From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.openvz.org (mail.openvz.org [69.168.225.77]) by lore.virtuozzo.com (Postfix) with ESMTPS id 3084E80E7E for ; Thu, 29 Oct 2026 16:08:19 +0000 (UTC) Received: from mail.openvz.org (localhost [127.0.0.1]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 69TG737d002271; Thu, 29 Oct 2026 19:07:04 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 69TG737d002271 Authentication-Results: mail.openvz.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=virtuozzo.com header.i=@virtuozzo.com header.b="iIGS972V" Received: from mail-pg1-f197.google.com (mail-pg1-f197.google.com [209.85.215.197]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 69TG714I002267 (version=TLSv1/SSLv3 cipher=AES128-GCM-SHA256 bits=128 verify=FAIL) for ; Thu, 29 Oct 2026 19:07:02 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 69TG714I002267 Received: by mail-pg1-f197.google.com with SMTP id 41be03b00d2f7-cdaf2073b0cso651342a12.0 for ; Thu, 29 Oct 2026 09:07:02 -0700 (PDT) X-Forwarded-Encrypted: i=3; AKwUvBxHjep3lv15wxdT7zWdAeZMSbsYdBZ4rDO3L68f5378aeXLsp+yBJXjL+/MlxfnHl+WXa8Okg==@openvz.org X-Gm-Message-State: AFq9FYID+AY1dwv2FiikGC+iDRVXAJy1LIVtGwmRxjP6BRVjKXWnFWMw ykA02e1pBXEM2MVvENu5miAN+CW1tNA4UlnjWqoUcP4NfR3mKIButFwgxxyETNxLfZxu9TWoe5O nF9x4TRTWli/8h8WglmThjF5A69CIm3VV3iRpPpGK7a5B9AIX4Y//ZA== X-Gm-Gg: AYBFou1BN58KupQZ7BwTptV/9VRk2myZrkrXHWm9H1/8s3Wd4uOjMkmMTnCH6THBgS6 WCoKzsK5tH3vnsbADetHCVqqKUKAelqA9trRMG5285GQ7leDJ+2KbabSr7bg9ePdG/hMXLDefNT XjSi2eZjZ8MFiiWB1Bl0MO1MTP/PVCv4ICP5hM6mjC4dxlTd0VQ6Y64ex85sYGEu3/MkNA+Wm0E KLUJuLu/6fh9OQaC/cXsoDh7nOVk+3vqGHVyzp0PfqR6ffAMWumB5NcntSRR8AUf69qzokGYKOc WjlqOPe3pHebGmRKOduX6KRnJHbnmNRBe1BJrZbuDrT7XHrl8EviOQDbkLkcIgjLTUPsmJPEt9P 90WDCkMfO0bPuXSJlIYF2YJHTn6cm3a1sLC80pQM9tHRJC1+11aZD3V+wxwnQfKdc7ffI1kzcoL AB7fcqCLHdFvdk9RRuqNpv18BNX0hi X-Received: by 2002:a17:90b:54c6:b0:39e:21a7:5df5 with SMTP id 98e67ed59e1d1-3ae580f1962mr4219319a91.24.1793290021032; Thu, 29 Oct 2026 09:07:01 -0700 (PDT) X-Received: by 2002:a17:90b:54c6:b0:39e:21a7:5df5 with SMTP id 98e67ed59e1d1-3ae580f1962mr4219297a91.24.1793290020517; Thu, 29 Oct 2026 09:07:00 -0700 (PDT) ARC-Seal: i=2; a=rsa-sha256; t=1793290020; cv=pass; d=google.com; s=arc-20260327; b=ocebr+20oqCJIAbMr8ec8AXVbDVrNLO9HIBkxws8rxASAWRDB0kBmgHrgQc6oqRenB bTeBjYPf+185RbVTiOqzUGvTdFjHVDtA+9D3m6KQlnv6/0GMy14hkF9ihvMaLBBtIlbd ghyrYBaUbVnhjdVWZgt2TBLuUbtGlSa41OOJKsTX8NFzmyxX9zwZSoZWBpI1hgCk3WBP +DX954n8mRRgVgsqCK+Ijp21/yl5Dv1kVq3H1XmncqdjHbqVp1pows3FePwrQhN4JWqz