From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.openvz.org (unknown [69.168.225.77]) by lore.virtuozzo.com (Postfix) with ESMTPS id 14AD0802A5 for ; Wed, 21 Oct 2026 17:55:31 +0000 (UTC) Received: from mail.openvz.org (localhost [127.0.0.1]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 69LHsGTC024100; Wed, 21 Oct 2026 20:54:17 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 69LHsGTC024100 Authentication-Results: mail.openvz.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=virtuozzo.com header.i=@virtuozzo.com header.b="Es3oA6Cz" Received: from mail-wr1-f72.google.com (mail-wr1-f72.google.com [209.85.221.72]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 69LHsFcE024096 (version=TLSv1/SSLv3 cipher=AES128-GCM-SHA256 bits=128 verify=FAIL) for ; Wed, 21 Oct 2026 20:54:15 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 69LHsFcE024096 Received: by mail-wr1-f72.google.com with SMTP id ffacd0b85a97d-48af5a07314so659942f8f.2 for ; Wed, 21 Oct 2026 10:54:15 -0700 (PDT) X-Gm-Message-State: AFq9FYLzctS1IT7u441E+dvrTz/dHTb344IoL0g8PQykchvkOKPiEtO9 OCs6pAFjdfMVjnRACRHLYqNlJE5D9s8gS9dEkjjyk1rfAbpf3DOKErR5lIEHnwfUfJFT3BOHBGN V9cfUc4zIGc+zLQrJtBIaIDo+wNkCCoZ6PNX/eaYi7fzOgfhUIOXoCw== X-Gm-Gg: AYBFou3tysPxwZVIxzsQlv9++mi0PhCjk/liDsaHIoICXLDcEOn68E0ohphtR6WCoKL UNiVnablRoBimHxBft8NyT/58EEU6kourHP7Io0NyqZx1/Dz04VPOt3Ocma1j9mPTeAdUFLVsld 6NVVP2F+Gl0djB7TR0DNlTSqvQ8z2DkwzyHLTbAoCDW0wlBJgPcpFR0Aobc6/p/8G6NcQMJ24g6 EH+wtZDv8AFcm8gJCuglPv3Ud3D860IcdvSIydQ/xNtA+IVKGmiLguRbKj3cdiFA2G6JWoFWtEk L7xektKcNbc8eaL5sprNoGre6p6U0lCH0IHFAxKG8AfgCNNjFcpvWdib0j71uqiIioLVqnkDE/Z c6YZyqgGKLuCwbOlQkUXIiGo1 X-Received: by 2002:a05:6000:186e:b0:48d:ee0d:8b3d with SMTP id ffacd0b85a97d-48e264a66admr6465037f8f.28.1792605254631; Wed, 21 Oct 2026 10:54:14 -0700 (PDT) X-Received: by 2002:a05:6000:186e:b0:48d:ee0d:8b3d with SMTP id ffacd0b85a97d-48e264a66admr6464986f8f.28.1792605254036; Wed, 21 Oct 2026 10:54:14 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1792605254; cv=none; d=google.com; s=arc-20260327; b=QcT3cdBr2LgMw7N2r80ssJ+wfqnZ9mA8Gp/9+FqtiWxl0eavlVPBBjqaNbCU0bM/AO 6rDzVg+H7380DDThG0ugtIwBsFmMe5QUuSUk41UvjaKFfPbzffSR76DwIvbP4gpQmeWy +K1vXDikhVrWyahkx/syh+cmV015uWd6y3sN4l+cEH4JYOom/oBoXLzNeVAFlDTkLpBF yTjmgY/4j/PfG9bfJipBjZj50XWvLmMQyXHGbiC57fmKIT6kE8NZYxf9L+48k1zhqPzW v4IOoLteDmrAl25p99tdb1ZOzI6nMESGXmx3/ar/q1Y5jTZ2rUDLJGXNn5qB2BKiRcnm AtcQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:dkim-signature; bh=1f2h82x2L2eHhFLrQv2mRsUoHGgGJnJubu45z5koDUE=; fh=WpT6aB7RBAGHZeWZzqAr71yzRFbPTYkPWKsRagLn48Q=; b=mhvqtUrhQkCDHrwR/VNINbgbg1lttbXMQzI2Bs242KCb9zGPPhTiUxS9HvhidBbDbF d5Qegy3HiF3mmnl6aRzBq6UwmYu3w1bOAGLv3PcxMfO8qf2xe+LL6VLXLkX6rZ/QcJ3R SZBdsbnInL3mf+6uRGWpNSo7d28SX99zKz8uOa6XtAhnw62TIqOpGqJe5/5hcKFs8Zg6 NfmjLV6X+WCgJ1hVweumulrapnVLPjEfVFQdS9g9yh8S7k/Q57DOK2ADa9GmsgD+lvRw opo6BaCPd+lbQMVHpwkQAnYbaJm2D/RiGyE55M3INdIskYN49VQO7gejyZNG0UXz1EUs uEZw==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=Es3oA6Cz; spf=pass (google.com: domain of eva.kurchatova@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=eva.kurchatova@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com Received: from relay.virtuozzo.com (relay.virtuozzo.com. [130.117.225.111]) by mx.google.com with ESMTPS id ffacd0b85a97d-48e25885f97si6464012f8f.397.2026.10.21.10.54.13 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 