From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.openvz.org (unknown [69.168.225.77]) by lore.virtuozzo.com (Postfix) with ESMTPS id BF74F80726 for ; Mon, 12 Oct 2026 14:03:48 +0000 (UTC) Received: from mail.openvz.org (localhost [127.0.0.1]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 69CE2SQM023285; Mon, 12 Oct 2026 17:02:29 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 69CE2SQM023285 Authentication-Results: mail.openvz.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=virtuozzo.com header.i=@virtuozzo.com header.b="hNQfJVM8" Received: from mail-yx1-f70.google.com (mail-yx1-f70.google.com [74.125.224.70]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 69CE2PGM023281 (version=TLSv1/SSLv3 cipher=AES128-GCM-SHA256 bits=128 verify=FAIL) for ; Mon, 12 Oct 2026 17:02:26 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 69CE2PGM023281 Received: by mail-yx1-f70.google.com with SMTP id 956f58d0204a3-6790b1d37e7so2331155d50.0 for ; Mon, 12 Oct 2026 07:02:26 -0700 (PDT) X-Gm-Message-State: AFq9FYJE1Sk3gjsml8j5TUz3AkL4K8qh3P6fmlLIdO1rLGDYxdtH9fCC A0CEud9XLmsfjLGMRUqsElq+0o+Fwdlbm2/n8wQfbowi+Gw5xP58mPaD/w+kjROmAsWbZSAwX28 GMhRgDZX/OxA5vw+N10FGWHuCLtsVtvN4SrusWYo8IpF4G5g+lLe8Jw== X-Gm-Gg: AYBFou2OST42fqHm2sNCp8o+toLJJloP+Xm8qEhFxR52KvIO/kJb6/I3R193ToyiREr SapXhK2rLprPxf/REAcwRtGueud3iWOSx2p5SP9h3CkKu5wFxjOlQFb9d2OlG8BtZL5WbRSMH6Q +TNLET/mEECJFqrTTMzhUjBF8PG9iI/AnUESJMoTg33/YS395RLarmZNIZaaQFoecD3blRZzCd7 dYwAzJ0m+2FNPMWiFB6E4ooDoMNzfI003qNRTIoPvFfi2RUHkKdiXA2p3YtCASdpB0+2lmf2Bjb MZ5iXII9X4al7Hwcw4KYFlsEijjg5lz14dbl5oFj0+NxtuxMmc+BAmnNAgAfS5CUWjPGXIkuczh YdrdOi1K/xkP8mAywTUYSO9UfyoQ5XGJNzF7X8GJ0gO6cObQbqDsEgAKiAGStRdR4QkeHLr6aeM SGqSJ/IjyS0MruEzRczkKVtKA01g== X-Received: by 2002:a05:690e:13c9:b0:674:1f9a:401e with SMTP id 956f58d0204a3-6793605de1cmr3438154d50.60.1791813745443; Mon, 12 Oct 2026 07:02:25 -0700 (PDT) X-Received: by 2002:a05:690e:13c9:b0:674:1f9a:401e with SMTP id 956f58d0204a3-6793605de1cmr3437787d50.60.1791813735609; Mon, 12 Oct 2026 07:02:15 -0700 (PDT) ARC-Seal: i=2; a=rsa-sha256; t=1791813735; cv=pass; d=google.com; s=arc-20260327; b=goIISa8MZqQrBrONlVzSyq2mxBdSMxjdNYO0xPoPkneo/v8a06suM7VKASaDAsucRd dlcLi15gLcXxN8Cm5XFVzNl9DyPRd3IFBM8OTwNPtoIIew2VgtZ/U2ffXa3MIKrstsAb EzUca+ON9XXah/NQxYIL9Rc7x7eW8BVsrffH1BQMsT+yd0Leh0WQVPKdgWg5hcCJK3Fy lHrY98fY8Q4dvy8+VFiv/SjA3C5DZGguy11wy7165UjUvWABw7+QOyAcVJdCZbqz6e0Z MxJbmcHbMrv5OdqV8TfJ+c0voGMFzzybQq9PXfZVI8/+w8UeMCNJacFAOKIk79QPSb9x 8kAA== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=mime-version:content-transfer-encoding:in-reply-to:from :content-language:references:cc:to:subject:user-agent:date :message-id:dkim-signature; bh=gnTfHs5//O+Mky/LRlLJPB1nCX5ZzV32TJ9yPChErH8=; fh=BRRxu66IxuZhqi+nRuayoL3+qJ6ygEZddpZV187zNZc=; b=aT49CXwkCfRss/d510uRd7TlYke00iQ3SFSbfazKyRAjcR87lSJKufu5ifRENaU4xk DDmy3/pKb6op7CZX/b4Lvfwwt7oXnI4XBpmHM5A2LIekicnYX0iMGzBQEwTg/Zskj0Ts isN0ooou8/iRrIH7adnkFB4RiY1vB5zaEyhxEu/rAnUQLLUrnOwa+mWWfh81/1ShFSP7 PUiY9Cr6J2E6oNGh/Sd3L52hsWvGhsCEHtp4PsGdICYMYiOqQoL0mHYHPNYVChl0neqi HRU41J+913UFh+9ThaWZzUfFkcG3w1n7qTritxBh4MXRNw4SYC2WD8dHNgDkbyc7oGRo 2dFg==; dara=google.com ARC-Authentication-Results: