From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.openvz.org (mail.openvz.org [69.168.225.77]) by lore.virtuozzo.com (Postfix) with ESMTPS id DEB8680E7E for ; Mon, 2 Nov 2026 17:37:19 +0000 (UTC) Received: from mail.openvz.org (localhost [127.0.0.1]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 6A2Ha4Ik027648; Mon, 2 Nov 2026 20:36:05 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 6A2Ha4Ik027648 Authentication-Results: mail.openvz.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=virtuozzo.com header.i=@virtuozzo.com header.b="tySNJIK2" Received: from mail-yw1-f200.google.com (mail-yw1-f200.google.com [209.85.128.200]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 6A2Ha2Ls027644 (version=TLSv1/SSLv3 cipher=AES128-GCM-SHA256 bits=128 verify=FAIL) for ; Mon, 2 Nov 2026 20:36:02 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 6A2Ha2Ls027644 Received: by mail-yw1-f200.google.com with SMTP id 00721157ae682-8ace1d95f5eso49786787b3.2 for ; Mon, 02 Nov 2026 09:36:02 -0800 (PST) X-Forwarded-Encrypted: i=3; AKwUvBwZv+LGz7hztOiLY57jracv2xGyZ73NH6W07MT4KJafYgm8BJ5IpKOyQ4z8BJLxx7OBgCRt/w==@openvz.org X-Gm-Message-State: APuU4Z8Uh33ABX90bM+Lse4Mj6bpWCOnC5omJYgVbqTMn5CEHsMaYzl7 h0175A+CvP7vz7WPaodlIAkKIxkk1Qmb0mkEw0xilfpUsN0EtERBIOmixAIY68t2sjf6YekpgJ8 jMpZLNlD/7++48x3l//MHkoy++5udKSA5xJbJf+tf17I/bGmk4nbb3w== X-Gm-Gg: AYBFou1sUIVyw7aV2sDFool0QGtDQlFPpQoHLdCauaxuv4LpVTb9A7HqJAbp4EysetK VPKwVjkAyCPzC/TFOm0sOnaBF3++FUX6f22I6uKUWO/puxofmmHE6zLVu2cNssICH13x6XA6MXt EOtCO+RMjvh25fTXMfI9fNAf0rBnjxaUvengkp/TlybrCNmsT0Esc0PPLkomWCJwrn3cwHHPqPq azK3EpcpzgtrN7e0sj77TONcANRXW94oaPOF6Q5UVU/4oksTeOCHysyL7Hgnu0yreUE/e1pZguf JIqYgtd4rOFUOu3KSkvQC9E/oP/4PNAm5sUS5KeVcATKVAcNHL42jJ6IU+mpIITKTi7gV+dUJFA 1UIsrCwuyC/xlctlnQVMo3ZgvBKr15j247s6PkGcKLPK2AFNu9Gh3x1M9ZRR3GcKiPJ5ARrx2po C7UmfIlOThaTi0vBF3D0sZVRlIygmWlVyH X-Received: by 2002:a05:690c:6e84:b0:8b0:e207:34b4 with SMTP id 00721157ae682-8b2b66d04c6mr82534617b3.18.1793640961773; Mon, 02 Nov 2026 09:36:01 -0800 (PST) X-Received: by 2002:a05:690c:6e84:b0:8b0:e207:34b4 with SMTP id 00721157ae682-8b2b66d04c6mr82534387b3.18.1793640961193; Mon, 02 Nov 2026 09:36:01 -0800 (PST) ARC-Seal: i=2; a=rsa-sha256; t=1793640961; cv=pass; d=google.com; s=arc-20260327; b=UlgpJNJdWl0QNGGfhtQ8pkJRzdYCXim++Iml/TimT1hKMvapQaDQUcYMjSBjIeHkxs fYZMV8qAtNCmJDlVXgsE8zTGKeParv+9AbsltEfSF4M9o3KdvFqKYqRYFTdl64jQOEJD iw57a88CgmaFOxDhWAoXQZMNUa2FZGKwBcfYE/a7QFIBZ6KFrJJ4GKIEZG/h4O+ZC6J3 