ovl: document security.capability idmapping on the xattr forward paths

Now that an overlay mount can itself be idmapped, every id exposed at
the overlay-inode boundary is mapped through the overlay mount idmap.
security.capability is the one id-bearing xattr that overlayfs does not
translate in its own boundary code: the embedded rootid of a v3 fscap
is instead mapped by the capability LSM inside vfs_getxattr() and
vfs_setxattr().

It still composes correctly only because the xattr read and write
forwards go through the security-aware vfs_getxattr() / vfs_setxattr()
rather than the raw __vfs_*xattr() variants: commoncap maps the rootid
through the layer idmap at the overlay-to-real forward, while the
overlay mount idmap is applied by the outer vfs_getxattr() at the
syscall boundary, mirroring the layer-then-mount composition used by
ovl_getattr().

The raw __vfs_*xattr() variants skip the security hooks and would
silently drop the rootid mapping. Comment both forwards - the read in
ovl_xattr_get() and the write in ovl_do_setxattr() - so they are not
converted to them by accident.

No functional change.

Link: https://patch.msgid.link/20260615-work-idmapped-overlayfs-v1-10-7381632aa402@kernel.org
Reviewed-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>

diff --git a/fs/overlayfs/overlayfs.h b/fs/overlayfs/overlayfs.h
index b75df37f70ac3268987e9ac1cf7b591bd3f4aee8..e0d8c6152e9fc55025fc07fbc8e6bdd2eaa6536d 100644 (file)
--- a/fs/overlayfs/overlayfs.h
+++ b/fs/overlayfs/overlayfs.h
@@ -320,6 +320,7 @@ static inline int ovl_do_setxattr(struct ovl_fs *ofs, struct dentry *dentry,
                                  const char *name, const void *value,
                                  size_t size, int flags)
 {
+       /* Use vfs_setxattr(), not __vfs_setxattr(): it idmaps the security.capability rootid. */
        int err = vfs_setxattr(ovl_upper_mnt_idmap(ofs), dentry, name,
                               value, size, flags);
 

diff --git a/fs/overlayfs/xattrs.c b/fs/overlayfs/xattrs.c
index aa95855c70237b3fc399ebf1bd96e94551cee332..811c94d2d9e986981c0cf5ad07f7ac6fc454681a 100644 (file)
--- a/fs/overlayfs/xattrs.c
+++ b/fs/overlayfs/xattrs.c
@@ -84,6 +84,7 @@ static int ovl_xattr_get(struct dentry *dentry, struct inode *inode, const char
        struct path realpath;
 
        ovl_i_path_real(inode, &realpath);
+       /* Use vfs_getxattr(), not __vfs_getxattr(): it idmaps the security.capability rootid. */
        with_ovl_creds(dentry->d_sb)
                return vfs_getxattr(mnt_idmap(realpath.mnt), realpath.dentry, name, value, size);
 }