From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.openvz.org (mail.openvz.org [69.168.225.77]) by lore.virtuozzo.com (Postfix) with ESMTPS id 037728045D for ; Thu, 29 Oct 2026 16:01:43 +0000 (UTC) Received: from mail.openvz.org (localhost [127.0.0.1]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 69TG0FBc002127; Thu, 29 Oct 2026 19:00:16 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 69TG0FBc002127 Authentication-Results: mail.openvz.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=virtuozzo.com header.i=@virtuozzo.com header.b="jyI1xyQR" Received: from mail-wm1-f72.google.com (mail-wm1-f72.google.com [209.85.128.72]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 69TG0DQE002122 (version=TLSv1/SSLv3 cipher=AES128-GCM-SHA256 bits=128 verify=FAIL) for ; Thu, 29 Oct 2026 19:00:14 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 69TG0DQE002122 Received: by mail-wm1-f72.google.com with SMTP id 5b1f17b1804b1-4a1f03f2e8aso21129585e9.1 for ; Thu, 29 Oct 2026 09:00:13 -0700 (PDT) X-Gm-Message-State: AFq9FYLhsl1Ls3dVP02ZgmApypu31Tsyz/LsGrcM/ggLXEPtJPu/d/Tz GgnTPxVdssQLZLBBv5n0sQYtoVYF3HAexGPmuBmKtCwqcsdIO7vAYjxiqdR11MWTNT9jJT6IDI+ fetM/PcutH831Bk1I6FqAqXrhRo5qUsnQ/q0EGA9lODRZd5VRvMxbOA== X-Gm-Gg: AYBFou19p6auqfhS5QEdbdtOOwB3YOtWkQsnU+/Yrnx9o+I1w91vWoe9Nbuu3DpPLMh t82k8QA4WBr0APO3FDmH6xnl2NMyVyH0PTFs7atoeJUyMcGzfohwcqinxpOEMDbDZrGXXrFYRy8 Y3ZM9FQ2f9h02fQB409kEoZ5W+DQ+KPexdSmiVoPslnTIOBIpVY/XqFk6eUhm8WpwU4ugVYTPCP ZTsNQCVk1A+2/fnbEyWH2VDWSWEn6NDJDX3tlfbYV9HDBSEa0vSVQcWOm098U0XkjhF7rkIYZmw w8h4UpB9tnsVMdljVbfk52ASNszAX9OyTELkZSYl4IjmIubm9esfwhsyEBBbz4JQPC0rKNKdMHD WAT/rZlSuxoil7jpwSA== X-Received: by 2002:a05:600c:4705:b0:4a1:7c56:d4e2 with SMTP id 5b1f17b1804b1-4a966587157mr133471775e9.16.1793289613167; Thu, 29 Oct 2026 09:00:13 -0700 (PDT) X-Received: by 2002:a05:600c:4705:b0:4a1:7c56:d4e2 with SMTP id 5b1f17b1804b1-4a966587157mr133469925e9.16.1793289611993; Thu, 29 Oct 2026 09:00:11 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1793289611; cv=none; d=google.com; s=arc-20260327; b=RrHYm3Z1vWg29ovlCx5/0EKBc0U4iHZIzlNhk/1vw5ekPu7KRvfcYTIp3gHEmsHnkk YVSBdvsay+bl3bjqHeHYKUmkL3D3jgM3tezeJr9UjXW9YEjVI1LQNqFHGKQ6DROmb8J+ PWg3hege4M8EB5l5y4QOsuTTkEg/K4558U+gs87b6xzGKChnIwpBuRaGft3cttblzy0e 0zSeiVlCNAWhfpevebX3jYf1cGqFOr98Eb5qGosODqxYdgnWir8Yzcuu/MScusNJAo7t osgzTapGEBwcTMrn4LRK+Kio6V1RZIDGH1L1k4yGu28DGFNJpgRrmtoAwntbtl0cMNBF Yt4A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=cc:to:message-id:content-transfer-encoding:mime-version:subject :date:from:dkim-signature; bh=PnQNhzG8oCz9H/p9Gcz4El9zkB5zgAEEY7V6RgGVj00=; fh=dqCMgmHh2rMamzF48Xjl4FTiCd40EM0DW1ZObGszY58=; b=HiuLMzQisve8FrzQDXKE682UJ7SSnT2wLu9h7mYfn0RRaYwM/TA30zIV+X4eB6SKwU bSdOe6HXHWqwGnI1BmVuEWGjSCTU4Dph3tChndMaheoi1wv2eE29Vwacq8Ab5iktRsOJ 4YVjCAk3lhJfSGCf0Q9MPipZtvu5YtCwRxTV6bvpsEfVj0RuGNeTEoBDEvnhrOnPXS0X