnFod2SWhht3mI iDI6x2ER1rCckoQVnt0GM3djLh8LYVrhcFe6aViaDtaJosPbVYqD/cNlprEhlDa0Bhjy e3AIDsKMXQeqMjDmL4jF0z4qT/HYmlpyr688gCytF7tWFU6tPFxjvA3rv/fwg980zi9R vqZNoVy/NZIrIHWPinp6vcks7PxbfYMBG6+TESjuUOFb5O+e65w3eyuax++cVRGw/Yl4 aF5Q== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=mime-version:content-transfer-encoding:in-reply-to:from :content-language:references:cc:to:subject:user-agent:date :message-id:dkim-signature; bh=GgkflIelM5mGPDOqpjyVoMD99btp0yEWRIp6RleA1PA=; fh=zb8v94HIydbT+fODnrL16oDT0rhznlRsQrQclEqomio=; b=PPUInEsMDk+VZRXReiK2jZLZkP06xe3hdGJWpYjprodlI9R2XRxA+0UmpyySKk0/Q+ nS/geE+tGbgcFwkZgr25GP1vP0+/QFqD8WkcuvCOBGIecPTY9vEEh4n/hYXMC4ur8PaJ Mo0BSxb2Y4JLPJB0OaQpYFcpLC1DGtlFC5+3wNqPBbHGL7PAGZtS1163HiZdDFDrZ9gI j3SJSgF9peG3lKC5NLo/16lKbpTGNnQsfENmB7ytFBiupDDVeyFq6WPA6qOonLRz9uqR hdLvHsqB0dnzZcgG58qIcDCSj0arummrqgz0cwIKdhvw86CQeFJ7XTynNztFv0GWwm2r 6yPg==; dara=google.com ARC-Authentication-Results: i=2; mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=selector2 header.b=PIBbpPSZ; arc=pass (i=1 spf=pass spfdomain=virtuozzo.com dkim=pass dkdomain=virtuozzo.com dmarc=pass fromdomain=virtuozzo.com); spf=pass (google.com: domain of vladimir.riabchun@virtuozzo.com designates 2a01:111:f403:c207::3 as permitted sender) smtp.mailfrom=vladimir.riabchun@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com Received: from MRWPR03CU001.outbound.protection.outlook.com (mail-francesouthazlp170110003.outbound.protection.outlook.com. [2a01:111:f403:c207::3]) by mx.google.com with ESMTPS id d2e1a72fcca58-8baad301de1si389459b3a.210.2026.11.09.11.56.40 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 09 Nov 2026 11:56:41 -0800 (PST) Received-SPF: pass (google.com: domain of vladimir.riabchun@virtuozzo.com designates 2a01:111:f403:c207::3 as permitted sender) client-ip=2a01:111:f403:c207::3; Authentication-Results: mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=selector2 header.b=PIBbpPSZ; arc=pass (i=1 spf=pass spfdomain=virtuozzo.com dkim=pass dkdomain=virtuozzo.com dmarc=pass fromdomain=virtuozzo.com); spf=pass (google.com: domain of vladimir.riabchun@virtuozzo.com designates 2a01:111:f403:c207::3 as permitted sender) smtp.mailfrom=vladimir.riabchun@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=JKWXHW9WlTVScI4Gx97MeiJuf4MW1clMWVlJavvwtybOV3qv1zpGC95Yov31OOlF6RjCLCxBXZT75M2HE1myzz0RPvtqbmZdGo+z0BUIy4ITsj1XqRn15WQ77vE2KxpiUpYa5yptjpH9qTS3w2qeBGGUk11wTGXgGhg8rkkNGsDKi6CBVhrnW0+4ndoDkgVZZFDI4Z8pMH+AsQn49iNAY99R4UgMolFCrmr0sZvmEa7i0gd2EA3LM9c/8MFLFeaSd3n217VJ3bF4zSIHRwwFaFGAa6tN0IZUbZMdXsMmRVShguyydy4RkXbp4ieEGwt9wp7pDQulrzKUVyGYcjTgog== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=GgkflIelM5mGPDOqpjyVoMD99btp0yEWRIp6RleA1PA=; b=Dn1QHBQaibBJ/AIFnio/fIXa78gfXPYsjB+Vqjsv2y9jvcF5Ghk8njcG1s4N62ke9Zxcejajpy0zyiIc/7Q1angoi6PBooEy41JJ6RpXKCd6YTqlx9aJP5UlijbmAlEsvpQMJpcE5iEm2KP8seFdq2kXCv3BnxF0ezvWauYbodestxLu7WE3tkSCEXBVp2GuclkUo6NOCm5MDInh7tZe8Af3MIDCfmn4VLmmALO3XGFpFOH4MKlnrPgZEO7uTpT7UR66zMKJeoXAmFBc1bLG/+FWCMdnZvvajpEszpmhFNXgaZbVtnsTuBs4R+3qCUJjps5Sov4dj55+oHVNVpbhBg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=virtuozzo.com; dmarc=pass action=none header.from=virtuozzo.com; dkim=pass header.d=virtuozzo.