S0DWK6McSTAmh8L3EUVXMIKJuyuo9GGLzm4MsY9Jf/EQ2jUuM1EEFF/qtzRB5Z/vZHWg /+2p5DRXjgryaQZRolNX91SGbSXPL718JRui/jnZs7+rQ6yJEx9cSqNpYE+ml02yhxKD 59ZQ== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=mime-version:content-transfer-encoding:in-reply-to:from :content-language:references:cc:to:subject:user-agent:date :message-id:dkim-signature; bh=TnEPyJmS2M+7zOylYjn+O1oXyMDRGtuXE0CPOpj5tqA=; fh=VQDKhBgz8Lx9RXvapRlbooCtsgGsUHg4STGkxjpnkho=; b=HP4ULlCM7sb2JlgMBGBdGvHBgoaes2ifq3cEANniXm/e2Hq1OEQJBHde3QCY7TEeKy nw6IDi4wpfl7UJmJZ6Z03ab5G8nCanbH9DW9gbr7DAZC4K5Pwe/x06wPUb+nuRIFKs9j 6Nl6C8nMOFvGafLM/5ftqFNnvDTBBLQVzYFtnMMOV//v89DSR0PSbEhEnzvwe5/x2tId ZSBS19wAmq6X0o7+YtBtSO3ntaiOoVl/K97IZuukr9aBYU7H5ViaydxHsvZdHpanJXgK hrflTrN/iEHzlee4nC+Ma8nnbyhb2rjpSeNZ/e9DW9KTv9TlNvNp+Colm4ptNCkhxtMF LF+A==; dara=google.com ARC-Authentication-Results: i=2; mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=selector2 header.b=tySNJIK2; arc=pass (i=1 spf=pass spfdomain=virtuozzo.com dkim=pass dkdomain=virtuozzo.com dmarc=pass fromdomain=virtuozzo.com); spf=pass (google.com: domain of vladimir.riabchun@virtuozzo.com designates 2a01:111:f403:c201::1 as permitted sender) smtp.mailfrom=vladimir.riabchun@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com Received: from AM0PR83CU005.outbound.protection.outlook.com (mail-westeuropeazlp170100001.outbound.protection.outlook.com. [2a01:111:f403:c201::1]) by mx.google.com with ESMTPS id 00721157ae682-8b2b71a3a0bsi66541707b3.143.2026.11.02.09.36.00 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 02 Nov 2026 09:36:01 -0800 (PST) Received-SPF: pass (google.com: domain of vladimir.riabchun@virtuozzo.com designates 2a01:111:f403:c201::1 as permitted sender) client-ip=2a01:111:f403:c201::1; Authentication-Results: mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=selector2 header.b=tySNJIK2; arc=pass (i=1 spf=pass spfdomain=virtuozzo.com dkim=pass dkdomain=virtuozzo.com dmarc=pass fromdomain=virtuozzo.com); spf=pass (google.com: domain of vladimir.riabchun@virtuozzo.com designates 2a01:111:f403:c201::1 as permitted sender) smtp.mailfrom=vladimir.riabchun@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=kNwaPo0HnjvFED/LcVJxNiKiDfx23GpU9RDCGtRLwhBeECfUYZRtkg65ujWPg8CNQ+TzM1oOBi/gdbrRwpuwsfuBCA/eLlsn9yLLUwQs7g0OXfB1GLSLnkuzioP5rLuh7Y2rS8diTCPt9AtZXbHyP8r+BIVxMexxtiktMNNUK4P/3S1mdJBH9HzIHa+7H/LWktFJEZxNqbfNmKs7X+dl6nb150peKhV9CPUhpDoq0R9UJv6On64Qgy1qy2T/ZUbczxal1p4eQZhv/XCtw+k0YRYDkEafwksbU9SclFXqT2AguA7eobzPDj6tH1a34gFEpqCVDCR2wfFNjRinlS3uMA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=TnEPyJmS2M+7zOylYjn+O1oXyMDRGtuXE0CPOpj5tqA=; b=GtZlbC1aVNCcz1gR4U0XGvZ2mbxOsOFfdQvrCrKmaB0vVNvHhxKa9vWTZjnPtfg4h4NpHn1Yh1AaAE2y8tBivNTqk0j6CVh3zcdoW+zir0/rm6rdzG0UbTT74EFV2vDywZBu49fjlP5z+iWMkY2OsV+DlTeCQlTwMC5lR5JT5+E6qhxxJI8fFfmPAiKXMhE8zAPnAyd6LQb9ZywuDde6crUOP7WPIjbs1q5rJVHSMYYEXkn2uS/fgwTi1Kmm3A2oL/uMU1A9ZLd+WdCaLBf0/pO83VvYdqUqWOTKhaX7pVd0S9uNNUJqFQKR5CtNpnwqTkbHcyiPIVwS8ORlSdICBg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=virtuozzo.com; dmarc=pass action=none header.from=virtuozzo.com; dkim=pass header.d=virtuozzo.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=TnEPyJmS2M+7zOylYjn+O1oXyMDRGtuXE0CPOpj5tqA=; b=tySNJIK2aVCQfsd+oxcsxmQxXniFTIrS0blSmqMd4jeN5Z3chv3O1QAGYgf6f37nkzq5c0bE5pSj6PiMzO7a3qfqF5Y4fdrxBmNzG20jV84gAyh2wV2n3iDc12RdtluMlJ8z0+g6WR78yzs34O0xJTGyGtphqbPtWlgvSRgTQWpZon4nV6zoIr6+aVQB9Oukb5rHDYYvF/M89K1GsIShSCeYrDZChkM63ZGxOSBFtf1lbeCdL0yV+9CYTw4vqMbE/kGdKVJiKEGMkTTJ2/tM03PP+pZ7iC0m8jfj6kmgbiITv43xtSn/HxwVlxdq2Lh3j/NBvgi2V8Zls+PBJ8jlWw== Authentication-Results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=virtuozzo.com; Received: from MI7PR08MB201474.eurprd08.prod.outlook.com (2603:10a6:290:112::17) by PAXPR08MB6624.eurprd08.prod.outlook.com (2603:10a6:102:dd::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.569.12; Mon, 2 Nov 2026 17:35:58 +0000 Received: from MI7PR08MB201474.eurprd08.prod.outlook.com ([fe80::f35b:af88:bd82:6dfa]) by MI7PR08MB201474.eurprd08.prod.outlook.com ([fe80::f35b:af88:bd82:6dfa%3]) with mapi id 15.21.0569.011; Mon, 2 Nov 2026 17:35:57 +0000 Message-ID: Date: Mon, 2 Nov 2026 18:35:56 +0100 User-Agent: Mozilla Thunderbird To: Pavel Tikhomirov References: <20261026-ovl-use-orig-ve-v2-0-eab58bfc29ca@virtuozzo.com> <20261026-ovl-use-orig-ve-v2-4-eab58bfc29ca@virtuozzo.com> <179318868950.3559520.6473416824609223980.b4-review@b4> Content-Language: en-US From: Vladimir Riabchun In-Reply-To: <179318868950.3559520.6473416824609223980.b4-review@b4> X-ClientProxiedBy: FR4P281CA0402.DEUP281.PROD.OUTLOOK.COM (2603:10a6:d10:cf::14) To MI7PR08MB201474.eurprd08.prod.outlook.com (2603:10a6:290:112::17) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: MI7PR08MB201474:EE_|PAXPR08MB6624:EE_ X-MS-Office365-Filtering-Correlation-Id: 0069c0bb-432a-40e9-d8fd-08df3907c0fb