From 333ad304d4794d6384087ea7fc16e58ab642809b Mon Sep 17 00:00:00 2001 From: Amir Goldstein Date: Sat, 17 Oct 2026 18:43:30 +0200 Subject: [PATCH] ovl: fix mount setup failing when override_creds drops CAP_SYS_ADMIN When a process drops CAP_SYS_ADMIN and calls fsconfig(FSCONFIG_SET_FLAG, "override_creds"), overlayfs saves those restricted credentials in ofs->creator_cred. ovl_fill_super() then wraps the entire mount setup in with_ovl_creds(), switching to those restricted credentials for the duration. Mount setup calls clone_private_mount(), which checks CAP_SYS_ADMIN against current credentials. With restricted credentials active, this check fails with -EPERM even though the task issuing FSCONFIG_CMD_CREATE is fully privileged. Use the mounter's real credentials only for cloning the private layer mounts. Keep all other backing filesystem operations during mount setup under the stashed credentials. Reported-by: Disha Goel Closes: https://lore.kernel.org/linux-unionfs/20260924112858.51392-1-disgoel@linux.ibm.com Fixes: c28f922c9dcee ("clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns") Cc: stable@vger.kernel.org Reviewed-by: Christian Brauner (Amutable) Signed-off-by: Amir Goldstein --- fs/overlayfs/super.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c index cc4b0959faf6..b452b8c5f641 100644 --- a/fs/overlayfs/super.c +++ b/fs/overlayfs/super.c @@ -503,6 +503,20 @@ static int ovl_report_in_use(struct ovl_fs *ofs, const char *name) } } +/* + * clone_private_mount() checks CAP_SYS_ADMIN in current->cred. + * ovl_fill_super_creds() runs under the stashed creator cred, which + * override_creds may have dropped. + * The task that issued FSCONFIG_CMD_CREATE is still current->real_cred, so + * use that only for the clone. creator_cred stays in effect for every other + * backing-fs operation. + */ +static struct vfsmount *ovl_clone_private_mount(const struct path *path) +{ + scoped_with_creds(current_real_cred()) + return clone_private_mount(path); +} + static int ovl_get_upper(struct super_block *sb, struct ovl_fs *ofs, struct ovl_layer *upper_layer, const struct path *upperpath) @@ -526,7 +540,7 @@ static int ovl_get_upper(struct super_block *sb, struct ovl_fs *ofs, if (err) goto out; - upper_mnt = clone_private_mount(upperpath); + upper_mnt = ovl_clone_private_mount(upperpath); err = PTR_ERR(upper_mnt); if (IS_ERR(upper_mnt)) { pr_err("failed to clone upperpath\n"); @@ -1104,7 +1118,7 @@ static int ovl_get_layers(struct super_block *sb, struct ovl_fs *ofs, } } - mnt = clone_private_mount(&l->path); + mnt = ovl_clone_private_mount(&l->path); err = PTR_ERR(mnt); if (IS_ERR(mnt)) { pr_err("failed to clone lowerpath\n");