i=2; mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=selector2 header.b=hNQfJVM8; arc=pass (i=1 spf=pass spfdomain=virtuozzo.com dkim=pass dkdomain=virtuozzo.com dmarc=pass fromdomain=virtuozzo.com); spf=pass (google.com: domain of ptikhomirov@virtuozzo.com designates 2a01:111:f403:c207::3 as permitted sender) smtp.mailfrom=ptikhomirov@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com Received: from MRWPR03CU001.outbound.protection.outlook.com (mail-francesouthazlp170110003.outbound.protection.outlook.com. [2a01:111:f403:c207::3]) by mx.google.com with ESMTPS id 956f58d0204a3-679356636e0si4351321d50.148.2026.10.12.07.02.15 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 12 Oct 2026 07:02:15 -0700 (PDT) Received-SPF: pass (google.com: domain of ptikhomirov@virtuozzo.com designates 2a01:111:f403:c207::3 as permitted sender) client-ip=2a01:111:f403:c207::3; Authentication-Results: mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=selector2 header.b=hNQfJVM8; arc=pass (i=1 spf=pass spfdomain=virtuozzo.com dkim=pass dkdomain=virtuozzo.com dmarc=pass fromdomain=virtuozzo.com); spf=pass (google.com: domain of ptikhomirov@virtuozzo.com designates 2a01:111:f403:c207::3 as permitted sender) smtp.mailfrom=ptikhomirov@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=BYbVQr8nLJt2mcuZZaaRZom7UtlowkfaUZx9JS5HD/gjzRxR+HPeJAj4BrAkXbXkLFgublcFBtm55KRM4rWITsKEkgOFsP0JzOi8vNKkopGKjMxrJheGnXs81FFJVeqHdFosOAOO6MZB81oklo4GbL60+3Vx+ugywrrKRgsgE0S5gEwnbvM58cKy5tVJQkMovIgtnr1pWaUBH33L/AwRssUDsfSt893/IC7Ku5H9HWiLQkvN2/UZkhpAxZOtOY6mDkXmZpS0emKNXzI+euytEZm3SflfM25FaoJy4f+0aclDq6PU6KY6p2B1GWL69OCFa0KVBxiljFb4B67le7jLSA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=gnTfHs5//O+Mky/LRlLJPB1nCX5ZzV32TJ9yPChErH8=; b=FF0sLC8ho/gGw5XlU5vcGuX/BF9i3IFpi0+/ePr0iw4WxfN9vPbEawquaiQ5Sbv5RYH3XDLXp+X/mTRgearURVs2tNXS/Se0UcKn58sdEdr/788T3jHos0+gLNhAXCIT5KP2keesjiJI+O54/CJASBw5ZtXgHHnT02moqBl8kUufDZF8bcS81YdM8hlDDDqa2ejK1RMl/e+uGgSJVpUlCWUFvSFMFpFDghjCI8e32j79AVNBPtqLt6E2EDtYRlnyRlm8CA0SgVdH2Yxhz+BaoQUI7o/W+mrtk0ZhnW4NTXb2MKTJnuXI5Ac6c/ipljdkfQNlJLqKWUDuCbkAp55Lzg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=virtuozzo.com; dmarc=pass action=none header.from=virtuozzo.com; dkim=pass header.d=virtuozzo.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=gnTfHs5//O+Mky/LRlLJPB1nCX5ZzV32TJ9yPChErH8=; b=hNQfJVM84TPyogc4I0WUfTurhvvNII+KpvDAeXzlB116W19/PTR+Q2zgheUCIO1+qxy8bF0Gtbf916C4/wwwbKKo9/OIkQGN2I6VlU2NVUQ6OD/1DXEebJS8DPXm0l1jzVE4rfRmLrj8HafjDG33ANuvmbBW/DuHBxuHugA76n9s5DH5KwsZXjYJCfezJHUcINh4PNrrzxLgVbIH8Kquq6gY8iCB7YhLEMwdfdVawxkAoxeFu3tXBEsCH1kGshu1wUYaxHzG/771OM+nmS92GXSackaAUU5jY5iI/A0bWdgxS7u49g3/MIqFWPbrOJ9n24N/WsSm4WlvHxyhNWVGtQ== Authentication-Results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=virtuozzo.com; Received: from AM0PR08MB11804.eurprd08.prod.outlook.com (2603:10a6:20b:747::14) by DB9PR08MB6633.eurprd08.prod.outlook.com (2603:10a6:10:23d::6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.522.11; Mon, 12 Oct 2026 14:02:10 +0000 Received: from AM0PR08MB11804.eurprd08.prod.outlook.com ([fe80::bf46:f137:f6d2:5b3a]) by AM0PR08MB11804.eurprd08.prod.outlook.com ([fe80::bf46:f137:f6d2:5b3a%7]) with mapi id 