From: Christian Brauner <brauner@kernel.org>
Date: Tue, 25 Feb 2025 09:31:34 +0000 (+0100)
Subject: fs: allow creating detached mounts from fsmount() file descriptors
X-Git-Tag: v6.15-rc1~244^2~2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=f8b6cd66e479b67a506303954373494a4bbbda2c;p=thirdparty%2Flinux.git

fs: allow creating detached mounts from fsmount() file descriptors

The previous patch series only enabled the creation of detached mounts
from detached mounts that were created via open_tree(). In such cases we
know that the origin sequence number for the newly created anonymous
mount namespace will be set to the sequence number of the mount
namespace the source mount belonged to.

But fsmount() creates an anonymous mount namespace that does not have an
origin mount namespace as the anonymous mount namespace was derived from
a filesystem context created via fsopen().

Account for this case and allow the creation of detached mounts from
mounts created via fsmount(). Consequently, any such detached mount
created from an fsmount() mount will also have a zero origin sequence
number.

This allows to mount subdirectories without ever having to expose the
filesystem to a a non-anonymous mount namespace:

    fd_context = sys_fsopen("tmpfs", 0);
    sys_fsconfig(fd_context, FSCONFIG_CMD_CREATE, NULL, NULL, 0);
    fd_tmpfs = sys_fsmount(fd_context, 0, 0);
    mkdirat(fd_tmpfs, "subdir", 0755);
    fd_tree = sys_open_tree(fd_tmpfs, "subdir", OPEN_TREE_CLONE);
    sys_move_mount(fd_tree, "", -EBADF, "/mnt", MOVE_MOUNT_F_EMPTY_PATH);

Signed-off-by: Christian Brauner <brauner@kernel.org>
---

diff --git a/fs/namespace.c b/fs/namespace.c
index 7f7ae1b2ce3a0..2200225a455a4 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -1000,8 +1000,13 @@ static inline int check_mnt(struct mount *mnt)
 
 static inline bool check_anonymous_mnt(struct mount *mnt)
 {
-	return is_anon_ns(mnt->mnt_ns) &&
-	       mnt->mnt_ns->seq_origin == current->nsproxy->mnt_ns->seq;
+	u64 seq;
+
+	if (!is_anon_ns(mnt->mnt_ns))
+		return false;
+
+	seq = mnt->mnt_ns->seq_origin;
+	return !seq || (seq == current->nsproxy->mnt_ns->seq);
 }
 
 /*