qGkN+BnKrniiMhX7itZM9I6v92mxEhcLohRmL1Fmoh0ArvACTZQfomWy365I8Q/aVEjN pNUg== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=mime-version:content-transfer-encoding:in-reply-to:from :content-language:references:cc:to:subject:user-agent:date :message-id:dkim-signature; bh=p6hxypnDeNQ6q5jEHqrH+eDDyiY9AIzomg7uU7iH0YQ=; fh=+VGu36pwhXIzvZeE+JvWoIY59Nzr5UdF/xhhkVqeCZI=; b=G71Vn4NX4+Jso1Y0MDW0ekuMIt5jGS9hveEiYQ5FqnBaIgE6TguoCvgBOluskVw805 WpIYuL1Vd3JtOkwUtFfCKRbDGzZmOOnGS7OE5Yll10FMSotlIAD2GygFLieIPvoNSwok s0KBmNO+onhbbzbDfUY3ZHjtqZTt+VeHepeyrLzB+VBTnH3keItKhYRaPrMNc9bU7Vr0 bgB3XWVvBctxns66CazoxgyQ/l7WM09vYK0jIx279JiM840PFmcVOZyxMLEkFKdcAuVx PUojjwP419XXb6R/ZqBwppDdZeB7ipxp818TWuIuDTKZp49Je/SDsE37PnmQb/Z42gt5 j4UA==; dara=google.com ARC-Authentication-Results: i=2; mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=selector2 header.b=iIGS972V; arc=pass (i=1 spf=pass spfdomain=virtuozzo.com dkim=pass dkdomain=virtuozzo.com dmarc=pass fromdomain=virtuozzo.com); spf=pass (google.com: domain of eva.kurchatova@virtuozzo.com designates 2a01:111:f403:c201::3 as permitted sender) smtp.mailfrom=eva.kurchatova@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com Received: from AS8PR04CU009.outbound.protection.outlook.com (mail-westeuropeazlp170110003.outbound.protection.outlook.com. [2a01:111:f403:c201::3]) by mx.google.com with ESMTPS id 41be03b00d2f7-cd8ccd1b9fbsi21366940a12.331.2026.10.29.09.07.00 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 29 Oct 2026 09:07:00 -0700 (PDT) Received-SPF: pass (google.com: domain of eva.kurchatova@virtuozzo.com designates 2a01:111:f403:c201::3 as permitted sender) client-ip=2a01:111:f403:c201::3; Authentication-Results: mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=selector2 header.b=iIGS972V; arc=pass (i=1 spf=pass spfdomain=virtuozzo.com dkim=pass dkdomain=virtuozzo.com dmarc=pass fromdomain=virtuozzo.com); spf=pass (google.com: domain of eva.kurchatova@virtuozzo.com designates 2a01:111:f403:c201::3 as permitted sender) smtp.mailfrom=eva.kurchatova@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=OnZZq33VI1La+fxAHViaHMobJcUwrS7cW4g9+UVvY9+sYnA2ZdmFlpO3Z5gjSyOOJd/c1+t/U+WpOnwl01rDfQv6v4MrVodmxwf3EG50Abf0atl17dLdnym2OzHQiF9EEdK0/eMmy8pDGUMS+DZX0LFlBZmrp+WYu6ygk6hQmjzJzOUlxER0I/l2Q1hTiHNSvnzs6VCKEwb7iPC1FkYrmPaiwzq+QUj94XWyXaGoadmCMrN/7sXwO2S9nw2mAwo9dcjcShDEAJCXuneUwMrY7PUTGsTl6GJZfllJgQzHROBD2LyxjlZPYyg7gOMu2DHICN8FwNGgwTREwzQXc028cA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=p6hxypnDeNQ6q5jEHqrH+eDDyiY9AIzomg7uU7iH0YQ=; b=ykQAU1CNvFocrfY8D6Rf8iA9aAms6BvjYakFOArPc5Ez27pAsNVDOJK1N33dQm2uRCZkVJAw8dw4mfHJntRac0E9BetQeUqMkQ4pOVQtJLE2Gc+vmgQ+GzfqWzU1f6X5umpe3+c54uxNvZkKitbFd2tESuxUxla1hUZkoZX2VXISBzgjZOH2RLzL8AybYYweqBmgCWBXiLbilYvXcpwbSt33TqgrDm8Mw5Ya75teyPY1NRWLzVApwjKD85DoUlYTq85zKMQa6SFLohg4TOCgx4q2STkS4MXld9KitKsJN/F5xO3xI7/pigdH6uRn6P1KuacCmRwMPU/v5CBhSsXXYQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=virtuozzo.com; dmarc=pass action=none header.from=virtuozzo.com; dkim=pass header.d=virtuozzo.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=p6hxypnDeNQ6q5jEHqrH+eDDyiY9AIzomg7uU7iH0YQ=; b=iIGS972VJk7kb1JMCVBewxGkR2rW3eF535RhrQ3g8MZ7CPlmWkEbeiL1Ici5hnTOTsWbG2N7vR094INiT4axfe6PGun48t5XhLtKOA5uN++f7H0HfZABQjscYN+9Mb42FHnUO+6nAK4Jkl+RF/mGPll4lm9N7CqUnwX8J+yU+sLZzv1zue3kUUgYr5vhknoFUIGc3cZ9LeIfc6avw64RUBJKWduio8JqcXU1J0vkcAIwoPuaNQJwltZ29xMr+Vp/bgJVVujS22J0AHwSGfCkGzBSrcGN6wsep0PyK5Rk7jJoiF1Vwgrbd8m61urJZijBfZ1uTkWJ/xjpRbr+N5V8/g== Authentication-Results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=virtuozzo.com; Received: from DBBPR08MB5929.eurprd08.prod.outlook.com (2603:10a6:10:208::8) by DB9PR08MB11379.eurprd08.prod.outlook.com (2603:10a6:10:60d::5) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.569.8; Thu, 29 Oct 2026 16:06:40 +0000 Received: from DBBPR08MB5929.eurprd08.prod.outlook.com ([fe80::8c14:5279:76ab:8d35]) by DBBPR08MB5929.eurprd08.prod.outlook.com ([fe80::8c14:5279:76ab:8d35%3]) with mapi id 15.21.0569.007; Thu, 29 Oct 2026 16:06:40 +0000 Message-ID: Date: Thu, 29 Oct 2026 18:06:39 +0200 User-Agent: Mozilla Thunderbird To: Konstantin Khorenko , devel@openvz.org References: <20261029-vstor-137668-block-let-container-root-set-the-block-size-v3-1-c3fd7db3777c@virtuozzo.com> Content-Language: en-US From: "Eva Kurchatova (Virtuozzo)" In-Reply-To: <20261029-vstor-137668-block-let-container-root-set-the-block-size-v3-1-c3fd7db3777c@virtuozzo.com> X-ClientProxiedBy: ZR2P278CA0044.CHEP278.PROD.OUTLOOK.COM (2603:10a6:910:47::6) To DBBPR08MB5929.eurprd08.prod.outlook.com (2603:10a6:10:208::8) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: DBBPR08MB5929:EE_|DB9PR08MB11379:EE_ X-MS-Office365-Filtering-Correlation-Id: 5a9bccac-6e87-41ab-5b5b-08df35d69e59 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; ARA:13230040|376014|366016|1800799024|23010399003|18002099003|22082099003|3023799007|5023799004|56012099006|261026140227099003|261021123027099003|261021121427099003|10067099003|261026121527099003|261022075727099003|261022105027099003|261009223027099003|261028144727099003; X-Microsoft-Antispam-Message-Info: 