From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.openvz.org (mail.openvz.org [69.168.225.77]) by lore.virtuozzo.com (Postfix) with ESMTPS id F3E1080CB2 for ; Wed, 28 Oct 2026 11:59:51 +0000 (UTC) Received: from mail.openvz.org (localhost [127.0.0.1]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 69SBwWRn019784; Wed, 28 Oct 2026 14:58:33 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 69SBwWRn019784 Authentication-Results: mail.openvz.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=virtuozzo.com header.i=@virtuozzo.com header.b="FnKg0CCE" Received: from mail-pg1-f199.google.com (mail-pg1-f199.google.com [209.85.215.199]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 69SBwJpt019760 (version=TLSv1/SSLv3 cipher=AES128-GCM-SHA256 bits=128 verify=FAIL) for ; Wed, 28 Oct 2026 14:58:20 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 69SBwJpt019760 Received: by mail-pg1-f199.google.com with SMTP id 41be03b00d2f7-cd5ca3840c5so1112881a12.2 for ; Wed, 28 Oct 2026 04:58:20 -0700 (PDT) X-Forwarded-Encrypted: i=3; AKwUvBzV9I1Lai8zvwv1gGV+VkIURBdNCU2P/TYJQQzvg1G+J9akRg3kTAvI7vXdJNIWAW9aLhPepQ==@openvz.org X-Gm-Message-State: AFq9FYIc3sZH4xe6CEJNZB/ei5krc1E33SHWHBQeZkSJFu9tP6hEqky+ Fx5dkVlTn0daTQkUdC+KJobE8VYZg9nUvyRpUAxCjo+EFROGyeUS6v0t7M6KCOEIv/GfNTsXbfQ wPxD02RceVFwxTLUXF5pVKQ7CuEjaUT/2kDTyzVXj/98RiR2ZU2wwMg== X-Gm-Gg: AYBFou23I+ReM8eEQOXJdFDhzoB1eW/n9EnIHN+CgyQ6LpE/h5WzMS9K75C6wx1llXV CfgPdIlGboMLFwwNeH9Y4vnOaRSIjPLDFifx1JtF6M1NTIAL3R4xcX0Vn0+WQn0tW2htHA6Oo6o HCNNWDQVe1ayze4X1PhnpQEBXCJlt0pqMepVuJkq9/YNDe1W0Vi65g6vwMRzLTDGTn7MvNrUP66 rEYl93Lw+PVBGhbMGWZ07EpsuaTb4I7n49MZR0LBbgEkW6n71To9Ipw9/xzzY/MfjLTGM1ARq1W ns6Zc3fLNy/681lclz4nQwPEimAxoQTBoVjprnF0n/WIF1Ha10XmXXfMJznlW3nfKN68CxEwwyk GfWiIZIl0ak2nn7WoG+eMRmutz2biM5HJs+UhQhTKgG7XHfpwR7lW9zglxTC8Am7m104sjUnZ/G OrpkKcED/xv8bIXjOd6HYGIXfp X-Received: by 2002:a05:6a20:6a20:b0:3cd:67e9:8565 with SMTP id adf61e73a8af0-3e9020dba8dmr2021242637.9.1793188698892; Wed, 28 Oct 2026 04:58:18 -0700 (PDT) X-Received: by 2002:a05:6a20:6a20:b0:3cd:67e9:8565 with SMTP id adf61e73a8af0-3e9020dba8dmr2021210637.9.1793188698100; Wed, 28 Oct 2026 04:58:18 -0700 (PDT) ARC-Seal: i=2; a=rsa-sha256; t=1793188698; cv=pass; d=google.com; s=arc-20260327; b=r8LrxL3ywijUieTI18CHkjy1Hwy2rkcohVHsD91UtlrYXKNike7pS+Z8AWRXCXMmi0 tRXgdSiapRmtR9hiIYQktCAm/6LsdKFHDBdc4Kvqk3BkPjngYluuXJs0hytCmkGLqty6 62VXAFZF9vZTDOZyC9FmFNNw3yy2n1AqaKVE03MPTkGKNFqqw7EIZ7uvdrt8V66if6bC fDRIe6yC+7E4+S2ZWFntIQin9Fi2hKvYxtOEVdhdF2isKe/kg1YiZPvEZq6JuKEBwpEy bNR3gbwtrR8npYgd5qaQM10BYzdlH9CuIDsV/kMa5O07deR97Ug7cnDAXbLzn+YgQ4ji ePZg== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=mime-version:message-id:date:references:in-reply-to:cc:to:from :subject:content-transfer-encoding:dkim-signature; bh=k9AcenqvjLj1PegIpYh4dF9xa77cvOkQf+5kupmc/Ss=; fh=XuaDQIg83Y0JaTwy0HIlYAvJmIfDYrzuP6EDdDofXPs=; b=fRJyg1qj+PVFNdAaLQ9iCPEruM+iEQ2Bm2Oot7UYOLnewd+YnU2vGpv07Rebxakubw hIZGzailbAZRBsbu4I0IzwB9dxiw5puILdvUawprksCfCbss0z+SSJoVUrFTahz2xCr3 sM4tNcgDjKGI7MuteuuAYTZdLAXndGcP0Yru7eZH9xirCwcjUdCjXdB+BPAMuiWr+jxU zCFyRdDAQ6deXgl40OiiHRFUMx9uI/TYBqPr/C+vwy84yUcg/FME9x2tI3cMIFWuYxhb /nmKac6ZfONn9vwN4D1BnQzjV052V/6SHolt+N/dm6bDSH3cNFS0cmlmNcbWIYBdsURJ H8sA==; dara=google.com ARC-Authentication-Results: i=2; mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=selector2 header.b=FnKg0CCE; arc=pass (i=1 spf=pass spfdomain=virtuozzo.com dkim=pass dkdomain=virtuozzo.com dmarc=pass fromdomain=virtuozzo.com); spf=pass (google.com: domain of ptikhomirov@virtuozzo.com designates 2a01:111:f403:c20f::7 as permitted sender) smtp.mailfrom=ptikhomirov@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com Received: from OSPPR02CU001.outbound.protection.outlook.com (mail-norwayeastazlp170130007.outbound.protection.outlook.com. [2a01:111:f403:c20f::7]) by mx.google.com with ESMTPS id d2e1a72fcca58-8a6a3e59360si5363954b3a.112.2026.10.28.04.58.17 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 28 Oct 2026 04:58:18 -0700 (PDT) Received-SPF: pass (google.com: domain of ptikhomirov@virtuozzo.com designates 2a01:111:f403:c20f::7 as permitted sender) client-ip=2a01:111:f403:c20f::7; Authentication-Results: mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=selector2 header.b=FnKg0CCE; arc=pass (i=1 spf=pass spfdomain=virtuozzo.com dkim=pass dkdomain=virtuozzo.com dmarc=pass fromdomain=virtuozzo.com); spf=pass (google.com: domain of ptikhomirov@virtuozzo.com designates 2a01:111:f403:c20f::7 as permitted sender) smtp.mailfrom=ptikhomirov@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=rxlHGjasiYUHw/Vn+Na//IxfwnFIEKdBqOnhFs7DJB8h/CiyveShD3ab2XSTx1WNqZlM1tna4PSDCFHEZL5HBka+bwloan+bkCS5LUK6wH7TebeR8UPvrHIcawON6cmzJfPVMM9KEUottcJ/xoCvrmqGzXpSxTkz2KkbbnC+Vu99Up/PAIAxfHMQT5hJYtxdUt6RBEV3Otkv9iN5Pp2rkMD4w+sOXxsY//3sgaITR8M40+QG7Ord4Q0EJ/Fma0g1D9bEPDXlYwYJzAXD87v3Pjk1YDtPIDRUr9rYWIIwbVJyYxtDRhPY9gfn4wJj9yWzZkxoVis7XkgxeCnV38+Ktg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=k9AcenqvjLj1PegIpYh4dF9xa77cvOkQf+5kupmc/Ss=; b=mCK2jCf03IK9i9ujaVuts0QGFGKzpHgdora/kNmH7gCryHPVndzHaxI6zSPxRYO4cOPTexi9CZpUawGG6hhGYMalVk0dimYk4U81wlN8aIkOTOKwQBc8jxzsUIihPBjqTsvyX5mDEoih+68VaGeakv1zG+JbgAcB0gPxdsY6Jf2tCCiAgzDmN00hzI2ETZ3kOH3BngaDFMjoidibSn+bOGBhbVqfGxShIkXJFBgfZr2KQ82bhIHFiAYYqNQKChnMW4jC2BLry3GskYpdV6u5Ca8o8o4CfJqfqhEg3YCbJm7W51CSF0iV9ZfyQaLt0Pc7pU86qLjWsFHpA8ZpLIXnoQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=virtuozzo.com; dmarc=pass action=none header.from=virtuozzo.com; dkim=pass header.d=virtuozzo.