X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; ARA:13230040|366016|376014|23010399003|1800799024|6133799003|10067099003|22082099003|261102123227099003|18002099003|3023799007|56012099006|5023799004|4143699003|261022105027099003|261021123027099003|261021121427099003|261022075727099003|261026140227099003|261026121527099003|261009223027099003|261028144727099003; X-Microsoft-Antispam-Message-Info: cFDt1rgWNf+glHYZiIQAjb6HqnKQ97+k4NLHmuhylvOJbK3scsWM9dKxVgqxio37LpzTY72t3VI+NFvsrAWKQfdX4NM8YzcOebfVMUClDebQxooUqf+ZutZApdr26W6u+rapvPG73oDSfN+3/qhyMqrJ4kmNKExF/v0eii2KZygwB+7lgFmN2ROiX8Fvx7xbva6d7Pmzl6DlH+qwESenDM+Rqce4ycCmAFucCpqFgDv90Bp4DW4bhzG8Fh2gOP40YYBOiY/JUJ/ZTkzKkyxoHRnxe24AmXqEaxTCPbKsW/4jyFblhI4hrGsN1kR5r9QnY+bwSt6/GtIv8RKuGjzeXLGEcyyU/tTXH6KID3WoCC9NfzAusn9XmlBbdpCLjYKq1ZRja29Z/hoHCd1oUlR6TPB55KvEFvVBJd2p8IEvvij4yXYXu7oNOeKW+C0fPvtJDIyVKwGQ96cwmIniG2wrgmKw99fZ2beGM5h28QnLL60aa1jsQW0gHikU4MWymNrFvl9elgebfnSYz7SgDHmLqNbYhIkziBf87XxE1vtOUo06wefHvtv6Q9qXI6LRBRBRBS55l22W71Wc+7FzhixTjZoR3DAinD2l0NcwLkY2tQWNFkzLWRv1r8+0BXXE61FMQo3sthy5pF4Kxpu8HGcl/P2It4EXwQ2VeHGLQa94RX8= X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:MI7PR08MB201474.eurprd08.prod.outlook.com; PTR:; CAT:NONE; SFS:(13230040)(366016)(376014)(23010399003)(1800799024)(6133799003)(10067099003)(22082099003)(261102123227099003)(18002099003)(3023799007)(56012099006)(5023799004)(4143699003)(261022105027099003)(261021123027099003)(261021121427099003)(261022075727099003)(261026140227099003)(261026121527099003)(261009223027099003)(261028144727099003); DIR:OUT; SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?NWphWnNkQnV5NGQ3MGptNzdZMjNwVE9YdktWQWkzNVFRRkY2WjQ2VlBOUWRh?= =?utf-8?B?M3pSSUdaMGJWOEZJNTJmUXJoYy9WTGtIV0d3a1g5UnczZ2lrU0Y4aW50bk5G?= =?utf-8?B?VE9FaEJ4QkRkYmxGRC9UNW1lV3NqUHU0aFI4WTlDeEprV3FNS0NsN3F4WEho?= =?utf-8?B?T2wrVmtqZXd0ZEIxTnpMQUMyTE1pSTJ3T01Lam9VRmJWNUF4ekpWVG5LZHRU?= =?utf-8?B?eE9TNjRlOWY4Mi9ZeUVwUExoalVzczVJQjBDU1lKZWVVNFgyTXNwK2hhcmVK?= =?utf-8?B?a1F3bE9aaWlwd1lGS1FOYm1uWG93dDdrVU4wdDhKNk9YYi9SLzl1NjlhRE05?= =?utf-8?B?ditsaFZ0TmNCMUZRdUcwLzVkZ3AzYmhqdlF4VFh2OHVNbEhRcGFDYUZ6czY4?= =?utf-8?B?b0RFLzFuM0Zjd2hxdjJkS2poZUU1MC9nU1QrcGhsKzBpdlQ2WDlFcWJUTUZu?= =?utf-8?B?RVZ2S2loY3hUSytHejdDcC82eDRCSjF0N0liTWZ2bnFlSGMwd1NmYVJkMENa?= =?utf-8?B?T2xzMWVXQ3djQ2RadENJUWFtb01za1hGZzhjMzMvQytraEtrLzZLMjVLNTha?= =?utf-8?B?ZFJ2c1pVN1lZTWZ4bS91OFRpT1hMdXdGVU8wTlROZlVsWGVaNGgxVExoNEt6?= =?utf-8?B?RjVrbVE1Tng4U2lKVnJaZVFZd2ZaRDFiZHVaT3dvOTVYTHptSEhBOEd1RVlP?= =?utf-8?B?YjhoS3Z3T1drWDVQbENOMjFKUTgvNi9GeVFzSDlKM1Bxd0tvSHFITUZXL0o2?