0Hra+MOwAErNT8emH5tSlAZY80AfUXHvzS6Zy3Tb7CgQ5yvfPyY5ettwib/z5mp/mPMfE4sZwwqvCtCwEqvkCgxYq0cOoFel9x6D0Fg7P6/H1Lua3I/NMVm4Pqaw7aqeWAiBLOg+9xezLokgEID0rG88a/Ku/vr58qX6U2pttuQw0vFgvC2vL4k66dX0/TEKJKtUpPFR75KbmgkzlpsE1ORWn1znG9iLR6mumibYz9BvC5GeJye7cgPqvw1CiGHDmYWwu7AvV2S5rx1vS2hM7OUIUynVIKvjR1v0n0BWMaPPb3jNsElLlSLUV04Rss1HzuJezNBhR3JcXrgGYJzcnm3lusHcKKjtXL+1WaK4ZYysKiTs0h8omNLo+iLI1TpLa5yPoM1lob/oSW3hyVD96KLYkNgEqlswqKJ8bm2L9BnHkA0DHgbG0IJe0lvFIWLm/WBENVR3rB9eye10wpxOXGfMYHfWReQYaE4jTmetbhbwpf10+saI1CYmVAg2zY74ZCRBGR+lw3wWECb80WisW1w+y3H5MUd6rJlDITTdx5ckrq5aTGMde5E2c9qFm1QOGz/dOQAfM2ew7nWFGBljXrfSHTfKdAhMUds461o1R5NhuL5zDJGkWYx8OldLLdzI X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:DBBPR08MB5929.eurprd08.prod.outlook.com; PTR:; CAT:NONE; SFS:(13230040)(376014)(366016)(1800799024)(23010399003)(18002099003)(22082099003)(3023799007)(5023799004)(56012099006)(261026140227099003)(261021123027099003)(261021121427099003)(10067099003)(261026121527099003)(261022075727099003)(261022105027099003)(261009223027099003)(261028144727099003); DIR:OUT; SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?TTZSYzkyQ1ppcnhQOUxEeDFwZ3hRbHhIZ0tuNEdCa21rcitieExTT0swVVJN?= =?utf-8?B?d1lTQlcvanpsNlZ6MVBtaCtlSkdxdEhzeWtuRjFPNS9IR29rV0w3MEZkUHJC?= =?utf-8?B?TzJCVEFhUUFUcE5kMkRkU0ZneXJjY2VvTjUzUzUvYlFRbmE4d1NLeWtPZUs0?= =?utf-8?B?SUZtUmw5SWJEd0lkMHQvNklFUnJMakRPT096bmw5M0cya0oraXUraTdDRm1F?= =?utf-8?B?VFBtcERUV1VFRkpLdjhaVHpNZTlJYlJJd0VMSHprM2lkMW81a2xiNlJ0cEsx?= =?utf-8?B?U0hVUzBBdjZheGF3YW9MVlFBZDIxTmtnZEVodzVBak9ZQ0N4WUthTTZjU3V5?= =?utf-8?B?Q3FueGh6V2xEcWpWTUVYQkZwZ1BIVG5EL0tyM3prSkl3YXpSVlNER2k3RFZv?= =?utf-8?B?RGVRd0hWK3FINXZ3dzhxbHJSM29Kb2t6U3FtSm1NczN1TlZPMGF2UDBHMnhN?= =?utf-8?B?OTVwQnJIc0ZQVkhWNGhOKzgyWGxGMG1zQTBGRUZzTmJWNXRPYmYyWG5KbTVm?= =?utf-8?B?b1EzNHVxcjVidHZHVW5xRnRlWk5EUi9SWTVyYWM3ZmJXMmhHV2FHNkZOeUl5?= =?utf-8?B?ZUp2MUplYzlIZjBONzArVWNiNHBlK0ZTbytwY3ROZmxUQnI1N3VtR0hTbXBF?= =?utf-8?B?MGZ3bGcydkpqRVRPVWRjYk0rbXpnNXV3dlpDRFM0Tm10QjJ3c1lWSDlVYUpw?= =?utf-8?B?TGJxWTRvVnhpQnhuL0g2QmdKT3RjYkhkdlh4Mm9jME9zT2ZvVURwZWx3ZEp6?= =?utf-8?B?TVJ0MkFDdEtaKzFXTHJQVGh4V3RidzFuL1BBLzZTeHZaNlJmY2VBSGx5c0FE?= =?utf-8?B?V1lpd25Ma2QzRDFzck5nRjVmamxEK2VpcncvR0JpUG44bDQremlEaG1vVjRK?= =?utf-8?B?bFdsS3JpWE1LOFhTRWdjUW1ydG5peVF3ZWZCUUlOemN6dVBGZ2IvUWJjMUxa?= =?utf-8?B?RTFmTTlNQW8va1VYWjhCN2FYTGhiVXprZEhsK200UXREMnBwOWRjMEVWbzZ5?= =?utf-8?B?NnlqZC85bVNLd1VHby8rOFB1RVU1aWNoY01wU1pBamM1ZEs0NW1JSkVtZnRJ?= =?utf-8?B?ZVowaXpQOTNPTThhSDNSZFlldk5uVm51SHJEQ0RqQ1RwN0w2VUljOUNQVWgy?