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=k9AcenqvjLj1PegIpYh4dF9xa77cvOkQf+5kupmc/Ss=; b=FnKg0CCEVSu2EIfhZoWlhJVm15tPqDGvVxcRE/LyaQfS2k5PTxEAateccYHwLEwLy3SOQK+pT2AyQ5wGbzoIv4f192I6ydHNlxHK3gznpFxUcCWqgiaIX429WB1CMpzViUwfzGFcic2I4+whlRIbxOY5qr67C5pRb/t934Bw95qd0DZ3PI6UxVPJuFRf7yFdekCyQkyvAngyINRoFB2tyofCpgIWxWj44FBETkcriENKP1FyfH9ZThGAMACQmFImLRAzIkiKwMEQ1r/VIzlyaPjc4AYMYie5o/ImGSnQjNMqklBix7gVrWIjFllUlsv3oevagYq0wm1gaHI1ZFUSLw== Authentication-Results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=virtuozzo.com; Received: from AM0PR08MB11804.eurprd08.prod.outlook.com (2603:10a6:20b:747::14) by AS8PR08MB8801.eurprd08.prod.outlook.com (2603:10a6:20b:5bd::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.546.22; Wed, 28 Oct 2026 11:58:15 +0000 Received: from AM0PR08MB11804.eurprd08.prod.outlook.com ([fe80::bf46:f137:f6d2:5b3a]) by AM0PR08MB11804.eurprd08.prod.outlook.com ([fe80::bf46:f137:f6d2:5b3a%7]) with mapi id 15.21.0569.007; Wed, 28 Oct 2026 11:58:15 +0000 From: Pavel Tikhomirov To: Vladimir Riabchun In-Reply-To: <20261026-ovl-use-orig-ve-v2-4-eab58bfc29ca@virtuozzo.com> References: <20261026-ovl-use-orig-ve-v2-0-eab58bfc29ca@virtuozzo.com> <20261026-ovl-use-orig-ve-v2-4-eab58bfc29ca@virtuozzo.com> Date: Wed, 28 Oct 2026 12:58:09 +0100 Message-Id: <179318868950.3559520.6473416824609223980.b4-review@b4> X-Mailer: b4 0.16.0 X-ClientProxiedBy: BE1P281CA0263.DEUP281.PROD.OUTLOOK.COM (2603:10a6:b10:86::12) To AM0PR08MB11804.eurprd08.prod.outlook.com (2603:10a6:20b:747::14) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: AM0PR08MB11804:EE_|AS8PR08MB8801:EE_ X-MS-Office365-Filtering-Correlation-Id: 18164203-d8e1-4da4-c145-08df34eabefa X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; ARA:13230040|52116014|23010399003|376014|10070799003|1800799024|366016|261026140227099003|5023799004|4143699003|261022105027099003|56012099006|261021121427099003|261009223027099003|261022075727099003|22082099003|261026121527099003|6133799003|18002099003|3023799007|10067099003; X-Microsoft-Antispam-Message-Info: XPz7jYQLgSzsxKTvC8goT496voG8LxmGqjKohWB/Hxst3PSgYO2DKRJGtJVHJJsg03c5SDOQxkDSaAe52t5o3VHpUoPC+kZzlh97incWQm9tKJkF1q2ZEzMkwWabGD+2NuwDEIJ//HKwpipUxOhJcnN4GbfOd63AG4grJG/2s0mftsmNWMt0muAT9khptsD8bI8qj1hzwx9uCcSITDuhZP6CpUTObXhC3V43F4EQSANK2MVbNA+ZhowSOVt+XNzGFyDZWfmwo+w6PDWi4T8d5k25qdxnEIXE2WXd3PctxTWzEnFzQ/Y053Y+TmNN5N62RER2brAtKdaTTjmvvsRfvdgVjMiYcyPWbmt4kW/ouAFPPoGLPfKX4XXFVJ1WCWqQHK4nl9CE4e5mibTYjYPnEB0fiOqDp0Y/1/Ju2UdGuYjoMYCMjL8rF5riI6rkw4L6AwMKuBZ1XLnH7K0FxyXcI8d1i57hswnbL7H8y21U1cDLIeX21ZAXKwP/vBoyUpRxXIHAMT6tlIMNnmyH9gBdX/eefHh1d1SmKMh61upe0Ku8vvpkgJsqhYk6fswr5O4qIsWaxPRyrY8Cxg+ZB6rU2zw9dgso+57zy4tMaOXheYTFzTdPUY0UWtEwkCAQF7tBIBJHtTcQDvif/H94i+cVqzt+2d6772+YKnQ28E/Ykmk= X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