From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.openvz.org (mail.openvz.org [69.168.225.77]) by lore.virtuozzo.com (Postfix) with ESMTPS id 76BCA802A5 for ; Thu, 22 Oct 2026 02:27:16 +0000 (UTC) Received: from mail.openvz.org (localhost [127.0.0.1]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 69M2Q2iJ031677; Thu, 22 Oct 2026 05:26:02 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 69M2Q2iJ031677 Authentication-Results: mail.openvz.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=virtuozzo.com header.i=@virtuozzo.com header.b="M98i2AIO" Received: from mail-wr1-f72.google.com (mail-wr1-f72.google.com [209.85.221.72]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 69M2Pvmo031664 (version=TLSv1/SSLv3 cipher=AES128-GCM-SHA256 bits=128 verify=FAIL) for ; Thu, 22 Oct 2026 05:25:57 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 69M2Pvmo031664 Received: by mail-wr1-f72.google.com with SMTP id ffacd0b85a97d-48dff112136so928089f8f.1 for ; Wed, 21 Oct 2026 19:25:57 -0700 (PDT) X-Gm-Message-State: AFq9FYKWVdFxPE6AQrfm3MU035b904DFl9zDYZe0so1OdOgFz9ujrjPq B/GAc1zhAtq+y7iMy0fnf5z/7pXMQZT+MTmsvXFj1o64UnS5MEfBH22aHtLVgaWTuQOHVDNhjEf E8ptAIVZKl5n2ARCLEAIB0j3SSaqUhqgBN/WyiBMnZtpdRtBAeqSqDw== X-Gm-Gg: AYBFou1+z2HNeubuIHAuX4viq2vidTcTFU86Irw0ma7L1izCudOeMpKBjxOR51noX9h m/jVlMWYKUPKFPO49k0k/iCiPzwZsD6BlYm3jYoCDyFvEVp1Hps96nlKC/CGGqE0c5GQbhZwml9 8aGgzZHP4m4Vb3oHL5t4y2L1cn97ppzvCJMRWCyb9ShPB8RVrO9a0Wo1VB/bQ64pm3MKcZUk1kf 0d73E4WGfcwASslg9UZ1PZGrDsTLfJdOabMAYV4O7XBwf/RHs1jlsm/4MiuoKXKy0GbmzFrB1vE MAqn2GSmkrolG8Gl+na6UZ6bFhwxKnWL+ghSNZYaMjMRhZfCwhmLJwhseORsQgOV1qROfvoAeul N1C4bM7OgDZpAWlIPxnCfUw4L X-Received: by 2002:a05:6000:4024:b0:48d:fdd0:6ce8 with SMTP id ffacd0b85a97d-48e2641ce77mr7962725f8f.3.1792635957321; Wed, 21 Oct 2026 19:25:57 -0700 (PDT) X-Received: by 2002:a05:6000:4024:b0:48d:fdd0:6ce8 with SMTP id ffacd0b85a97d-48e2641ce77mr7962690f8f.3.1792635956784; Wed, 21 Oct 2026 19:25:56 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1792635956; cv=none; d=google.com; s=arc-20260327; b=ahyB6VSUG4qmvDlEYVMP5ko6yYGdJkIcptNsjMtSXPvF4DCml93smnlZGUE7anOHQx t8LBI9YlUieGxMNNqdpMQeeAuGlUpD9orb9UepIB9VOny8gKcyeW+Pee9SSG+yrgNErJ HwYzNpYkQ5p1RnqnZIKbnNjmcHuLLlWPpTCNjg6o0IrqUveuoLuHtx4gsDRerEOd4Guu uJqD0FDbJ57h8P9XFtnzDdLCTSTzBbDUFq52HlRHU8v/T/H5GOZT/a04b1Ov9HW59maE E1sxxVuRxlcMgNrmz/10PdnFOMExGRtnkEcASkqR3os+HoFBU6P55oJmjt5yRjsmp+vK SkFw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:dkim-signature; bh=vLc8Xv6cK5X38maOjRBKWZhU3oGBtxVNZGDN2vQ2k3Y=; fh=WpT6aB7RBAGHZeWZzqAr71yzRFbPTYkPWKsRagLn48Q=; b=S8kBqWXUZZBEFhsLVUgrvkaqa7iJ1i1z1Cwt4fOnCi0qupfG8z9OTB9YVNM9L/5dHX XOyKzRI+yJhfLiCta6bX/k4WPN5QRfBwxJdqny4DXj6O4vnkqaTjVxSBb70gU09TbTOC JFW/X4zYodX1zxmA7sH2eNVX5M40T6J4NxSXorQsbtwOh9BxR02/qcQ3sNcTaaLCkN7c BVaJ4gmIw2vNcNjPMV1Zf/EG8BdAgCvF++u7EN+SaLLM6GZ8+wb/ceLlwwB1yPD7f+Gy 9AgI7lReXJMWiZg5GEtgId9WEO/1JLnlLYXsx1YOCEfDa+PLOXlszkaIfgDhk5VF9m+u 2hiQ==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=M98i2AIO; spf=pass (google.com: domain of eva.kurchatova@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=eva.kurchatova@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com Received: from relay.virtuozzo.com (relay.virtuozzo.com. [130.117.225.111]) by mx.google.com with ESMTPS id ffacd0b85a97d-48e2589ccccsi8497618f8f.497.2026.10.21.19.25.56 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 21 Oct 2026 19:25:56 -0700 (PDT) Received-SPF: pass (google.com: domain of eva.kurchatova@virtuozzo.com designates 130.117.225.111 as permitted sender) client-ip=130.117.225.111; Authentication-Results: mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=M98i2AIO; spf=pass (google.com: domain of eva.kurchatova@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=eva.kurchatova@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=virtuozzo.com; s=relay; h=MIME-Version:Message-ID:Date:Subject:From: Content-Type; bh=vLc8Xv6cK5X38maOjRBKWZhU3oGBtxVNZGDN2vQ2k3Y=; b=M98i2AIOR+Uz VsEUvpY2LtB1UKyf90gn3DQGklG4jWQv7Z3wKb7hUcEJvpC/IcxV0DPQqkOoSm3Ba6Ks6w6lnhxT4 UD1b4iBhtCoj2r1w8TEqdn0MB3e/8Hoiv9hvaqPfWseRPKPV8BvrQZzEDNUnutzBaiBhg0lOpaQBw 