= =?utf-8?B?amNBUUNzTTU0VXZBaU1XU2V0bTZHaG50amZzemRKNEs2QkNHUTNQcEI5amgv?= =?utf-8?B?RnhwRjhsb0xaaUtQaWZIWWhPa21ZWFJEa2FwZm5HMG9VZVZ4NzJZTTcwWE4w?= =?utf-8?B?WmtFVFlnQkFFVk16VEt6akZUa2QvMGZNUGh4VzlmS3VUUFZ1TzQ0RTdscXlL?= =?utf-8?B?ai9oQmx0WWQ2UWdnSGx1UjRnanE4cENwQU5KbW1xTlUxWWpvSytDUE5QUjBx?= =?utf-8?B?ZXRETVNJUlBUSEhpZDNiYitXZlNndldTNnQxMC93RFRPbDd0YmdQbGhDUUYz?= =?utf-8?B?WTFnQjQvZkJUTGsrS2JJK3JvNGFkNWNNS1ZSOTdiT2RSbGZzYTlRY1lIZDVP?= =?utf-8?B?NGE4RUZLOGUvM21NbCtpZFo1SkxjcmZ4VVB4aVZQZ3FTRFNqdThMaEM2QTFS?= =?utf-8?B?cnV6UHRWMVQvMWZBVUJJT2Z0Z0RiemN3YmVwVk1xSW5NSWNURjJhQ0FZa3FC?= =?utf-8?B?bExWdFZEMjJHOWZVL3g3M1JHdDZQQWlHVHVFNURRRWtJNHlCM3pzTEExNHM5?= =?utf-8?B?S1FRTWp6aldNWXhySkR2aWNiMlhXaU9TQVd1bjdmTXNHdU9ldStEampTdDVs?= =?utf-8?B?Z2lEVHNtUHhiQSt5VE16ZmhNb1JVK2ZubWtCaHg3UXlRZjhFZ0MxMEo1cktt?= =?utf-8?B?WVhnR0MvZ3dpNE9wWmwyNzdDRVdkajhBOUpETGh4djU0akdsNjdYblIydGFE?= =?utf-8?B?OFRPZlRvSlBlWjU3SFQweThRTXZjaGg4NExQclp0VUhUSFZEczhhSmdpcEpK?= =?utf-8?B?bHppb25mTnpiMy9zYXFSTmZBVzg4dzAvZDZKUnpqc3lPeVZMY25YVzN6YmNG?= =?utf-8?B?K2RmblBFU3paY0NnV3I5NEZzMVl2Um1XZlU5WDFvTmVkM1pYNDNBdXBIQWl5?= =?utf-8?B?Umt1NlRPWjRnVFdqa0M0aU1DTmh3aHYzcG5PTndvczJBL05JMC9mVS9JZWxn?= =?utf-8?B?ZzFpUkh6dWtNcGZMWHl1alJ4bXVkOUdNODlnZDlCQ0N2Lzd3KytuVk5ESFA3?= =?utf-8?B?ZkJHdTV2c1NEWGNsVGREdWZTZHdrejJYUTBwY0ZqZy9jSDZrak5SeVRyN01w?= =?utf-8?B?Z0J0RTBVY0FjK09leEc3ZWRNZUpEN3d0WE5XUHFzeGx5QXNqYnF6WkpManVE?= =?utf-8?B?Yno2SE81Z05iYTlHa24xN1hRemRwcVpUMjVLYzJhQ2NlR0x2ZlY2dFBHUUdG?= =?utf-8?Q?lX8gtsvEnz0F+T88=3D?= X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-Network-Message-Id: 5a9bccac-6e87-41ab-5b5b-08df35d69e59 X-MS-Exchange-CrossTenant-AuthSource: DBBPR08MB5929.eurprd08.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 29 Oct 2026 16:06:40.7091 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: UnSCncWvsWW4CiAHDcsyaf0Idn+D6uI7FLiHxbqTkEIOLbmuW9GYrzZ/a4g2DV6o1IzPqIimni0nw3yZny7N9rWzY4yXMvrKQhWlzQd6rXQ= X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB9PR08MB11379 X-OZ-Fwd: true Subject: Re: [Devel] [PATCH hci-8.1 v3] block: let container root set the block size of and flush its device X-BeenThere: devel@openvz.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: OpenVZ development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed" Sender: devel-bounces@openvz.org Errors-To: devel-bounces@openvz.org On 10/29/26 18:00, Konstantin Khorenko wrote: > From: Eva Kurchatova > > BLKBSZSET and BLKFLSBUF check CAP_SYS_ADMIN in the initial user > namespace, so root in a container cannot set the block size of a block > device it