:AM0PR08MB11804.eurprd08.prod.outlook.com; PTR:; CAT:NONE; SFS:(13230040)(52116014)(23010399003)(376014)(10070799003)(1800799024)(366016)(261026140227099003)(5023799004)(4143699003)(261022105027099003)(56012099006)(261021121427099003)(261009223027099003)(261022075727099003)(22082099003)(261026121527099003)(6133799003)(18002099003)(3023799007)(10067099003); DIR:OUT; SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 2 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?c2wzcVhsMlVwb1NuRElHTndTQVdsK3d0OVlPNGFzWVY4dWZ4aGxUNEZhRFVG?= =?utf-8?B?TEt1OElxWlZZNGxKdlZISkR5MDBJY3ViM3luaDc2SWM4dXpmb2tiTVp4OTI3?= =?utf-8?B?dEdJRTdQZTgvT0lYZi9vdFRpald1Q2h5TGIvdnluUEx1OE9BTWtTWDROeEZu?= =?utf-8?B?bk50cHIxNXdzRWlYempWVm5VT2JiVDFTR1FtRTlVMGhmelhhOGVkMHdxTG9B?= =?utf-8?B?YmJsZHZZR3JsNSt0R2Q2d3d3ZGJVN292NHpleWp5cndDc0R3S2JqSDdzdjIx?= =?utf-8?B?ZURaUS9pYmIvOU9WNDgvY0xaVi8vMFdZaitsNWlnOEl4UWtSVGpPeFhOandk?= =?utf-8?B?Mjl1a1B1NkUxa085MWdjaE5aTDd2Z1d3cGM5Z2ZRTHdzbkViamdpU0ZDaTFk?= =?utf-8?B?VFV1Y2g1cjFnTDczOUFSRW9VM3htcXpobWlac1QrVHVFUjFOK0VoUEFCVnhX?= =?utf-8?B?cElLS0tsTWJteVU1UmF0MVJ6SVZDSmQ1ck1JZ1Zwcm9PQWVpMWZ5aWxiR3lk?= =?utf-8?B?SDAyQ0lRNC9wTDJua040L3duVzFRMDN0N1VOelZDSERqd1FVNEExdzZNNFlY?= =?utf-8?B?REZZU2hXMnhmZG5iMEVUdGVLNmdjMDJUbG9YbTl5dmJ0eWpZTndqNHJlVkUy?= =?utf-8?B?YmdQdGlxN1RRS0RRRjJsUGtFajB3Y0YxRWUzcWgrVVJDTG9RalZSME1MSncy?= =?utf-8?B?b3pXYURMUTE0Mlo3TmtqZ0JDN05PUVlVbENXYzJsSU0xVkdKdFQ4S3l1Mmtw?= =?utf-8?B?Tzk0b01NUlBmanhRV3Rob1p0VXVES0JmeTBIZDFVRDRxcitNYmtyV056RVZK?= =?utf-8?B?b1M3MTZzL0RLcUt2dm9COTNHOWdJMjhBMVIzNGtYWEk5cVJoQVdLRXNmc3lI?= =?utf-8?B?RGtjaGxDU25wRDQ4RFJlekliTWl0ZTdGdURQNHhjQUhnaWZlQ000cERLU2Z2?= =?utf-8?B?Y1BxazFNbHcrUzA2bm14U3BoSDRMM0d0VFlmTjJoMGNTUmg1cUJ1dUJiZG5u?= =?utf-8?B?cCtTdytXYWtpdXhYbHlkR2hSMGFEckZJWmpqY2tDdkM2ZXhwa0dCVTZJK0xi?= =?utf-8?B?WFhpL1dZZThJNzNxbm1uWS9oZEtpS2E2TXJsV1N3Um1UQWVIaUU5cTBPblFW?= =?utf-8?B?a0xkeWE0anUrZUdMRElvaloxVWVLOVBHdkNvMHRKY2IvT3lRTEozUEc0K1A3?= =?utf-8?B?RlRDeW1uTjJJbzV5TFlYWkxiUWFVeXdSZ013SXAyb0UwWmx3dVRrNlZ2L0t3?= =?utf-8?B?cDIwS3hrYk11NWE1bFR1RlpDYVNXTnN4REczZlJ6SmJnKzAwY2tzazZicGFX?= =?utf-8?B?NGF2bEVuL3hhWXZJWU0zSWJDZzdmcGpERmg4amlPTU1SeFM5QWpTK3dtVlll?= =?utf-8?B?anNaOTVDRldhQ29Ba2wybmhBT04xOXNjL1dxaXY4bEJHVHFkcjNkYXkyYlcr?= =?utf-8?B?RUFtV21XSTl2aXVZbGFqdjFrbHR2WUNaY3I5cDlKeVB6UGJ1Qk85WmtDWnhH?= =?utf-8?B?aVc2OXVteklINnNPdGpwbkl6bTd1YnBRMS9lVGFaZkVjV2RBV2FWSWFtTWRx?= =?utf-8?B?Qk9YNkg2WTU4M2NXRjlCRHd3cHdaakxUamFCRHNEbkppOTNpN3djS3BJRElh?= =?utf-8?B?N1AwaUgydGxMcXd6M0dRUkIyblhiVW8xTjI3UmkvUU9VK2dCdTNBaHBpa3ND?= =?utf-8?B?N3Q0MDdyak8xN0pMamxCNFpWajFNNWpTK3ovZVdLTHo3TmVhSFNvV3JzcVRP?= =?utf-8?B?czNISUh2anBtY1NqdytVTlRKelpHbGlaUE5wRGw0S0pyaXRKU0JLT3RNR0k4?= =?utf-8?B?OVZQWVN4dlEwbGkyQ2piZkJmRDBQVHZCYnZIUEFxOUFuZXhrYytURVJFeE9v?