From: Christian Brauner Date: Tue, 4 Feb 2025 14:24:12 +0000 (+0100) Subject: Merge patch series "fs: allow detached mounts in clone_private_mount()" X-Git-Tag: v6.15-rc1~252^2~6 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=312994674eb1748c3c7b07b82935250a980262b7;p=thirdparty%2Fkernel%2Flinux.git Merge patch series "fs: allow detached mounts in clone_private_mount()" Christian Brauner says: In container workloads idmapped mounts are often used as layers for overlayfs. Recently I added the ability to specify layers in overlayfs as file descriptors instead of path names. It should be possible to simply use the detached mounts directly when specifying layers instead of having to attach them beforehand. They are discarded after overlayfs is mounted anyway so it's pointless system calls for userspace and pointless locking for the kernel. This just recently come up again in [1]. So enable clone_private_mount() to use detached mounts directly. Following conditions must be met: - Provided path must be the root of a detached mount tree. - Provided path may not create mount namespace loops. - Provided path must be mounted. It would be possible to be stricter and require that the caller must have CAP_SYS_ADMIN in the owning user namespace of the anonymous mount namespace but since this restriction isn't enforced for move_mount() there's no point in enforcing it for clone_private_mount(). * patches from https://lore.kernel.org/r/20250123-avancieren-erfreuen-3d61f6588fdd@brauner: selftests: add tests for using detached mount with overlayfs fs: allow detached mounts in clone_private_mount() Link: https://lore.kernel.org/r/20250123-avancieren-erfreuen-3d61f6588fdd@brauner Signed-off-by: Christian Brauner --- 312994674eb1748c3c7b07b82935250a980262b7