Vt7NURRc+mK7qMvy28hWKwIBgkSV3I4EpuVk9LT+ethkumAizKfS2GAyVzvs/EPRWR6q uUNxdSzoiLX72EhL3/Q3x3qNaQuosRKn5kgoNW72ezB/+mhERAMZHnKbYtZLEt6MBECY AJjw==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=jyI1xyQR; spf=pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=khorenko@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com Received: from relay.virtuozzo.com (relay.virtuozzo.com. [130.117.225.111]) by mx.google.com with ESMTPS id ffacd0b85a97d-48e6df2a092si104888f8f.56.2026.10.29.09.00.11 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 29 Oct 2026 09:00:11 -0700 (PDT) Received-SPF: pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) client-ip=130.117.225.111; Authentication-Results: mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=jyI1xyQR; spf=pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=khorenko@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=virtuozzo.com; s=relay; h=Message-Id:Content-Type:MIME-Version:Subject:Date :From; bh=PnQNhzG8oCz9H/p9Gcz4El9zkB5zgAEEY7V6RgGVj00=; b=jyI1xyQRBTjjf2JCV8a 8RhmUGDPPbqJL8zbaoNEToNOc6/E91Rs3KmwjNxwakgJYr3wVAmEHkIEQMDtWaFQ1X9lxv5xqywWw Qexd5P/C7ASxt8dwfGltn6LEf/O22GiXtNkrTRWtbF/wL7/GiI1FsoqnqFbAEqQM2DnV+mFYnEdkE TcNAIVHcLG586tyUxGyGRberP8A0Mt2ob/myX9Scmxpec+/ClW/xfGAtMgMX2elNar0XVRdQ72vhj 5yFKCdKTGP6BBgXhRa2xDftT2W3hbEgT/Gu8ZaKGv1gZ4+KTARTFtzGm35DyfxHaDcLCxFNZkhEwN psibZiM7XOojkZA==; Received: from ch-demo-asa.virtuozzo.com ([130.117.225.8] helo=f0.sw.ru) by relay.virtuozzo.com with esmtp (Exim 4.96) (envelope-from ) id 1xMSUB-009Ffx-1g; Thu, 29 Oct 2026 17:00:09 +0100 From: Konstantin Khorenko Date: Thu, 29 Oct 2026 17:00:08 +0100 MIME-Version: 1.0 Message-Id: <20261029-vstor-137668-block-let-container-root-set-the-block-size-v3-1-c3fd7db3777c@virtuozzo.com> X-B4-Tracking: v=1; b=H4sIAIdt42oC/4WOwVLDMAxEf6XjM/LEShzXnPgPhoPjqsS0jRjb8 UA6+Xec0AM3TpqVVm/3LhLFQEk8H+4iUgkp8FRF+3QQfnTTO0E4VS2wwV41aKGkzBFUa/r+CMO V/QWulMHzlF2YKEJkzpDqKo/0MKSwEJjGIp5PdkCnRcV/RjqHrz36VYw+wFEq8fZ7SPPwQT5vw Zt1DFvo916yqP3h0UcpozvVSGxba6wBBVScvMyxls9c3EsJMc+8LCw933Z8wb+AOlDrTmKHptP 9v4B1XX8ADktJnzQBAAA= X-Change-ID: 20261029-vstor-137668-block-let-container-root-set-the-block-size-70922fd9b2a5 To: devel@openvz.org, Konstantin Khorenko X-Mailer: b4 0.16.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=5263; i=khorenko@virtuozzo.com; h=from:subject:message-id; bh=o5yF6f//X40uwxFIV/ZZrBazGtT2q/lQ9JlQZ6BkIiQ=; b=owEBbQKS/ZANAwAKAVGWCkf5YVwqAcsmYgBq422KEQzzVqe0xnUrPOuaUaS3hDQhP2I18dUuD 7YZGcpjjGOJAjMEAAEKAB0WIQRWD23IPcXT0GO9CCxRlgpH+WFcKgUCauNtigAKCRBRlgpH+WFc Ki+VD/9SjAUwiLJPzRGatX/h8mFLPQ8jcoskRjmr+v5XhtXb4UT/h9BhrS2xBFii0biel+mEWA4 qZKnG+FBC/KD7UusxPn3UldKnTZrFa/dUlKf0xEDc18eAIoE7YbtG1BGLrNkWhg/tcqrcKGb7kk qKUJwEiATSYcsVdqO6saGqZa9sridl9V5L70MlsANj0qKVFe7kIHy+JQlYAdHmdXR+RAJvQ9yPH 5ukQMKIqYIUV8YyFA1nd+VDBhyxNJfrY8+YeDjBbOFPr1VNSDogt2BFzC3KHHRY/NRJdrpNDjVq 