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=GgkflIelM5mGPDOqpjyVoMD99btp0yEWRIp6RleA1PA=; b=PIBbpPSZl2S8Hou/+lgr9HqN645sl37S2slHvArGFMBXLQcqfZvB5u+gb+yx6Uj4AJW/7eLCrSkUs17OElEIwY6+4pDYqZ3Zoj3Ns+/w1TMxNYh/egUbrnnnj1xJs+IcdFE5/5c+J95tsYYF38lzWQxs4bD5VESz2rMM00P8d2iBMwxzTBvz7B+1bjSZlD8d3MLwe4wBkrsWtjU5DY4QR5D5WoFh383iTofJLH//GH4QB4Xtuvj0Zsmpqw3NmqS/Cgfvn5FRPWlWcrEH2EF2IOlj92wPymIGU7sLNznRn7yQSeuDKei6sTc6oMK0NyDoN4BSHRWJSVHB4KKAQhoynQ== Authentication-Results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=virtuozzo.com; Received: from MI7PR08MB201474.eurprd08.prod.outlook.com (2603:10a6:290:112::17) by AMBPR08MB066365.eurprd08.prod.outlook.com (2603:10a6:20b:786::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.592.13; Mon, 9 Nov 2026 19:56:38 +0000 Received: from MI7PR08MB201474.eurprd08.prod.outlook.com ([fe80::f35b:af88:bd82:6dfa]) by MI7PR08MB201474.eurprd08.prod.outlook.com ([fe80::f35b:af88:bd82:6dfa%3]) with mapi id 15.21.0592.010; Mon, 9 Nov 2026 19:56:37 +0000 Message-ID: <019fc5a2-1da0-41af-bfe4-ff813ed6e4f5@virtuozzo.com> Date: Mon, 9 Nov 2026 20:56:36 +0100 User-Agent: Mozilla Thunderbird To: ptikhomirov@virtuozzo.com, Konstantin Khorenko References: <20261109-ovl-use-orig-ve-v4-0-88e65484dc5b@virtuozzo.com> <20261109-ovl-use-orig-ve-v4-5-88e65484dc5b@virtuozzo.com> <010701a1c1dbc46a-09b3db06-4bcb-439b-848f-69df34074a4b-000000@eu-central-1.amazonses.com> Content-Language: en-US From: Vladimir Riabchun In-Reply-To: <010701a1c1dbc46a-09b3db06-4bcb-439b-848f-69df34074a4b-000000@eu-central-1.amazonses.com> X-ClientProxiedBy: ZR2P278CA0046.CHEP278.PROD.OUTLOOK.COM (2603:10a6:910:53::19) To MI7PR08MB201474.eurprd08.prod.outlook.com (2603:10a6:290:112::17) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: MI7PR08MB201474:EE_|AMBPR08MB066365:EE_ X-MS-Office365-Filtering-Correlation-Id: 3d996705-bf68-42f0-462f-08df3e9b90b2 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; ARA:13230040|23010399003|376014|1800799024|366016|22082099003|18002099003|6133799003|10067099003|3023799007|4143699003|5023799004|261009223027099003|261102123227099003|261028144727099003|261026121527099003|261022105027099003|56012099006|261022075727099003|261021121427099003|261021135927099003|261026140227099003; X-Microsoft-Antispam-Message-Info: ESoxeCvXycv0O9LKE78W3yPYWU4SMCjxsY7Bz4oMWioaNV+NC03ypgrjoQOGJm33TWJGDEBydoPjkbLhTM2bDWpErJBMwJPV2qeX3zEiQDexaa3uD0wvZUknLJvxHEX3q8nh23+hMcmrhcvn/EvJqk6CftM/PuC69mB1Z9f0HYYzf4Dmv6xsY8Jv/F+WixyonE3NbL1s3kuqcpG21U+M5dQnZ7P+ihyeQuJXzl31VYztLt584Ilz9tTXf6fRvlmDYXwl1zmnlp8ff997XoVeq1tmS1LWeTpHbOvpxp3xbvfZ3AaMcLL6g7EUBiXxiqQw2anshmpG2CBHAjD+ROQlnLVtqFp06bxVUJqYM8Hfhp7ikfaSQVFNoOhLNQ7wq/5dE2l226dkC3G36T5jMcu9iN634saiqGF0LO/rddlmaskREz79kMafLB243pkrg3/l0KsmixiTs/2qPoxHTce9up/GuZRhEIIlg8Ma/7ReuEdaCkAIulhVe4Q2auaXvyaC8ePVG8Rkzmj78xHcxrJlvD0VXP2rk3SutEKDbGIUXW2wzbf7u/NUV0/3UTUYcDlcfJD9xf3oQ4Vq1/5m1auslgW4fSYSJ22JkluBkbFt/toDsP0tMY62gI7fGqPbDJ8R X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:MI7PR08MB201474.eurprd08.prod.outlook.com; PTR:; CAT:NONE; SFS:(13230040)(23010399003)(376014)(1800799024)(366016)(22082099003)(18002099003)(6133799003)(10067099003)(3023799007)(4143699003)(5023799004)(261009223027099003)(261102123227099003)(261028144727099003)(261026121527099003)(261022105027099003)(56012099006)(261022075727099003)(261021121427099003)(261021135927099003)(261026140227099003); DIR:OUT; SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?OWF4ajhTaCt0Z1l0SWVQUHFvYXpQTVc5MlFpYVlaT2pwVmRMTUNxMzhMZkpa?= =?utf-8?B?aGtZeThhOFpzZWNON2hPMkRIRm5xbm1ENmRnMFBTcWwrN3BSRURsUWdnUEJH?= =?utf-8?B?RW1IaExMNGczNDl5Tkg0YnZWVmRzQ0RPV3V6R3VtOUZWMlA2MjU2NjQxTGJ0?= =?utf-8?B?d2FQcjZ0blhaYjZxUThSOEw0em9MbUxZUWg0R1pLcjkvaWt3Nm1TYkdZK1lm?= =?utf-8?B?T0Ezd2ZTVW5seUNPWk4zZ1lRQWlCK3hLaVBPRFZqZzRVMTc3elBiTU85dWxQ?= =?utf-8?B?TXkwUFlteGZYZnBJaU1rRjc2YmZsZHBHUFdrMFMrbmp3M04vL3pJYWtVOHVV?= =?utf-8?B?RkV3WDFBeEJXTUV5bkFkQXBWOVB6ZjZyaGdTMlE0S1VJZzBhWU1XK3pBRDFM?= =?utf-8?B?RGpWWU96MGpYeVFuM1I1U2R3VUZBN09BTTgrS3BRZHMvN2dPeHRHamZWc0J6?= =?utf-8?B?RjhrNFIvZ1hUQnkwMCt5S2NaamhPMkkyelhqRUIxeVNjK1JpYnhJNVBvejB4?= =?utf-8?B?Ni9aUU5tOUk4ckdyS1NnRHFUV3JiNy93ZW1rRmg5bDdIeUFJa1h0Q0x2ZENV?= =?utf-8?B?UWV1andINmI4S29jZGdoM0NOdGlrSHIyNnNGR2dzSzA0RE4xOFhMTjJ3aWRw?= =?utf-8?B?cE40b1lpdFFjbnNrWlROeU5Xdno5WHU1NnRtOFBqZ2k1WTIraW9aSUxrT3Bq?= =?utf-8?B?UXFPbFF6YjY4UXo3UFBlNThIVFlvcFE0dHhROEx4N3dWcXNLa2V0bWJBNmxH?= =?utf-8?B?RzBMNVEvQ3JhR1h3VEs4NVVwbW9pUXRyaTJxY0hXKzhTZFlpVkdEM1BoTkNh?= =?utf-8?B?b3A2NEd0bVh4dkpMMkFUeTlSZzNNdDNtZjQ4SGdnS2hObDZvUU96QXc2cmFq?= =?utf-8?B?dS9ZSGlFNmVGcXBhZkRicVZ0b3lMN1gxM2VDSmtkRkxMLzFWbHZ5dElMSWJn?= =?utf-8?B?blE5aWJrd1hRZzdRZ0RCUVJqenNjSU51QkQrdHd0bldHSXNkNStLVnI5TGpD?= =?utf-8?B?dG5CL0ltMFhTNzM3WmwzZXFPODVtWE42VzlCMngxUStST0RIZ1dSaDl0b01s?= =?utf-8?B?WUtkZ0MyZVJiRlNUMldZb3hNL3BxbHhaNCtITTVDN2EvUkc0UTZsWlJIK09W?= =?utf-8?B?OWtWY0tMcmJPZGVGaXlNRmloZVU3U0VyQWtrTWpiMmpqOFMyTWg5c1lNTFVL?= =?utf-8?B?RVNIRzE5L0hjQlhYVHhXV0djS2RwcndSaDZobmVFNXBDTTdQY0wzYXpHb3d6?= =?utf-8?B?R05ZbmFTcWlvODhNUWJCc0xKUktEQnRla3dzM09mdjlsQ3Jva0pMd1N2NnBK?= =?utf-8?B?K215U2ZhblorYXJhckNjblRva3pJRWdmM3VYM0JLVkZUclhOYzV1MlU3akQr?= =?utf-8?B?VXJaR0dTbDRIcmdZUXY2VnRlTC92YlE5ZHoxaWw0QjlRZTFIYnZhRHU5STNj?