= =?utf-8?B?Z1gwRWVQZWFiQUxkSDdIcGZjRG9iU3UzTzV5VlFuMG9NMFBHQ1FpVVBpRVJq?= =?utf-8?B?ZnpOQk9jbXVrY1QxQ0VPTW40U0h0V3NFKy9qVVhBajBZV0RTTllLbUJxUndx?= =?utf-8?B?Z0VSbWVWejZ1OW1TRUlpQUZQZ2tiSU1PVmpWeU92WVRDSFJ4TVdwTkIxK21t?= =?utf-8?B?ZjRURXE1cFdNbDJZNG5IaHBuejlkdUo0S2xETndhSCt3T2ZxbGhRSGIvQS96?= =?utf-8?B?cTB5UTZLNE1jNnhSWHpQQTYxZ1Fnam5vcmowdk80eVJSN2ZsY1hWWXN0OHNX?= =?utf-8?B?ZUZYWHFtWE9TblFWRXNPek9qUVBhT3NEb01kREJQVWlETE8rRXRyaGIvN2pZ?= =?utf-8?B?OWZ1eWU5WjhJWUVxcUU0M1pGZEJsWHAwanFJM051amxmdXJsZFJVNlVaWU4x?= =?utf-8?B?VkFGMjF5Q0tuRUI5SEUrWElHYjhkQmtKTWpSN1U4WTBJQytzNXlyTVZXSnpW?= =?utf-8?Q?sZ8wQZoZFYGn2o0FUDcZeV7KlbuA356RvTALzxyIG3gJ6?= X-MS-Exchange-AntiSpam-MessageData-1: vFdOOMAUINy3rDJOekFM2BWoXMpm+JLXrS0= X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-Network-Message-Id: 18164203-d8e1-4da4-c145-08df34eabefa X-MS-Exchange-CrossTenant-AuthSource: AM0PR08MB11804.eurprd08.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 28 Oct 2026 11:58:14.1694 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: MQq1W0fl5/qe8Ro+vnKAH0GwO2h9o/P4f/I8bLxC54SuLNIY8OAZx10hiTbbiHSGDiZ+ktwSAs8yQhR2KRuV/W+1j5owkjARxtY7nKhukwE= X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS8PR08MB8801 X-OZ-Fwd: true Cc: devel@openvz.org Subject: Re: [Devel] [PATCH hci-8.1 v2 4/4] ve/overlayfs: Override VE together with creds X-BeenThere: devel@openvz.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: OpenVZ development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: devel-bounces@openvz.org Errors-To: devel-bounces@openvz.org > Host users might want to access overlayfs, owned by CT. In such case > ve_capable checks will fail - they will perform VE cred checks against > host user_ns. > > Modify ovl_override_creds so that it returns both old cred and old VE. > This will also protect us from future rebase issues - all new users of > old_cred and ovl_override_creds will fail with compilation error. > > This fixes an observed crash in overlayfs when checkpointing > a container with a docker running inside: What about dead creator VE? It will try to check ovl creator cred against host userns and fail and reintroduce the crash. AI slop: // ofs holds a reference on creator_ve, but after CT stop ve_drop_context() clears ve->init_cred, and ve_capable() falls back to ve0.init_cred. With CT creator_cred that means ns_capable(init_user_ns) -> false. So if the superblock outlives the CT, e.g. CRIU (or any host process) has a file open on the CT overlay while the CT dies, we again get ovl_can_decode_fh() == true at mount time and false later, i.e. the same NULL dereference in ovl_get_index_name_fh() this series fixes. // I think dieing in the middle of CRIU c/r maybe not so rare a case. > > [ 2300.870181] BUG: kernel NULL pointer dereference, address: 0000000000000005 > [ 2300.871537] #PF: supervisor read access in kernel mode > [ 2300.872577] #PF: error_code(0x0000) - not-present page > [ 2300.873595] PGD 800000010a18f067 P4D 800000010a18f067 PUD 10730c067 PMD 0 > [ 2300.874900] Oops: Oops: 0000 [#1] SMP PTI > [ 2300.875742] CPU: 1 UID: 0 PID: 5419 Comm: criu ve: 0 Kdump: loaded Not tainted 6.12.0-211.39.1.16.6.vz10.x86_64 #1 16.6 PREEMPT(voluntary) > [ 2300.878057] Hardware name: Acronis OpenStack Compute/Virtuozzo, BIOS 1.16.1-1.vz9.2 04/01/2014 > [ 2300.879684] RIP: 0010:ovl_get_index_name_fh+0x18/0x70 [overlay] > [ 2300.880859] Code: ... > [ 2300.884128] RSP: 0018:ffffd32582e0f7c0 EFLAGS: 00010246 > [ 2300.885153] RAX: ... > [ 2300.895807] Call Trace: > [ 2300.896397] > [ 2300.903298] ? ovl_get_index_name_fh+0x18/0x70 [overlay] > [ 2300.904435] ovl_create_index+0x82/0x260 [overlay] > [ 2300.905406] ovl_copy_up_workdir+0x30a/0x330 [overlay] > [ 2300.906427] ovl_do_copy_up+0x10d/0x2e0 [overlay] > [ 2300.907387] ovl_copy_up_one+0x456/0x720 [overlay] > [ 2300.910736] ovl_copy_up_flags+0x81/0x110 [overlay] > [ 2300.911740] ovl_create_object+0x51/0x130 [overlay] > [ 2300.912719] vfs_mkdir+0x194/0x250 > [ 2300.913470] do_mkdirat+0x14c/0x180 > [ 2300.914223] __x64_sys_mkdir+0x46/0x70 > [ 2300.915019] do_syscall_64+0x7d/0x160 > [ 2300.922814] entry_SYSCALL_64_after_hwframe+0x76/0x7e > [ 2300.923823] RIP: 0033:0x7f5a2f8de3eb > > Overlayfs was created inside CT, so ovl_fill_super stored > in-container credentials to ofs->creator_cred. > > Those creds were later used in ovl_override_creds to temporarily > swich creds and perform checks using them. > > One of these checks happened in ovl_get_origin_fh/ovl_can_decode_fh. > On fs creation this check passed because we had container VE > and container creds, so overlayfs thought that we support > file handles (ovl_can_decode_fh call in ovl_make_workdir). > > When we tried to do something with the overlayfs from host VE, > ve_capable check was performed with credentials from CT > and with host VE. > > ovl_get_origin_fh returned unexpected NULL and all exploded. > > Stroing ve_capable check result on creation is a possible fix, > but it just masks the problem. We have other paths from overlay to > ve_capable checks: > > ovl_fileattr_set > ovl_override_creds > ovl_real_fileattr_set > vfs_fileattr_set > fileattr_set_prepare > ve_capable > > And storing capability check result will make rebase dangerous - we > would have to track new added code - not funny. All uses of ovl_creds() are not handled, they save creator_cred to backing file: struct backing_file_ctx { const struct cred *cred; ... } -- Pavel Tikhomirov _______________________________________________ Devel mailing list Devel@openvz.org https://lists.openvz.org/mailman/listinfo/devel