has been given, nor flush its buffers, and mkfs.xfs on a loop > device there stops with "cannot set blocksize 512 on block device > /dev/loopN: Permission denied", or with "Flushing the data device > failed, err=13" once it gets past the first. > > Check the capability relative to the container, as the other block > code adapted for containers does, and let container root through only > where its device cgroup grants write access to the device: a device > handed to a container read-only may be held by a filesystem outside > it, and neither its cache nor its block size should be touched from > inside. > > https://virtuozzo.atlassian.net/browse/VSTOR-137668 > Feature: ve: allow various syscalls in CT root userns > > Signed-off-by: Eva Kurchatova > Reviewed-by: Pavel Tikhomirov > Signed-off-by: Konstantin Khorenko > --- > Root in a container cannot run mkfs.xfs on a block device it has been > given: BLKBSZSET and BLKFLSBUF want CAP_SYS_ADMIN in the initial user > namespace. The patch checks the capability relative to the container > and lets container root through only where its device cgroup grants > write access to the device. > > v2 also refused BLKFLSBUF from a container with -EBUSY when a > filesystem was mounted on the device. v3 drops that: the path is > reachable only with a write grant on the device, and with that grant > the container can already overwrite the filesystem under the mount, so > forcing its writeback through fs_bdev_sync() is strictly less. The > sync is what syncfs() does, bd_holder_lock is dropped before it, and > invalidate_bdev() frees clean pages only. A container's own mounted > loop device now behaves as on the host. > > CT disks handed out by vzctl are not affected: libvzctl grants them > write access for mount only, which bdev_permission(BLK_OPEN_WRITE) > does not satisfy, so they keep getting -EACCES as before. > > BLKROSET and BLKRASET stay under capable(): the former flips > BD_READ_ONLY on a device the host may hold, the latter writes the > per-disk bdi shared with the host and every partition. The neoltp CI > carries strict XFAIL rules for the affected tests (PSBM-139222, > PSBM-139077); the xfs ones start passing with this kernel and need a > kernel-version condition, ioctl04 and ioctl06 keep failing. > > Assisted-by: LLM > --- > Changes in v3: > - Drop the -EBUSY refusal of BLKFLSBUF on a mounted device from a > container, a device the container can write to is synced as on the > host (Pavel Tikhomirov). > - Add Pavel's Reviewed-by. > - Link to v2: http://lore.virtuozzo.com/20261022022554.2427456-1-eva.kurchatova@virtuozzo.com > > Changes in v2: > - Device in read-only cannot be flushed or have its block size changed > from CT, depending on cgroup grant. Host path unchanged. > - Device with mounted filesystem denies flush from a container with > EBUSY. Container syncs its own mounts via the filesystem. > - Host and container told apart by ve_is_super(), not by a failing > capable(). > - Corrected the claims in the commit message. > - Link to v1: http://lore.virtuozzo.com/20261021175410.2339797-1-eva.kurchatova@virtuozzo.com > > To: Pavel Tikhomirov > To: Vladimir Riabchun > --- > block/ioctl.c | 18 +++++++++++++++--- > 1 file changed, 15 insertions(+), 3 deletions(-) > > diff --git a/block/ioctl.c b/block/ioctl.c > index a3c53b04e1e34..c49a35b01cb05 100644 > --- a/block/ioctl.c > +++ b/block/ioctl.c > @@ -9,6 +9,7 @@ > #include > #include > #include > +#include > #include > #include > #include > @@ -416,10 +417,20 @@ static int blkdev_pr_clear(struct block_device *bdev, blk_mode_t mode, > return ops->pr_clear(bdev, c.key); > } > > +/* Container root administers only a device its device cgroup lets it write */ > +static bool blkdev_admin_capable(struct block_device *bdev) > +{ > + if (!ve_capable(CAP_SYS_ADMIN)) > + return false; > + > + return ve_is_super(get_exec_env()) || > + !bdev_permission(bdev->bd_dev, BLK_OPEN_WRITE, NULL); > +} > + > static int blkdev_flushbuf(struct block_device *bdev, unsigned cmd, > unsigned long arg) > { > - if (!capable(CAP_SYS_ADMIN)) > + if (!blkdev_admin_capable(bdev)) > return -EACCES; > > mutex_lock(&bdev->bd_holder_lock); > @@ -527,11 +538,12 @@ static int blkdev_bszset(struct file *file, blk_mode_t mode, > { > // this one might be file_inode(file)->i_rdev - a rare valid > // use of file_inode() for those. > - dev_t dev = I_BDEV(file->f_mapping->host)->bd_dev; > + struct block_device *bdev = I_BDEV(file->f_mapping->host); > + dev_t dev = bdev->bd_dev; > struct file *excl_file; > int ret, n; > > - if (!capable(CAP_SYS_ADMIN)) > + if (!blkdev_admin_capable(bdev)) > return -EACCES; > if (!argp) > return -EINVAL; > > --- > base-commit: 0a88195dfe7ad750d8e0d9815e70515a03b270f1 > change-id: 20261029-vstor-137668-block-let-container-root-set-the-block-size-70922fd9b2a5 > > Best regards, > -- > Konstantin Khorenko, > Virtuozzo Linux Kernel Team Acknowledged-by: Eva Kurchatova _______________________________________________ Devel mailing list Devel@openvz.org https://lists.openvz.org/mailman/listinfo/devel