15.21.0522.009; Mon, 12 Oct 2026 14:02:10 +0000 Message-ID: Date: Mon, 12 Oct 2026 16:02:09 +0200 User-Agent: Mozilla Thunderbird To: Mirian Shilakadze , khorenko@virtuozzo.com References: <20261012102058.46896-1-mirian.shilakadze@virtuozzo.com> Content-Language: en-US From: Pavel Tikhomirov In-Reply-To: <20261012102058.46896-1-mirian.shilakadze@virtuozzo.com> X-ClientProxiedBy: BE1P281CA0269.DEUP281.PROD.OUTLOOK.COM (2603:10a6:b10:86::8) To AM0PR08MB11804.eurprd08.prod.outlook.com (2603:10a6:20b:747::14) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: AM0PR08MB11804:EE_|DB9PR08MB6633:EE_ X-MS-Office365-Filtering-Correlation-Id: 96ec357a-944b-4bde-468d-08df286968dc X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; ARA:13230040|23010399003|1800799024|10070799003|366016|376014|10067099003|3023799007|261009223027099003|5023799004|6133799003|22082099003|18002099003|56012099006; X-Microsoft-Antispam-Message-Info: uOqZBuJ1q7kxRHO/Q0Ji9OuLRO0C38oA8iZ+xpRSlSLjlVkMatAr/Ol9/BbesVXj6xD6i8yYPn7+RVCgImjScX/8wJU3X62NrG0T6OxYHC9JeOFqy+IMPgFGHxUxFjbYRTJnNu55S2c/FTKO9OO8E+18mJHw/MjTEFgNCnt2wYOZ0lBS4Y39iHFX2W08kNZ0ej0tYErAUWAiPLM6YB6yBM7YJcKWSxygjVg/IDswXy88LbcCpk5CIpplvygHI8iFI/UJ1CejLRyLAF2TWgWJejqByvFxyGC1J8hpR+ObT9F6S78+I11N2pGDSi8GJDFi83M/idvL1JDonVWGSMz2lqp1ZB1Hmd7LPHMpC3kbGDFZdMj2AF1agF1jD99BaiVH9QCGIWd84JFh3v4Vxrl1t9ezqTNweZ0jQwghn93wEf2xxhgoZ2ip393UbUVhiXgSWn9UkFndAVJ/ZlWxaXtDMTMaxwW+i5HhAAmBFPrwJhHNwG0SNCpp4JkI3ZjFO0Y1imR03r4Xahz2XmQLyf7CPQeeALDc5r2urjZDgkALAhCWEsMefDwSTUbr68eYK7UO6q4vW46+JGJASuniG9AVczUCNqefZx51vu/cWNcz2HsJ79eFdTL6vBrNZQaffeH49+3AhYQQVvK8PDpNn4VSlRMJbGoTFpJ3qHvKWExGPXg= X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:AM0PR08MB11804.eurprd08.prod.outlook.com; PTR:; CAT:NONE; SFS:(13230040)(23010399003)(1800799024)(10070799003)(366016)(376014)(10067099003)(3023799007)(261009223027099003)(5023799004)(6133799003)(22082099003)(18002099003)(56012099006); DIR:OUT; SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 2 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?Vlh6ODRoMGtRZjc5bXhHWnNLK1FCeFM1WFNDK2dYUE1iT2dSTEVGZmgrdW83?= =?utf-8?B?djNGVUMvWmxoTmlXc1k3WTc0bnZKN00yeUZPRVdmTThOUXZSZThQSmVhVS80?= =?utf-8?B?YWUwbG9BRWpvVkxEck56eWJLS25KcTZDUFovaVR5bWJhODNCWGN4WXNHdkxv?= =?utf-8?B?ZFQ0QUFRRmVmK0hNTVhVOTVaNXVCNWg0N3U5QlJvL1kvc2NwVGNkSFFXQzB4?= =?utf-8?B?Sm9QMGo1eW5vbmJuMkFtQTFoMy9ZTTRuMllIU29JRGhJdHljUjFiOGNsbkZ0?= =?utf-8?B?NHBKclpEQnBmcjk3Q0s2K3FGLzR1Skc5RlVOTU1FMW5jVi9CRmY2Y3E3TGxC?= =?utf-8?B?T0xZQmhXbkIyN0xUcDVKRkJIRlV5K3dqVmQ5Sy9sWStiamxiRDNQYmR1T1JY?= =?utf-8?B?U1lEQ204amVxT2w1NE5mL2QxdTlXTjdOMW43TWpZZzNPeDhhQ2Z4Ukxtd093?= =?utf-8?B?dGRadUJ3Z3NVait2bWJPRkRUK0x6YkNmT1hEeVc2Z3BraFFDMG1kUFRNTEVZ?= =?utf-8?B?b0hjTEhJUVRBd0hsNy9lVFBUdkh3bEt5QTAwVDM3SEp4aXJxSSsvQTVCRmVR?= =?utf-8?B?NCt0SEJNYjZ4NS9ja3VVZTV1cVl5TmM2eFVRRkFYNDZOQzYvcm9Qajg0OFla?= =?utf-8?B?U2VVNTVDcElZZmJRcERDWWhKV1VFWVZuQWNkeU0xNUN3cXJpMHJad282T3No?= =?utf-8?B?NGp2TXNaWVM1YzJwUkplekdlSks4N0paT2M1NjJQVXFJaHErblZ5UzJEMDNR?= =?utf-8?B?M2VzSEpROVdpNGFjUHd5RWt4YU5wSU1mRytDSFdQT1Jsa3pZb2xRWCtaUktX?= =?utf-8?B?allPK3EvMHp5aTl5MTZnNmRRalE4N3RkSnNuL2owUStxV29Senh5MlZ4R04x?= =?utf-8?B?RG90S0VMb0lvSkQvMU55VmRYb3lWN0xpOEIydjUvNGo2OHFuUldsSFdEZVVG?