= =?utf-8?B?VFgrSTA4WU9sTXpvSTBpd0NNZGh3WE1vMEJqYTlEUUVMaDhaNEFSRWRLYWtW?= =?utf-8?B?RlNUYzU0RmVRdzlaZVJUTUxHdnhhdHJnbDJJYXl0QWtqWVRMdWlYUlY5N2hw?= =?utf-8?B?L3doZHhLYm93SUVuVTF5Q2xPMU9BOFgyZVZ5SkQ5RERQRDJaYzUyR3VsZjdh?= =?utf-8?B?VWx0dmNCZ0pOZW9BVk5XSmZnTFkrbXZRVys4VEVyUWtTWlBOL0krcXU3cUZv?= =?utf-8?B?eDd2OGpwR3JQdm9WaEIzZ3VrQXZlYVpzMGxselN6QlZubzlGUHZHK2d0MDJy?= =?utf-8?B?aHlGZFRMVXVtR1hGVzZMai9WdGxxOWR0YnBFcWJyaGZ6WG4rUUxWbUxGOWdh?= =?utf-8?B?RDRmanBvUHJaODYwYXJ0QlVsUnBMNTdxdDRpR1FLUUpEWDRJY3lmM1dqL2tB?= =?utf-8?B?TXFYT3U4aGtLM2xadDhDV2NKK1dxS3FadEl3TWJFVXFzOWFhdStZU1U5YnU5?= =?utf-8?B?K3hyemtPM0FYSXVnNnhuV21jYmNiMEpXbmpqNS9YUmVybEJld1ExdXBBREpB?= =?utf-8?B?OE5Zc25jQXlDZnBWNnNUL2xlNXBIeVV0TE1NVFNMZytTRUhNaGFSUlRjU0tn?= =?utf-8?B?aC80N0JieDU1cVY4NC96dHVWTWZLNjd0SnBDdkFyYkRCQ2FqdllyVkw4VlNV?= =?utf-8?B?Z2dTWktuOGRwS2FDVHVsWUMwcHU3dVNVUmc0R1J0VlJ6b2E0RFVBaXhLZjBJ?= =?utf-8?B?dkhTbksvZFhwNnJGOGFiTW1DVXJyL0RYRnNIQlEwamxqdkFoc0Q1THh4amwx?= =?utf-8?B?bk5vK1JKMm5ucDZFbVpHd0xzTkZycUJaYWozazRJTUlkcGpYemg4cE5Oa216?= =?utf-8?B?bTk5a3g1dndoZ0tlR2N3cUE1YVlBeEhKcXZSQ1RTbnNUNk1icHE0cnVjZE9H?= =?utf-8?Q?CclLupSdroCT2RDY=3D?= X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-Network-Message-Id: 3d996705-bf68-42f0-462f-08df3e9b90b2 X-MS-Exchange-CrossTenant-AuthSource: MI7PR08MB201474.eurprd08.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 09 Nov 2026 19:56:37.9074 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: UAKt0DPmhVedabCro81ApmWShH816bcb17wOJT6bTzA+7hGhhkaY3oaDTG6bwNZCpqKYc1ft0npl97ugzXWOTCRWU2B0srz0T0oUMIB11I4= X-MS-Exchange-Transport-CrossTenantHeadersStamped: AMBPR08MB066365 X-OZ-Fwd: true Cc: devel@openvz.org Subject: Re: [Devel] [PATCH hci-8.1 v4 5/5] ve/overlayfs: Override VE together with creds X-BeenThere: devel@openvz.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: OpenVZ development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed" Sender: devel-bounces@openvz.org Errors-To: devel-bounces@openvz.org On 11/9/26 20:49, no-reply@sashiko.virtuozzo.com wrote: > Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: > - [Medium] ovl: ovl_override_creds() fails with WARN and -EPERM for CT callers of a foreign-VE overlay > -- > > commit 9e04559c3517d9690eb025bf97e30b602d11f4ca > Author: Vladimir Riabchun > > ve/overlayfs: Override VE together with creds > > This patch changes ovl_override_creds() to also override the VE > (through override_ve()) using ofs->creator_ve. It returns both the old > cred and the old VE in a new struct ovl_creds_desc, and converts all > overlayfs callers to the new ovl_override_creds()/ovl_revert_creds() > pair. The stated goal is to let a host user access an overlayfs created > inside a CT without ve_capable() checks failing. > > Link: https://virtuozzo.atlassian.net/browse/VSTOR-142405 > >> diff --git a/fs/overlayfs/util.c b/fs/overlayfs/util.c >> index f95090f0d29c..d28d572d6099 100644 >> --- a/fs/overlayfs/util.c >> +++ b/fs/overlayfs/util.c > > [ ... ] > >> @@ -63,11 +63,27 @@ struct dentry *ovl_workdir(struct dentry *dentry) >> return ofs->workdir; >> } >> >> -const struct cred *ovl_override_creds(struct super_block *sb) >> +/* On error no revert is needed. */ >> +int ovl_override_creds(struct super_block *sb, struct ovl_creds_desc *desc) >> { >> struct ovl_fs *ofs = OVL_FS(sb); >> >> - return override_creds(ofs->creator_cred); >> + desc->ve = override_ve(ofs->creator_ve); >> + if (IS_ERR(desc->ve)) >> + return PTR_ERR(desc->ve); >> + >> + desc->cred = override_creds(ofs->creator_cred); >> + return 0; >> +} > > [Severity: Medium] > Can this turn a previously working access into a WARN plus -EPERM for > tasks running in a container? > > ovl_fill_super() stores ofs->creator_ve = get_ve(get_exec_env()), so > creator_ve is the VE of the mounting task. Every converted entry point > (ovl_lookup(), ovl_permission(), ovl_getattr(), ovl_iterate(), > ovl_open_realfile(), the xattr and copy-up paths) now calls > ovl_override_creds(), which calls override_ve(ofs->creator_ve). > > With CONFIG_VE, override_ve() in include/linux/ve.h does: > > if (WARN_ON(new_ve != get_exec_env() && !ve_is_super(get_exec_env()))) > return ERR_PTR(-EPERM); > > That condition is true for any non-host task whose VE differs from > creator_ve. One example is a CT task reaching a host-mounted overlay > through a bind mount or mount propagation. Another is a CT task reaching > another CT's overlay. In both cases, ovl_override_creds() returns -EPERM > and the operation fails. > > Before this patch only the creds were swapped, so that access worked. > Each failure now also emits a WARN backtrace, which is a panic with > panic_on_warn. Is this reachable from within a container? > > The commit message covers only the host-accessing-CT direction and does > not mention this one. Is it intended that a CT task accessing an overlay > created in a different VE fails with -EPERM? > > If it is intended, would it be better to avoid the WARN_ON backtrace on > this path, for example by checking the VE relationship in > ovl_override_creds() before calling override_ve()? This is the whole idea. We never want to upgrade our privileges, so this should be restricted. If this happens - it is either someone trying to use host overlay mount inside CT, or a CT/kernel is doing something nasty. Both cases should be reported loudly. > > [ ... ] > -- Best regards, Riabchun Vladimir Linux Kernel Developer, Virtuozzo _______________________________________________ Devel mailing list Devel@openvz.org https://lists.openvz.org/mailman/listinfo/devel