Merge patch series "fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid"

Christian Brauner <brauner@kernel.org> says:

vfs_tmpfile() is the only object-creation path in the VFS that never
checked whether the caller's fsuid and fsgid map into the filesystem.

On an idmapped mount whose idmapping does not cover the caller's
fs{u,g}id, the ->tmpfile() instance initializes the new inode through
inode_init_owner(), where mapped_fsuid()/mapped_fsgid() return
INVALID_UID/INVALID_GID.  The tmpfile ends up owned by (uid_t)-1, and
because it is created I_LINKABLE it can subsequently be spliced into the
namespace with linkat(2).

Every other creation path already refuses this: may_o_create() (O_CREAT)
and may_create_dentry() (mkdir, mknod, symlink, link) bail out with
-EOVERFLOW via fsuidgid_has_mapping() precisely so that an object cannot
be created with an owner the filesystem cannot represent.  O_TMPFILE is
no exception and must hold the same guarantee.

Patch 1 adds the missing fsuidgid_has_mapping() check to vfs_tmpfile().
It is a no-op on non-idmapped mounts -- there the caller's fs{u,g}id
always map in the superblock's user namespace -- and only takes effect
on an idmapped mount that does not map the caller.  It applies to every
filesystem that sets FS_ALLOW_IDMAP and implements ->tmpfile() (tmpfs,
ext4, btrfs, xfs, f2fs, ...), and to overlayfs, whose upper-layer
tmpfile creation funnels through vfs_tmpfile() via
backing_tmpfile_open().

Patch 2 adds a selftest that idmaps a detached tmpfs mount and checks
both directions: an unmapped caller is refused with -EOVERFLOW, while a
mapped caller can create an O_TMPFILE, link it into the namespace, and
have its ownership round-trip through the mount idmap.

* patches from https://patch.msgid.link/20260615-work-idmapped-tmpfile-v1-0-754a94d81f83@kernel.org:
  selftests/filesystems: test O_TMPFILE creation on idmapped mounts
  fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid

Link: https://patch.msgid.link/20260615-work-idmapped-tmpfile-v1-0-754a94d81f83@kernel.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>

fs/namei.c

@@ -4736,6 +4736,10 @@ int vfs_tmpfile(struct mnt_idmap *idmap,
 	int error;
 	int open_flag = file->f_flags;
 
+	/* A tmpfile is I_LINKABLE, so guard its owner like may_o_create(). */
+	if (!fsuidgid_has_mapping(dir->i_sb, idmap))
+		return -EOVERFLOW;
+
 	/* we want directory to be writable */
 	error = inode_permission(idmap, dir, MAY_WRITE | MAY_EXEC);
 	if (error)

tools/testing/selftests/filesystems/.gitignore

@@ -5,3 +5,4 @@ fclog
 file_stressor
 anon_inode_test
 kernfs_test
+idmapped_tmpfile

tools/testing/selftests/filesystems/Makefile

@@ -2,6 +2,10 @@
 
 CFLAGS += $(KHDR_INCLUDES)
 TEST_GEN_PROGS := devpts_pts file_stressor anon_inode_test kernfs_test fclog
+TEST_GEN_PROGS += idmapped_tmpfile
 TEST_GEN_PROGS_EXTENDED := dnotify_test
 
 include ../lib.mk
+
+$(OUTPUT)/idmapped_tmpfile: LDLIBS += -lcap
+$(OUTPUT)/idmapped_tmpfile: utils.c