1nJ8+phG5MhUFcr/RUOXzebMzWbpeoTjuYvQgiPxbRA5UzLeIerpnSkaA08eq8+yrdH2JDhrXHh v0rvu/Rm8Rqz+TJ25sO9VUGqOMotulE6z3lZKymD1TVrEKhzSs5oJZohFOaS1Bt7tbbdIkidvNt oZBn0j2qPQJKsZ/ARavLT4GDe4OE9iCipAUNSjWqLEG3ON6sJRKgnzf8o08ulFAWxH3SOqo6cSC lyZBdHwrIcbtIrXtp+Eru5GFCI7mYR9EcCvQPDpymOoB5AouVWGdOK1JeyfGjDTjGPp+rXgx5sP OjF+ckElO/TKCEDAwQ0+KqU6m5CbN34nCKTZNOYXwOxkxBds25GKF2fa0t33OBBDIzMGTS/V7O5 6SzmNUMnLaPIDEg== X-Developer-Key: i=khorenko@virtuozzo.com; a=openpgp; fpr=560F6DC83DC5D3D063BD082C51960A47F9615C2A X-OZ-Fwd: true Subject: [Devel] [PATCH hci-8.1 v3] block: let container root set the block size of and flush its device X-BeenThere: devel@openvz.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: OpenVZ development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: devel-bounces@openvz.org Errors-To: devel-bounces@openvz.org From: Eva Kurchatova BLKBSZSET and BLKFLSBUF check CAP_SYS_ADMIN in the initial user namespace, so root in a container cannot set the block size of a block device it has been given, nor flush its buffers, and mkfs.xfs on a loop device there stops with "cannot set blocksize 512 on block device /dev/loopN: Permission denied", or with "Flushing the data device failed, err=13" once it gets past the first. Check the capability relative to the container, as the other block code adapted for containers does, and let container root through only where its device cgroup grants write access to the device: a device handed to a container read-only may be held by a filesystem outside it, and neither its cache nor its block size should be touched from inside. https://virtuozzo.atlassian.net/browse/VSTOR-137668 Feature: ve: allow various syscalls in CT root userns Signed-off-by: Eva Kurchatova Reviewed-by: Pavel Tikhomirov Signed-off-by: Konstantin Khorenko --- Root in a container cannot run mkfs.xfs on a block device it has been given: BLKBSZSET and BLKFLSBUF want CAP_SYS_ADMIN in the initial user namespace. The patch checks the capability relative to the container and lets container root through only where its device cgroup grants write access to the device. v2 also refused BLKFLSBUF from a container with -EBUSY when a filesystem was mounted on the device. v3 drops that: the path is reachable only with a write grant on the device, and with that grant the container can already overwrite the filesystem under the mount, so forcing its writeback through fs_bdev_sync() is strictly less. The sync is what syncfs() does, bd_holder_lock is dropped before it, and invalidate_bdev() frees clean pages only. A container's own mounted loop device now behaves as on the host. CT disks handed out by vzctl are not affected: libvzctl grants them write access for mount only, which bdev_permission(BLK_OPEN_WRITE) does not satisfy, so they keep getting -EACCES as before. BLKROSET and BLKRASET stay under capable(): the former flips BD_READ_ONLY on a