= =?utf-8?B?NlRwNmtnQlBUTXZsVzRmYjUyZzhkTFU3ZEs0d1N3Mmh0aE14WTBKMGYyUzFa?= =?utf-8?B?NWlML0xQblh5YmxZMnlnQ2xQOHlaSHVOSTNSbURBb3VWdzdxcHYzcTJkZGc3?= =?utf-8?B?VFNiVjNocjNVRU12dHpvZ094S1Y3OFpXNzBLQVdnWlFPeWNHTXd0dmQySXNo?= =?utf-8?B?SytvMXA2Vm12Ui9NNXI0alE5am9NUExDTjhzT3BSMzlNWUlvTEVvQjhTM2R0?= =?utf-8?B?anBlY1ZKMTAzdDlLbFlzcWp3dkZhSUpJNzBTWnhVb0JaN0pUWkk3RmhmdjhL?= =?utf-8?B?elZHWC9BRVRvWmdsa1Bic1d4NTgwVUdGaGNmQ0FLR3lxenR4Y0RLTkl1Mndr?= =?utf-8?B?dWRhTHVNUDhJM2xWdno4UU1wMXVNb3ZSaGRUeUltZnFoalNpZzJIS2NDSFZp?= =?utf-8?B?OXd3U1QxcVV5SURZYW8vRXFkaXNQMXRwc3lLdFEvRzYrdThsMWVYUWE1ZkFj?= =?utf-8?B?TjZUS3dsZlF2dk1TWDNnVElVUFMvY3dvSEl0NmhwOUd5UEhYYnZ3RkFXRUho?= =?utf-8?B?Tnd0dTVMYlJBcllUMXpCeFFNWkRiR3A2blE0ZERkVnU5dDlkS1VpZ0t4azNO?= =?utf-8?B?M2Z3bjJaQmw0ekZpNHZSSGlvOTFLZ2c2NHF2cW8vR2p5S2tKZXR2YnBnL3R2?= =?utf-8?B?bVd6cnhkZndnQURRaFlZakJUblhkZ1JiU2k1S2Nxak1JVDN6eXVXd2JxVUxC?= =?utf-8?B?b2ZrK2FWUTBPZUs0VklpMFZZbDNocG1GdjdHZGZUYWJqUFIwbXZiek5kZThK?= =?utf-8?B?Nm9vTEJiUEdIQVZwTXRaQ1JuNkhpYW5Md3pReHZkWVdUVk1jYUVVZ21xb2pp?= =?utf-8?B?Rk5MSlM3aHBsMWhMS08zUjlEK0lYR0txZWVGeDcyRFM3MDhTNFRpNjhaWWZq?= =?utf-8?B?TStSdmJCTXJwa0t1WU1oMGNHa1cxdGFmeHBvSlNxYkxHR0Rreml1bE9mVHVC?= =?utf-8?B?bGRhdDVwQXpBV0x2Rms0RXZhaGRNTlc2cFpVb0ppSEExZVNDSWN6aDMzTWxj?= =?utf-8?B?czJySjlHUHRNSVMwcVBCQkRXcnhuNFFRNGs5RnZXaCs4anJ3TjBXdmlXYXJ6?= =?utf-8?B?ekt3S3BJVzU3RHdBMG5jQmtTYzUrclBKZmpLKzFLSU9GMkVvQUxGWmZsUk1F?= =?utf-8?B?aXMvQjd3c1VES1dIeE5TaENsR0hWMUMzb25oaklFckRVczhnenFmUVlVNURG?= =?utf-8?B?c0NBOVIxQm0zc3JRM3Nod3NrUGJEenNHWmZHc1RYSXNqOFBpY2hBcGtLSFFz?= =?utf-8?B?WkJRcHk3YmFBRStVMVVJNWFwUTNsT1RoYzhvL3ZOTkc5bWd1eGtlSnNnK0J4?= =?utf-8?B?ZUlwL0ZOdHlIMGVsTlZyQXZrcDdZUFBUU0ZYSm1kQldJaUQveHFrRkI2bWZB?= =?utf-8?Q?o5J0r+6GftR6LmEryhI5I5YAihE6aJ4XAxiNphv75A1rs?= X-MS-Exchange-AntiSpam-MessageData-1: URsHWVwB8SCxfY3DT560dGVBEZVmgyFvSks= X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-Network-Message-Id: 96ec357a-944b-4bde-468d-08df286968dc X-MS-Exchange-CrossTenant-AuthSource: AM0PR08MB11804.eurprd08.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 12 Oct 2026 14:02:10.6894 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: LtFntcmR7yXaBPI5KD2JQmn9VTqyCI26JwFI/ZvklGfFnQh4sBU5X4SqkO4T2rX+shAGSuen/tWnlX+IQag6HYDvUz2V2Xpw/fD9Kf6nmRc= X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB9PR08MB6633 X-OZ-Fwd: true Cc: devel@openvz.org Subject: Re: [Devel] [PATCH vz10] fs: let the protection flags of a mount be locked from userspace X-BeenThere: devel@openvz.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: OpenVZ development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: devel-bounces@openvz.org Errors-To: devel-bounces@openvz.org On 10/12/26 12:20, Mirian Shilakadze wrote: > A container can strip ro, nosuid, nodev or noexec from a bind mount the > host gave it with "mount -o remount,rw,bind" and then write host data. > Nothing raises the MNT_LOCK_* bits that forbid this on such a mount, and > userspace cannot set them. > > Add MOUNT_ATTR_VE_LOCK to mount_setattr(). In attr_set it locks those > of the four protections the call leaves set, in attr_clr it drops the > locks. Only a host task with CAP_SYS_ADMIN in the initial user > namespace may use