= =?utf-8?B?WFJuNkpYQnJxeXhPUWtmcVZXdnI1WWZpeTlRZUczYTgrb3BEeXR6ZXBNQ1Bk?= =?utf-8?B?Y0VSZTlRNFRqa3JncTdWMUg2MVp4UDRHK3NGS0J0YjYyaDQzVUo1TCtVUERF?= =?utf-8?B?UWViZHUxYnlEeXdqSG1ublZhRDlHUm9OSm5PYTlodGJHdW13OUVkSVl3TjlM?= =?utf-8?B?Q2d5Unk3K0N4dVhVQzQ5VzlidFRQTk1qQSt3RHBJMEhzb0RsWTFHWm9WRGJY?= =?utf-8?B?M29ObmFXZFFjR0VWTDQrUVcrN2F3TUV5MzhBQWhBU2xIdmI3Rk1PN2pUVVdX?= =?utf-8?B?bXVyN3pPRlpvbWREWUMwbGNDQTdScWM2L1UvUk5IUGl0WFFER0QydmRLdXla?= =?utf-8?B?cHFpWE9RcVJ5aXpNNGJSQ3lTSTlzTzNCZXJQczB4ZXl2SHNIZUVEd2dQc2lJ?= =?utf-8?B?Mm9BdWhDYTN5a1ZuSGErS2VycTFiUmJSUUx0bmFjQXpLK0QrekcwTTlnOEVJ?= =?utf-8?B?NndIM1NjVXFXZjdTenpDbzhpdkt3UE9xTUNkVmFPTm5sVHJ4aElnZmV4Znlo?= =?utf-8?B?QjRHSGhVVmxhbDBWTnJKaFFzc2xZekN2MklIM2t1Y3Z6ejloVFBOUVFBcmJJ?= =?utf-8?B?ZWlaQ2s3bkxWRHNoMzh0UlFGbUlOWW5KUGpCYXlERE5KUmhaemFrK2dxd3Mr?= =?utf-8?B?SlNmL2dxZ0VJWjhRLzFCQlZ6Uk95elROZXpJcCtXMkJmOWg5VXZ4SEk0aGtt?= =?utf-8?B?TEttSWxyU0hqZ0l2QlFvZjdRY0NLVFEvS2kra3lxTjlqM3laZnVyN3J5VmJP?= =?utf-8?B?akxieS9KbGtxVFZWaCtoN0c3Z1hETnZROG4ybmxRWXlzNjhDV0pQaks5ek96?= =?utf-8?B?Zm1PeFM5dmdmRVhvT3ZXUXhCVHA5RDJjSTQ4ZHh6REgzNldaOWtnZUEwdVJn?= =?utf-8?B?bDF4alVuT1FzcytGUlMwUmVydENqZ3Z4emtoK3hPdkVuNTBpeWJWV0lIZzJ5?= =?utf-8?B?bHc0bUp1N29OUGM4QWNTc2I5NVUrbXVOcWJ4cENzMmVXTExYbXJhNllPOUZ0?= =?utf-8?B?eUNJT3dtU0ZWWkhSUjFJcTlBZHhNdXozbkpmZVRicWxydExkUERWbzdYRlcy?= =?utf-8?B?VDNIU3ZlVkQ1UmloZzJyYUJtRVFzdWVXSzh5Z0s4U1RhZnpEbTA1YW1OeDlI?= =?utf-8?B?QVQzQzQvdURGd1Zjd1RhYXVLL1RyVUtKWE4yMUdOSnNBdVhObVJCSHEvRDVl?= =?utf-8?B?SjExWFdlL3NjMFFYVnhVMjNuWWdoV3MyRWpVTEs5TmxzeVFYMDVRWVpIbk12?= =?utf-8?B?aytwNnFEVFFvWDlraFJpcHNiY3ZWdDBsRWE3SGQ0dEpiMjU4WkVsbDhQaXdj?= =?utf-8?B?QzdHWGh5R1d2akpjakgyVXAzY3Y5clpuTkc0V2llNmMzeTJpM1d4c2VrWVZL?= =?utf-8?B?Y21jSjRvdlRRRVMvbk9kajlxUmpqRTVmRTZrN3N6bkMvbnpIKysyY2dMR3Vy?= =?utf-8?B?em9idnRlM2ZtS28xbngzbVJnS3NFVTVlVFkxTnJ6Yk9mNjVTR2RNaWRKQzZC?= =?utf-8?B?d3JZQnFZVGJSN1JRMVJXYjBmM0R6YThpUEpnTlFaL3RzSThJWE53ZEN1MXJZ?= =?utf-8?Q?vDUciSuna0NuYkes=3D?= X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-Network-Message-Id: 0069c0bb-432a-40e9-d8fd-08df3907c0fb X-MS-Exchange-CrossTenant-AuthSource: MI7PR08MB201474.eurprd08.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 02 Nov 2026 17:35:57.5847 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: Go1StBteAjmZ+6ZOs9kWjPuMieXSXqY5xirRlMU3MP4bdheYrRI+4lrr8LFe/RZ83TJKDLOIY3NaOWwXTTsNwWKABk80pE1TB3tAdgZ53IQ= X-MS-Exchange-Transport-CrossTenantHeadersStamped: PAXPR08MB6624 X-OZ-Fwd: true Cc: devel@openvz.org Subject: Re: [Devel] [PATCH hci-8.1 v2 4/4] ve/overlayfs: Override VE together with creds X-BeenThere: devel@openvz.