tools/testing/selftests/filesystems/idmapped_tmpfile.c

@@ -0,0 +1,168 @@
+// SPDX-License-Identifier: GPL-2.0
+#define _GNU_SOURCE
+
+#include <errno.h>
+#include <fcntl.h>
+#include <limits.h>
+#include <sched.h>
+#include <stdio.h>
+#include <unistd.h>
+#include <sys/fsuid.h>
+#include <sys/stat.h>
+#include <sys/syscall.h>
+
+#include <linux/mount.h>
+#include <linux/types.h>
+
+#include "kselftest_harness.h"
+#include "wrappers.h"
+#include "utils.h"
+
+/*
+ * The test mount maps caller-visible ids [0, MAP_RANGE) onto the on-disk range
+ * [MAP_HOST, MAP_HOST + MAP_RANGE).  An id outside [0, MAP_RANGE) therefore has
+ * no mapping in the mount and is not representable in the filesystem.
+ */
+#define MAP_HOST  10000
+#define MAP_RANGE 10000
+#define UNMAPPED  50000
+
+#ifndef MOUNT_ATTR_IDMAP
+#define MOUNT_ATTR_IDMAP 0x00100000
+#endif
+
+#ifndef __NR_mount_setattr
+#define __NR_mount_setattr 442
+#endif
+
+static inline int sys_mount_setattr(int dfd, const char *path,
+				    unsigned int flags,
+				    struct mount_attr *attr, size_t size)
+{
+	return syscall(__NR_mount_setattr, dfd, path, flags, attr, size);
+}
+
+/*
+ * Clone @path into a detached mount idmapped so that caller-visible ids
+ * [0, MAP_RANGE) map onto the on-disk ids [MAP_HOST, MAP_HOST + MAP_RANGE).
+ * Returns the mount fd, or -1 if idmapped mounts are not available.
+ */
+static int idmapped_clone(const char *path)
+{
+	struct mount_attr attr = {
+		.attr_set = MOUNT_ATTR_IDMAP,
+	};
+	int fd_tree, userns_fd, ret;
+
+	fd_tree = sys_open_tree(AT_FDCWD, path,
+				OPEN_TREE_CLONE | OPEN_TREE_CLOEXEC);
+	if (fd_tree < 0)
+		return -1;
+
+	userns_fd = get_userns_fd(MAP_HOST, 0, MAP_RANGE);
+	if (userns_fd < 0) {
+		close(fd_tree);
+		return -1;
+	}
+
+	attr.userns_fd = userns_fd;
+	ret = sys_mount_setattr(fd_tree, "", AT_EMPTY_PATH, &attr, sizeof(attr));
+	close(userns_fd);
+	if (ret) {
+		close(fd_tree);
+		return -1;
+	}
+
+	return fd_tree;
+}
+
+FIXTURE(idmapped_tmpfile) {
+	char dir[64];	/* non-idmapped path to the layer directory */
+};
+
+FIXTURE_SETUP(idmapped_tmpfile)
+{
+	/* Private mount namespace so test mounts need no cleanup. */
+	ASSERT_EQ(unshare(CLONE_NEWNS), 0);
+	ASSERT_EQ(sys_mount(NULL, "/", NULL, MS_SLAVE | MS_REC, NULL), 0);
+	ASSERT_EQ(sys_mount("tmpfs", "/tmp", "tmpfs", 0, NULL), 0);
+
+	snprintf(self->dir, sizeof(self->dir), "/tmp/d");
+	ASSERT_EQ(mkdir(self->dir, 0777), 0);
+	/* World-writable so an unmapped caller still passes permission(). */
+	ASSERT_EQ(chmod(self->dir, 0777), 0);
+}
+
+FIXTURE_TEARDOWN(idmapped_tmpfile)
+{
+}
+
+/*
+ * A caller whose fsuid/fsgid have no mapping in the idmapped mount must not be
+ * able to create an O_TMPFILE.  Without the check in vfs_tmpfile() the inode
+ * would be created owned by (uid_t)-1 and could then be linked into the
+ * namespace.
+ */
+TEST_F(idmapped_tmpfile, unmapped_caller_is_refused)
+{
+	int mfd, fd;
+
+	mfd = idmapped_clone(self->dir);
+	if (mfd < 0)
+		SKIP(return, "idmapped mounts not supported");
+
+	/* Become a caller outside the mount's [0, MAP_RANGE) range. */
+	setfsgid(UNMAPPED);
+	setfsuid(UNMAPPED);
+	ASSERT_EQ(setfsuid(-1), UNMAPPED);
+
+	fd = openat(mfd, ".", O_TMPFILE | O_WRONLY, 0644);
+	ASSERT_LT(fd, 0);
+	EXPECT_EQ(errno, EOVERFLOW);
+	if (fd >= 0)
+		close(fd);
+
+	EXPECT_EQ(close(mfd), 0);
+}
+
+/*
+ * A mapped caller can create an O_TMPFILE and link it into the namespace; the
+ * ownership round-trips through the mount idmap.  This is what makes refusing
+ * the unmapped case above necessary in the first place.
+ */
+TEST_F(idmapped_tmpfile, mapped_caller_creates_and_links)
+{
+	char path[PATH_MAX];
+	struct stat st;
+	int mfd, fd;
+
+	mfd = idmapped_clone(self->dir);
+	if (mfd < 0)
+		SKIP(return, "idmapped mounts not supported");
+
+	/* Caller is uid/gid 0, which maps to MAP_HOST through the mount. */
+	fd = openat(mfd, ".", O_TMPFILE | O_RDWR, 0600);
+	ASSERT_GE(fd, 0);
+
+	ASSERT_EQ(fstat(fd, &st), 0);
+	EXPECT_EQ(st.st_uid, 0);
+	EXPECT_EQ(st.st_gid, 0);
+
+	/* The tmpfile is linkable: splice it into the directory. */
+	ASSERT_EQ(linkat(fd, "", mfd, "linked", AT_EMPTY_PATH), 0);
+	EXPECT_EQ(close(fd), 0);
+
+	ASSERT_EQ(fstatat(mfd, "linked", &st, 0), 0);
+	EXPECT_EQ(st.st_uid, 0);
+	EXPECT_EQ(st.st_gid, 0);
+
+	/* On the underlying, non-idmapped tmpfs it is stored as MAP_HOST. */
+	snprintf(path, sizeof(path), "%s/linked", self->dir);
+	ASSERT_EQ(stat(path, &st), 0);
+	EXPECT_EQ(st.st_uid, MAP_HOST);
+	EXPECT_EQ(st.st_gid, MAP_HOST);
+
+	EXPECT_EQ(close(mfd), 0);
+}
+
+TEST_HARNESS_MAIN