it. I like the idea. Looks generally good. Proabbly mainstreamable. Reviewed-by: Pavel Tikhomirov Should we dump those flags in CRIU? Should we also expose them for that. MNT_LOCKED is not raised, so the container can > still unmount the bind. By the way, it might be a good idea to have a way to raise MNT_LOCKED on the mounts vzctl does for CT, so that CT can't umount it even if it wants to (usecase: protect external mount mountpoint for CRIU to be able to restore it easily (now we fail if external mount was moved in CT). > > Locks can now appear on an attached mount, so can_change_locked_flags() > is re-tested under the mount hash in do_reconfigure_mnt() and > do_remount(). > > Feature: ve: ve generic structures > https://virtuozzo.atlassian.net/browse/VSTOR-141092 > Signed-off-by: Mirian Shilakadze > --- > The libvzctl side, which locks bindmounts at container start, on a live > add and again after restore, goes to vzctl.ovz separately. > > Tested on 211.52.1.22.8 in a VM: > - a container cannot strip ro, nosuid, nodev or noexec from a locked bind > by remount or mount_setattr(), cannot unlock it and cannot lock its own > mounts, a bind it makes of a locked mount inherits the lock > - an unprivileged user, root without CAP_SYS_ADMIN and root in a user > namespace of its own cannot unlock what lock_mnt_tree() locked > - a VE in pseudosuper cannot lock or unlock, the host can do both > - mount_setattr selftest 21/21, mount/ selftests pass > - a remount racing a lock, with a 2 ms sleep added to widen the window: > about 30% of rounds end writable but locked without the re-tests, none > in 26000 rounds with them Let's, maybe, add selftests? > > fs/namespace.c | 113 ++++++++++++++---- > include/uapi/linux/mount.h | 22 ++++ > .../trace/beauty/include/uapi/linux/mount.h | 22 ++++ > 3 files changed, 137 insertions(+), 20 deletions(-) > > diff --git a/fs/namespace.c b/fs/namespace.c > index 75cabf7763ef..07ee860cae6e 100644 > --- a/fs/namespace.c > +++ b/fs/namespace.c > @@ -100,6 +100,7 @@ struct mount_kattr { > unsigned int propagation; > unsigned int lookup_flags; > bool recurse; > + bool ve_lock; > struct user_namespace *mnt_userns; > struct mnt_idmap *mnt_idmap; > }; > @@ -2394,26 +2395,42 @@ int iterate_mounts(int (*f)(struct vfsmount *, void *), void *arg, > return 0; > } > > +#define MNT_LOCK_PROTECTION_MASK (MNT_LOCK_READONLY | MNT_LOCK_NOSUID | \ > + MNT_LOCK_NODEV | MNT_LOCK_NOEXEC) > + > +/* > + * Raise the MNT_LOCK_* twin of every protection @flags carries, so that whoever > + * is given the mount cannot clear them again. Shared by lock_mnt_tree(), where > + * the kernel locks a tree that crosses a user namespace, and by > + * MOUNT_ATTR_VE_LOCK, where the host asks for it. > + * > + * Neither MNT_LOCKED nor MNT_LOCK_ATIME is raised here. lock_mnt_tree() adds > + * both itself, while a mount locked through MOUNT_ATTR_VE_LOCK can still be > + * unmounted and keeps its atime settable. > + */ > +static unsigned int lock_protection_flags(unsigned int flags) > +{ > + if (flags & MNT_READONLY) > + flags |= MNT_LOCK_READONLY; > + if (flags & MNT_NOSUID) > + flags |= MNT_LOCK_NOSUID; > + if (flags & MNT_NODEV) > + flags |= MNT_LOCK_NODEV; > + if (flags & MNT_NOEXEC) > + flags |= MNT_LOCK_NOEXEC; > + > + return flags; > +} > + > static void lock_mnt_tree(struct mount *mnt) > { > struct mount *p; > > for (p = mnt; p; p = next_mnt(p, mnt)) { > - int flags = p->mnt.mnt_flags; > + int flags = lock_protection_flags(p->mnt.mnt_flags); > + > /* Don't allow unprivileged users to change mount flags */ > flags |= MNT_LOCK_ATIME; > - > - if (flags & MNT_READONLY) > - flags |= MNT_LOCK_READONLY; > - > - if (flags & MNT_NODEV) > - flags |= MNT_LOCK_NODEV; > - > - if (flags & MNT_NOSUID) > - flags |= MNT_LOCK_NOSUID; > - > - if (flags & MNT_NOEXEC) > - flags |= MNT_LOCK_NOEXEC; > /* Don't allow unprivileged users to reveal what is under a mount */ > if (list_empty(&p->mnt_expire)) > flags |= MNT_LOCKED; > @@ -3018,8 +3035,10 @@ SYSCALL_DEFINE3(open_tree, int, dfd, const char __user *, filename, unsigned, fl > /* > * Don't allow locked mount flags to be cleared. > * > - * No locks need to be held here while testing the various MNT_LOCK > - * flags because those flags can never be cleared once they are set. > + * MOUNT_ATTR_VE_LOCK can raise and drop the MNT_LOCK_* flags on a mount that > + * is already attached, so a test made without the mount hash held only tells > + * you what was true a moment ago. Test again under the hash before the change > + * that depends on it. > */ > static bool can_change_locked_flags(struct mount *mnt, unsigned int mnt_flags) > { > @@ -3124,9 +3143,12 @@ static int do_reconfigure_mnt(struct path *path, unsigned int mnt_flags) > */ > down_read(&sb->s_umount); > lock_mount_hash(); > - ret = change_mount_ro_state(mnt, mnt_flags); > - if (ret == 0) > - set_mount_attributes(mnt, mnt_flags); > + ret = -EPERM; > + if (can_change_locked_flags(mnt, mnt_flags)) { > + ret = change_mount_ro_state(mnt, mnt_flags); > + if (ret == 0) > + set_mount_attributes(mnt, mnt_flags); > + } > unlock_mount_hash(); > up_read(&sb->s_umount); > > @@ -3382,6 +3404,20 @@ static inline int ve_try_reserve_mount(struct ve_struct *ve) > return ret; > } > > +/* > + * Only the host may lock or unlock the protection flags of a mount, meaning a > + * task in ve0 with CAP_SYS_ADMIN in the initial user namespace. > + * > + * ve0 alone proves nothing. Every host task is there, an unprivileged user in a > + * user namespace of its own included, and could otherwise unlock what > + * lock_mnt_tree() locked against it. A VE in pseudosuper is not enough either, > + * libvzctl runs container binaries inside it while the flag is still raised. > + */ > +static inline bool ve_may_lock_mount(void) Maybe confusing name, I would expect ve_may... allow something for ve root, not prohibit. Also ve_is_super(get_exec_env()) is excess if you already check capable. > +{ > + return ve_is_super(get_exec_env()) && capable(CAP_SYS_ADMIN); > +} > + > static inline void ve_mount_put(struct mount *mnt, struct ve_struct *ve) > { > /* > @@ -3440,6 +3476,7 @@ bool is_sb_ve_accessible(struct ve_struct *ve, struct super_block *sb) > static inline int ve_try_reserve_mount(struct ve_struct *ve) { return 1; } > static inline void ve_mount_put(struct mount *mnt, struct ve_struct *ve) { } > static