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: OpenVZ development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed" Sender: devel-bounces@openvz.org Errors-To: devel-bounces@openvz.org On 10/28/26 12:58, Pavel Tikhomirov wrote: >> Host users might want to access overlayfs, owned by CT. In such case >> ve_capable checks will fail - they will perform VE cred checks against >> host user_ns. >> >> Modify ovl_override_creds so that it returns both old cred and old VE. >> This will also protect us from future rebase issues - all new users of >> old_cred and ovl_override_creds will fail with compilation error. >> >> This fixes an observed crash in overlayfs when checkpointing >> a container with a docker running inside: > > What about dead creator VE? It will try to check ovl creator cred > against host userns and fail and reintroduce the crash. > > AI slop: > // > ofs holds a reference on creator_ve, but after CT stop ve_drop_context() > clears ve->init_cred, and ve_capable() falls back to ve0.init_cred. With > CT creator_cred that means ns_capable(init_user_ns) -> false. So if the > superblock outlives the CT, e.g. CRIU (or any host process) has a file > open on the CT overlay while the CT dies, we again get > ovl_can_decode_fh() == true at mount time and false later, i.e. the > same NULL dereference in ovl_get_index_name_fh() this series fixes. > // > > I think dieing in the middle of CRIU c/r maybe not so rare a case. The simplest solution I see is to delay init_cred/ve_nsproxy destruction until ve_destroy. So stale users will still have access to user_ns/etc. > >> >> [ 2300.870181] BUG: kernel NULL pointer dereference, address: 0000000000000005 >> [ 2300.871537] #PF: supervisor read access in kernel mode >> [ 2300.872577] #PF: error_code(0x0000) - not-present page >> [ 2300.873595] PGD 800000010a18f067 P4D 800000010a18f067 PUD 10730c067 PMD 0 >> [ 2300.874900] Oops: Oops: 0000 [#1] SMP PTI >> [ 2300.875742] CPU: 1 UID: 0 PID: 5419 Comm: criu ve: 0 Kdump: loaded Not tainted 6.12.0-211.39.1.16.6.vz10.x86_64 #1 16.6 PREEMPT(voluntary) >> [ 2300.878057] Hardware name: Acronis OpenStack Compute/Virtuozzo, BIOS 1.16.1-1.vz9.2 04/01/2014 >> [ 2300.879684] RIP: 0010:ovl_get_index_name_fh+0x18/0x70 [overlay] >> [ 2300.880859] Code: ... >> [ 2300.884128] RSP: 0018:ffffd32582e0f7c0 EFLAGS: 00010246 >> [ 2300.885153] RAX: ... >> [ 