21 Oct 2026 10:54:13 -0700 (PDT) Received-SPF: pass (google.com: domain of eva.kurchatova@virtuozzo.com designates 130.117.225.111 as permitted sender) client-ip=130.117.225.111; Authentication-Results: mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=Es3oA6Cz; spf=pass (google.com: domain of eva.kurchatova@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=eva.kurchatova@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=virtuozzo.com; s=relay; h=MIME-Version:Message-ID:Date:Subject:From: Content-Type; bh=1f2h82x2L2eHhFLrQv2mRsUoHGgGJnJubu45z5koDUE=; b=Es3oA6CzfbbE lMXPjDwuwcb3PUoj6m6Ynaij2H2v/aKdG1emitxRYu3Zd2MBhg8YBeW4H33+grI+q/gwxhlmUm28J WTJo/5JYEfuR4X65JLhgOqUeI6L4JWE+5sv7FQbXO+7X6lLP4ijnuN5nAXSj8C5Tn0cOqFhnc6FxX 10uqEaHlPd2FbYMoUhn2yw7AoHH036I5LuulLYAej9mHUznVq6R3nUL19Kx5wzc5MNv9eU5h+jxFC qSFRyGcK76xlH7wmjX62uIgtcfr3H15ckknDs2AfW57Dp6kGSOuXXUN6pJFh3KSFgqfZLVJwO2Rkw 4tuibp5WdNhaa6ohnuZHTw==; Received: from ch-vpn.virtuozzo.com ([130.117.225.6] helo=LekKit-T14) by relay.virtuozzo.com with esmtp (Exim 4.96) (envelope-from ) id 1xJaSL-00A3jd-1i; Wed, 21 Oct 2026 19:54:12 +0200 From: Eva Kurchatova To: khorenko@virtuozzo.com Date: Wed, 21 Oct 2026 20:54:05 +0300 Message-ID: <20261021175410.2339797-1-eva.kurchatova@virtuozzo.com> X-Mailer: git-send-email 2.56.0 MIME-Version: 1.0 X-OZ-Fwd: true Cc: devel@openvz.org Subject: [Devel] [PATCH hci-8.1] block: let container root set the block size of and flush its device X-BeenThere: devel@openvz.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: OpenVZ development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: devel-bounces@openvz.org Errors-To: devel-bounces@openvz.org BLKBSZSET and BLKFLSBUF check CAP_SYS_ADMIN in the initial user namespace, so root in a container cannot set the block size of a block device it has been given, nor flush its buffers, and mkfs.xfs on a loop device there stops with "cannot set blocksize 512 on block device /dev/loopN: Permission denied", or with "Flushing the data device failed, err=13" once it gets past the first. Check the capability relative to the container, as the other block code adapted for containers does. The device itself is reachable only through the device cgroup, set_blocksize() still needs the device exclusively, and a flush discards only cached pages of that device, so nothing a container could not already write to is affected. https://virtuozzo.atlassian.net/browse/VSTOR-137668 Feature: ve: allow various syscalls in CT root userns Signed-off-by: Eva Kurchatova --- block/ioctl.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/block/ioctl.c b/block/ioctl.c index a3c53b04e1e3..14047cd8e611 100644 --- a/block/ioctl.c +++ b/block/ioctl.c @@ -419,7 +419,7 @@ static int blkdev_pr_clear(struct block_device *bdev, blk_mode_t mode, static int blkdev_flushbuf(struct block_device *bdev, unsigned cmd, unsigned long arg) { - if (!capable(CAP_SYS_ADMIN)) + if (!ve_capable(CAP_SYS_ADMIN)) return -EACCES; mutex_lock(&bdev->bd_holder_lock); @@ -531,7 +531,7 @@ static int blkdev_bszset(struct file *file, blk_mode_t mode, struct file *excl_file; int ret, n; - if (!capable(CAP_SYS_ADMIN)) + if (!ve_capable(CAP_SYS_ADMIN)) return -EACCES; if (!argp) return -EINVAL; -- 2.56.0 _______________________________________________ Devel mailing list Devel@openvz.org https://lists.openvz.org/mailman/listinfo/devel