inline void ve_mount_reown(struct mount *mnt, struct ve_struct *ve) { } > +static inline bool ve_may_lock_mount(void) { return capable(CAP_SYS_ADMIN); } > > #endif /* CONFIG_VE */ > > @@ -3483,7 +3520,15 @@ static int do_remount(struct path *path, int ms_flags, int sb_flags, > err = reconfigure_super(fc); > if (!err) { > lock_mount_hash(); > - set_mount_attributes(mnt, mnt_flags); > + /* > + * A lock may have landed since the first test. > + * The superblock change above stands, the mount > + * flags do not change. > + */ > + if (can_change_locked_flags(mnt, mnt_flags)) > + set_mount_attributes(mnt, mnt_flags); > + else > + err = -EPERM; > unlock_mount_hash(); > } > } > @@ -4543,7 +4588,8 @@ SYSCALL_DEFINE5(mount, char __user *, dev_name, char __user *, dir_name, > MOUNT_ATTR_NOEXEC | MOUNT_ATTR__ATIME | MOUNT_ATTR_NODIRATIME | \ > MOUNT_ATTR_NOSYMFOLLOW) > > -#define MOUNT_SETATTR_VALID_FLAGS (FSMOUNT_VALID_FLAGS | MOUNT_ATTR_IDMAP) > +#define MOUNT_SETATTR_VALID_FLAGS \ > + (FSMOUNT_VALID_FLAGS | MOUNT_ATTR_IDMAP | MOUNT_ATTR_VE_LOCK) > > #define MOUNT_SETATTR_PROPAGATION_FLAGS \ > (MS_UNBINDABLE | MS_PRIVATE | MS_SLAVE | MS_SHARED) > @@ -5052,6 +5098,8 @@ static void mount_setattr_commit(struct mount_kattr *kattr, struct mount *mnt) > > do_idmap_mount(kattr, m); > flags = recalc_flags(kattr, m); > + if (kattr->ve_lock) Maybe name it kattr->lock_flags? for more mainstreamability. > + flags = lock_protection_flags(flags); > WRITE_ONCE(m->mnt.mnt_flags, flags); > > /* If we had to hold writers unblock them. */ > @@ -5230,8 +5278,33 @@ static int build_mount_kattr(const struct mount_attr *attr, size_t usize, > if ((attr->attr_set | attr->attr_clr) & ~MOUNT_SETATTR_VALID_FLAGS) > return -EINVAL; > > + kattr->ve_lock = !!(attr->attr_set & MOUNT_ATTR_VE_LOCK); > + if (kattr->ve_lock || (attr->attr_clr & MOUNT_ATTR_VE_LOCK)) { > + if (kattr->ve_lock && (attr->attr_clr & MOUNT_ATTR_VE_LOCK)) > + return -EINVAL; > + /* > + * Unlocking says nothing about the protections themselves. > + * Relaxing one is a separate call, so it still goes through > + * can_change_locked_flags() against a mount that is by then > + * genuinely unlocked, rather than riding in on this one. > + */ > + if ((attr->attr_clr & MOUNT_ATTR_VE_LOCK) && > + (attr->attr_clr & (MOUNT_ATTR_RDONLY | MOUNT_ATTR_NOSUID | > + MOUNT_ATTR_NODEV | MOUNT_ATTR_NOEXEC))) > + return -EINVAL; > + if (!ve_may_lock_mount()) > + return -EPERM; > + } > + > kattr->attr_set = attr_flags_to_mnt_flags(attr->attr_set); > kattr->attr_clr = attr_flags_to_mnt_flags(attr->attr_clr); > + /* > + * Unlocking is a plain clear, so recalc_flags() is already all it > + * needs. Locking cannot be: which twin to raise depends on what each > + * mount in the tree ends up with, which is only known per mount. > + */ > + if (attr->attr_clr & MOUNT_ATTR_VE_LOCK) > + kattr->attr_clr |= MNT_LOCK_PROTECTION_MASK; > > /* > * Since the MOUNT_ATTR_ values are an enum, not a bitmap, > diff --git a/include/uapi/linux/mount.h b/include/uapi/linux/mount.h > index 225bc366ffcb..6368876b37ad 100644 > --- a/include/uapi/linux/mount.h > +++ b/include/uapi/linux/mount.h > @@ -125,6 +125,28 @@ enum fsconfig_command { > #define MOUNT_ATTR_IDMAP 0x00100000 /* Idmap mount to @userns_fd in struct mount_attr. */ > #define MOUNT_ATTR_NOSYMFOLLOW 0x00200000 /* Do not follow symlinks */ > > +/* > + * Virtuozzo mount attributes use high bits (from 63 downwards) to stay clear of > + * the upstream range, which allocates upwards from bit 0. Keep them last in this > + * list, after the mainline entries above, so a future upstream flag creeping up > + * towards them is easy to spot. > + */ > + > +/* > + * In attr_set, lock MOUNT_ATTR_RDONLY, MOUNT_ATTR_NOSUID, MOUNT_ATTR_NODEV and > + * MOUNT_ATTR_NOEXEC, whichever of them the call leaves set, so that whoever is > + * given the mount cannot clear them again. Those four are the only attributes > + * this flag locks. In attr_clr, drop those locks again, on its own and not > + * alongside the attributes it was guarding. mount_setattr() only, fsmount() > + * takes its attributes as 32 bits and never sees this one. > + * > + * Only the host may do either, so a container cannot unlock what it was given > + * and cannot lock anything against the host. The lock is per mount and is > + * copied only into binds made after it, so set it before the mount is handed > + * over, on the detached tree. > + */ > +#define MOUNT_ATTR_VE_LOCK 0x8000000000000000ULL > + > /* > * mount_setattr() > */ > diff --git a/tools/perf/trace/beauty/include/uapi/linux/mount.h b/tools/perf/trace/beauty/include/uapi/linux/mount.h > index 225bc366ffcb..6368876b37ad 100644 > --- a/tools/perf/trace/beauty/include/uapi/linux/mount.h > +++ b/tools/perf/trace/beauty/include/uapi/linux/mount.h > @@ -125,6 +125,28 @@ enum fsconfig_command { > #define MOUNT_ATTR_IDMAP 0x00100000 /* Idmap mount to @userns_fd in struct mount_attr. */ > #define MOUNT_ATTR_NOSYMFOLLOW 0x00200000 /* Do not follow symlinks */ > > +/* > + * Virtuozzo mount attributes use high bits (from 63 downwards) to stay clear of > + * the upstream range, which allocates upwards from bit 0. Keep them last in this > + * list, after the mainline entries above, so a future upstream flag creeping up > + * towards them is easy to spot. > + */ > + > +/* > + * In attr_set, lock MOUNT_ATTR_RDONLY, MOUNT_ATTR_NOSUID, MOUNT_ATTR_NODEV and > + * MOUNT_ATTR_NOEXEC, whichever of them the call leaves set, so that whoever is > + * given the mount cannot clear them again. Those four are the only attributes > + * this flag locks. In attr_clr, drop those locks again, on its own and not > + * alongside the attributes it was guarding. mount_setattr() only, fsmount() > + * takes its attributes as 32 bits and never sees this one. > + * > + * Only the host may do either, so a container cannot unlock what it was given > + * and cannot lock anything against the host. The lock is per mount and is > + * copied only into binds made after it, so set it before the mount is handed > + * over, on the detached tree. > + */ > +#define MOUNT_ATTR_VE_LOCK 0x8000000000000000ULL > + > /* > * mount_setattr() > */ -- Best regards, Pavel Tikhomirov Senior Software Developer, Virtuozzo. _______________________________________________ Devel mailing list Devel@openvz.org https://lists.openvz.org/mailman/listinfo/devel