device the host may hold, the latter writes the per-disk bdi shared with the host and every partition. The neoltp CI carries strict XFAIL rules for the affected tests (PSBM-139222, PSBM-139077); the xfs ones start passing with this kernel and need a kernel-version condition, ioctl04 and ioctl06 keep failing. Assisted-by: LLM --- Changes in v3: - Drop the -EBUSY refusal of BLKFLSBUF on a mounted device from a container, a device the container can write to is synced as on the host (Pavel Tikhomirov). - Add Pavel's Reviewed-by. - Link to v2: http://lore.virtuozzo.com/20261022022554.2427456-1-eva.kurchatova@virtuozzo.com Changes in v2: - Device in read-only cannot be flushed or have its block size changed from CT, depending on cgroup grant. Host path unchanged. - Device with mounted filesystem denies flush from a container with EBUSY. Container syncs its own mounts via the filesystem. - Host and container told apart by ve_is_super(), not by a failing capable(). - Corrected the claims in the commit message. - Link to v1: http://lore.virtuozzo.com/20261021175410.2339797-1-eva.kurchatova@virtuozzo.com To: Pavel Tikhomirov To: Vladimir Riabchun --- block/ioctl.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/block/ioctl.c b/block/ioctl.c index a3c53b04e1e34..c49a35b01cb05 100644 --- a/block/ioctl.c +++ b/block/ioctl.c @@ -9,6 +9,7 @@ #include #include #include +#include #include #include #include @@ -416,10 +417,20 @@ static int blkdev_pr_clear(struct block_device *bdev, blk_mode_t mode, return ops->pr_clear(bdev, c.key); } +/* Container root administers only a device its device cgroup lets it write */ +static bool blkdev_admin_capable(struct block_device *bdev) +{ + if (!ve_capable(CAP_SYS_ADMIN)) + return false; + + return ve_is_super(get_exec_env()) || + !bdev_permission(bdev->bd_dev, BLK_OPEN_WRITE, NULL); +} + static int blkdev_flushbuf(struct block_device *bdev, unsigned cmd, unsigned long arg) { - if (!capable(CAP_SYS_ADMIN)) + if (!blkdev_admin_capable(bdev)) return -EACCES; mutex_lock(&bdev->bd_holder_lock); @@ -527,11 +538,12 @@ static int blkdev_bszset(struct file *file, blk_mode_t mode, { // this one might be file_inode(file)->i_rdev - a rare valid // use of file_inode() for those. - dev_t dev = I_BDEV(file->f_mapping->host)->bd_dev; + struct block_device *bdev = I_BDEV(file->f_mapping->host); + dev_t dev = bdev->bd_dev; struct file *excl_file; int ret, n; - if (!capable(CAP_SYS_ADMIN)) + if (!blkdev_admin_capable(bdev)) return -EACCES; if (!argp) return -EINVAL; --- base-commit: 0a88195dfe7ad750d8e0d9815e70515a03b270f1 change-id: 20261029-vstor-137668-block-let-container-root-set-the-block-size-70922fd9b2a5 Best regards, -- Konstantin Khorenko, Virtuozzo Linux Kernel Team _______________________________________________ Devel mailing list Devel@openvz.org https://lists.openvz.org/mailman/listinfo/devel