8ZIL8O6MtEnsTxebSEPNAl98N4WhB8cOz13qoGg50IQLFLwOB+ZVgLifyBnR4mZxspo9JG/psMGSm DTpOLTGN8veb6fbdXoU72ZKdiRvTpG89NTjyIJRRC7U+4AWwRDB5scisE8hpnXVxWxDOgdEgnkgPy AJpbMf1mdU1Hp3dQZUs2TQ==; Received: from ch-vpn.virtuozzo.com ([130.117.225.6] helo=LekKit-T14) by relay.virtuozzo.com with esmtp (Exim 4.96) (envelope-from ) id 1xJiRY-002GA2-0B; Thu, 22 Oct 2026 04:25:54 +0200 From: Eva Kurchatova To: khorenko@virtuozzo.com Date: Thu, 22 Oct 2026 05:25:20 +0300 Message-ID: <20261022022554.2427456-2-eva.kurchatova@virtuozzo.com> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261022022554.2427456-1-eva.kurchatova@virtuozzo.com> References: <20261022022554.2427456-1-eva.kurchatova@virtuozzo.com> MIME-Version: 1.0 X-OZ-Fwd: true Cc: devel@openvz.org Subject: [Devel] [PATCH hci-8.1 v2 1/1] block: let container root set the block size of and flush its device X-BeenThere: devel@openvz.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: OpenVZ development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: devel-bounces@openvz.org Errors-To: devel-bounces@openvz.org BLKBSZSET and BLKFLSBUF check CAP_SYS_ADMIN in the initial user namespace, so root in a container cannot set the block size of a block device it has been given, nor flush its buffers, and mkfs.xfs on a loop device there stops with "cannot set blocksize 512 on block device /dev/loopN: Permission denied", or with "Flushing the data device failed, err=13" once it gets past the first. Check the capability relative to the container, as the other block code adapted for containers does, and let container root through only where its device cgroup grants write access to the device: a device handed to a container read-only may be held by a filesystem outside it, and neither its cache nor its block size should be touched from inside. Device with mounted filesystem denies flush from a container with EBUSY, as block size change does, and a container syncs its own mounts through filesystem. https://virtuozzo.atlassian.net/browse/VSTOR-137668 Feature: ve: allow various syscalls in CT root userns Signed-off-by: Eva Kurchatova --- block/ioctl.c | 27 ++++++++++++++++++++++----- 1 file changed, 22 insertions(+), 5 deletions(-) diff --git a/block/ioctl.c b/block/ioctl.c index a3c53b04e1e3..def89aa19904 100644 --- a/block/ioctl.c +++ b/block/ioctl.c @@ -9,6 +9,7 @@ #include #include #include +#include #include #include #include @@ -416,16 +417,31 @@ static int blkdev_pr_clear(struct block_device *bdev, blk_mode_t mode, return ops->pr_clear(bdev, c.key); } +/* Container root may administer only a device its device cgroup lets it write */ +static bool blkdev_admin_capable(struct block_device *bdev) +{ + if (!ve_capable(CAP_SYS_ADMIN)) + return false; + + return ve_is_super(get_exec_env()) || + !bdev_permission(bdev->bd_dev, BLK_OPEN_WRITE, NULL); +} + static int blkdev_flushbuf(struct block_device *bdev, unsigned cmd, unsigned long arg) { - if (!capable(CAP_SYS_ADMIN)) + if (!blkdev_admin_capable(bdev)) return -EACCES; mutex_lock(&bdev->bd_holder_lock); - if (bdev->bd_holder_ops && bdev->bd_holder_ops->sync) + if (bdev->bd_holder_ops && bdev->bd_holder_ops->sync) { + /* A filesystem on the device is synced by its own mount, not from a container */ + if (!ve_is_super(get_exec_env())) { + mutex_unlock(&bdev->bd_holder_lock); + return -EBUSY; + } bdev->bd_holder_ops->sync(bdev); - else { + } else { mutex_unlock(&bdev->bd_holder_lock); sync_blockdev(bdev); } @@ -527,11 +543,12 @@ static int blkdev_bszset(struct file *file, blk_mode_t mode, { // this one might be file_inode(file)->i_rdev - a rare valid // use of file_inode() for those. - dev_t dev = I_BDEV(file->f_mapping->host)->bd_dev; + struct block_device *bdev = I_BDEV(file->f_mapping->host); + dev_t dev = bdev->bd_dev; struct file *excl_file; int ret, n; - if (!capable(CAP_SYS_ADMIN)) + if (!blkdev_admin_capable(bdev)) return -EACCES; if (!argp) return -EINVAL; -- 2.56.0 _______________________________________________ Devel mailing list Devel@openvz.org https://lists.openvz.org/mailman/listinfo/devel