From: Christian Brauner Date: Mon, 15 Jun 2026 13:19:59 +0000 (+0200) Subject: ovl: document security.capability idmapping on the xattr forward paths X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=7289a359e627ce27f66a1e1b1d956c690cb10f9e;p=thirdparty%2Fkernel%2Flinux.git ovl: document security.capability idmapping on the xattr forward paths Now that an overlay mount can itself be idmapped, every id exposed at the overlay-inode boundary is mapped through the overlay mount idmap. security.capability is the one id-bearing xattr that overlayfs does not translate in its own boundary code: the embedded rootid of a v3 fscap is instead mapped by the capability LSM inside vfs_getxattr() and vfs_setxattr(). It still composes correctly only because the xattr read and write forwards go through the security-aware vfs_getxattr() / vfs_setxattr() rather than the raw __vfs_*xattr() variants: commoncap maps the rootid through the layer idmap at the overlay-to-real forward, while the overlay mount idmap is applied by the outer vfs_getxattr() at the syscall boundary, mirroring the layer-then-mount composition used by ovl_getattr(). The raw __vfs_*xattr() variants skip the security hooks and would silently drop the rootid mapping. Comment both forwards - the read in ovl_xattr_get() and the write in ovl_do_setxattr() - so they are not converted to them by accident. No functional change. Link: https://patch.msgid.link/20260615-work-idmapped-overlayfs-v1-10-7381632aa402@kernel.org Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner (Amutable) --- diff --git a/fs/overlayfs/overlayfs.h b/fs/overlayfs/overlayfs.h index b75df37f70ac..e0d8c6152e9f 100644 --- a/fs/overlayfs/overlayfs.h +++ b/fs/overlayfs/overlayfs.h @@ -320,6 +320,7 @@ static inline int ovl_do_setxattr(struct ovl_fs *ofs, struct dentry *dentry, const char *name, const void *value, size_t size, int flags) { + /* Use vfs_setxattr(), not __vfs_setxattr(): it idmaps the security.capability rootid. */ int err = vfs_setxattr(ovl_upper_mnt_idmap(ofs), dentry, name, value, size, flags); diff --git a/fs/overlayfs/xattrs.c b/fs/overlayfs/xattrs.c index aa95855c7023..811c94d2d9e9 100644 --- a/fs/overlayfs/xattrs.c +++ b/fs/overlayfs/xattrs.c @@ -84,6 +84,7 @@ static int ovl_xattr_get(struct dentry *dentry, struct inode *inode, const char struct path realpath; ovl_i_path_real(inode, &realpath); + /* Use vfs_getxattr(), not __vfs_getxattr(): it idmaps the security.capability rootid. */ with_ovl_creds(dentry->d_sb) return vfs_getxattr(mnt_idmap(realpath.mnt), realpath.dentry, name, value, size); }