2300.895807] Call Trace: >> [ 2300.896397] >> [ 2300.903298] ? ovl_get_index_name_fh+0x18/0x70 [overlay] >> [ 2300.904435] ovl_create_index+0x82/0x260 [overlay] >> [ 2300.905406] ovl_copy_up_workdir+0x30a/0x330 [overlay] >> [ 2300.906427] ovl_do_copy_up+0x10d/0x2e0 [overlay] >> [ 2300.907387] ovl_copy_up_one+0x456/0x720 [overlay] >> [ 2300.910736] ovl_copy_up_flags+0x81/0x110 [overlay] >> [ 2300.911740] ovl_create_object+0x51/0x130 [overlay] >> [ 2300.912719] vfs_mkdir+0x194/0x250 >> [ 2300.913470] do_mkdirat+0x14c/0x180 >> [ 2300.914223] __x64_sys_mkdir+0x46/0x70 >> [ 2300.915019] do_syscall_64+0x7d/0x160 >> [ 2300.922814] entry_SYSCALL_64_after_hwframe+0x76/0x7e >> [ 2300.923823] RIP: 0033:0x7f5a2f8de3eb >> >> Overlayfs was created inside CT, so ovl_fill_super stored >> in-container credentials to ofs->creator_cred. >> >> Those creds were later used in ovl_override_creds to temporarily >> swich creds and perform checks using them. >> >> One of these checks happened in ovl_get_origin_fh/ovl_can_decode_fh. >> On fs creation this check passed because we had container VE >> and container creds, so overlayfs thought that we support >> file handles (ovl_can_decode_fh call in ovl_make_workdir). >> >> When we tried to do something with the overlayfs from host VE, >> ve_capable check was performed with credentials from CT >> and with host VE. >> >> ovl_get_origin_fh returned unexpected NULL and all exploded. >> >> Stroing ve_capable check result on creation is a possible fix, >> but it just masks the problem. We have other paths from overlay to >> ve_capable checks: >> >> ovl_fileattr_set >> ovl_override_creds >> ovl_real_fileattr_set >> vfs_fileattr_set >> fileattr_set_prepare >> ve_capable >> >> And storing capability check result will make rebase dangerous - we >> would have to track new added code - not funny. > > All uses of ovl_creds() are not handled, they save creator_cred to > backing file: > > struct backing_file_ctx { > const struct cred *cred; > ... > } Yep, but this is a different problem. I think it should be handled in a separate task - require override_cred number matching override_ve when doing ve_capable. Here I think it is not distinguishable from underlying fs issues, so we probably won't crash the system. > -- Best regards, Riabchun Vladimir Linux Kernel Developer, Virtuozzo _______________________________________________ Devel mailing list Devel@openvz.org https://lists.openvz.org/mailman/listinfo/devel