--- /dev/null
+// SPDX-License-Identifier: GPL-2.0-or-later
+// Copyright (c) 2026 Christian Brauner <brauner@kernel.org>
+
+#define _GNU_SOURCE
+
+#include <errno.h>
+#include <fcntl.h>
+#include <sched.h>
+#include <stdio.h>
+#include <string.h>
+#include <sys/stat.h>
+#include <sys/mount.h>
+#include <unistd.h>
+#include <sys/syscall.h>
+
+#include "../wrappers.h"
+#include "../utils.h"
+#include "../statmount/statmount.h"
+#include "../../kselftest_harness.h"
+
+#include <linux/stat.h>
+
+#ifndef MOVE_MOUNT_BENEATH
+#define MOVE_MOUNT_BENEATH 0x00000200
+#endif
+
+static uint64_t get_unique_mnt_id_fd(int fd)
+{
+ struct statx sx;
+ int ret;
+
+ ret = statx(fd, "", AT_EMPTY_PATH, STATX_MNT_ID_UNIQUE, &sx);
+ if (ret)
+ return 0;
+
+ if (!(sx.stx_mask & STATX_MNT_ID_UNIQUE))
+ return 0;
+
+ return sx.stx_mnt_id;
+}
+
+/*
+ * Create a locked overmount stack at /mnt_dir for testing MNT_LOCKED
+ * transfer on non-rootfs mounts.
+ *
+ * Mounts tmpfs A at /mnt_dir, overmounts with tmpfs B, then enters a
+ * new user+mount namespace where both become locked. Returns the exit
+ * code to use on failure, or 0 on success.
+ */
+static int setup_locked_overmount(void)
+{
+ /* Isolate so mounts don't leak. */
+ if (unshare(CLONE_NEWNS))
+ return 1;
+ if (mount("", "/", NULL, MS_REC | MS_PRIVATE, NULL))
+ return 2;
+
+ /*
+ * Create mounts while still in the initial user namespace so
+ * they become locked after the subsequent user namespace
+ * unshare.
+ */
+ rmdir("/mnt_dir");
+ if (mkdir("/mnt_dir", 0755))
+ return 3;
+
+ /* Mount tmpfs A */
+ if (mount("tmpfs", "/mnt_dir", "tmpfs", 0, NULL))
+ return 4;
+
+ /* Overmount with tmpfs B */
+ if (mount("tmpfs", "/mnt_dir", "tmpfs", 0, NULL))
+ return 5;
+
+ /*
+ * Create user+mount namespace. Mounts A and B become locked
+ * because they might be covering something that is not supposed
+ * to be revealed.
+ */
+ if (setup_userns())
+ return 6;
+
+ /* Sanity check: B must be locked */
+ if (!umount2("/mnt_dir", MNT_DETACH) || errno != EINVAL)
+ return 7;
+
+ return 0;
+}
+
+/*
+ * Create a detached tmpfs mount and return its fd, or -1 on failure.
+ */
+static int create_detached_tmpfs(void)
+{
+ int fs_fd, mnt_fd;
+
+ fs_fd = sys_fsopen("tmpfs", FSOPEN_CLOEXEC);
+ if (fs_fd < 0)
+ return -1;
+
+ if (sys_fsconfig(fs_fd, FSCONFIG_CMD_CREATE, NULL, NULL, 0)) {
+ close(fs_fd);
+ return -1;
+ }
+
+ mnt_fd = sys_fsmount(fs_fd, FSMOUNT_CLOEXEC, 0);
+ close(fs_fd);
+ return mnt_fd;
+}
+
+FIXTURE(move_mount) {
+ uint64_t orig_root_id;
+};
+
+FIXTURE_SETUP(move_mount)
+{
+ ASSERT_EQ(unshare(CLONE_NEWNS), 0);
+
+ ASSERT_EQ(mount("", "/", NULL, MS_REC | MS_PRIVATE, NULL), 0);
+
+ self->orig_root_id = get_unique_mnt_id("/");
+ ASSERT_NE(self->orig_root_id, 0);
+}
+
+FIXTURE_TEARDOWN(move_mount)
+{
+}
+
+/*
+ * Test successful MOVE_MOUNT_BENEATH on the rootfs.
+ * Mount a clone beneath /, fchdir to the clone, chroot to switch root,
+ * then detach the old root.
+ */
+TEST_F(move_mount, beneath_rootfs_success)
+{
+ int fd_tree, ret;
+ uint64_t clone_id, root_id;
+
+ fd_tree = sys_open_tree(AT_FDCWD, "/",
+ OPEN_TREE_CLONE | OPEN_TREE_CLOEXEC);
+ ASSERT_GE(fd_tree, 0);
+
+ clone_id = get_unique_mnt_id_fd(fd_tree);
+ ASSERT_NE(clone_id, 0);
+ ASSERT_NE(clone_id, self->orig_root_id);
+
+ ASSERT_EQ(fchdir(fd_tree), 0);
+
+ ret = sys_move_mount(fd_tree, "", AT_FDCWD, "/",
+ MOVE_MOUNT_F_EMPTY_PATH | MOVE_MOUNT_BENEATH);
+ ASSERT_EQ(ret, 0);
+
+ close(fd_tree);
+
+ /* Switch root to the clone */
+ ASSERT_EQ(chroot("."), 0);
+
+ /* Verify "/" is now the clone */
+ root_id = get_unique_mnt_id("/");
+ ASSERT_NE(root_id, 0);
+ ASSERT_EQ(root_id, clone_id);
+
+ /* Detach old root */
+ ASSERT_EQ(umount2(".", MNT_DETACH), 0);
+}
+
+/*
+ * Test that after MOVE_MOUNT_BENEATH on the rootfs the old root is
+ * stacked on top of the clone. Verify via statmount that the old
+ * root's parent is the clone.
+ */
+TEST_F(move_mount, beneath_rootfs_old_root_stacked)
+{
+ int fd_tree, ret;
+ uint64_t clone_id;
+ struct statmount sm;
+
+ fd_tree = sys_open_tree(AT_FDCWD, "/",
+ OPEN_TREE_CLONE | OPEN_TREE_CLOEXEC);
+ ASSERT_GE(fd_tree, 0);
+
+ clone_id = get_unique_mnt_id_fd(fd_tree);
+ ASSERT_NE(clone_id, 0);
+ ASSERT_NE(clone_id, self->orig_root_id);
+
+ ASSERT_EQ(fchdir(fd_tree), 0);
+
+ ret = sys_move_mount(fd_tree, "", AT_FDCWD, "/",
+ MOVE_MOUNT_F_EMPTY_PATH | MOVE_MOUNT_BENEATH);
+ ASSERT_EQ(ret, 0);
+
+ close(fd_tree);
+
+ ASSERT_EQ(chroot("."), 0);
+
+ /* Old root's parent should now be the clone */
+ ASSERT_EQ(statmount(self->orig_root_id, 0, 0,
+ STATMOUNT_MNT_BASIC, &sm, sizeof(sm), 0), 0);
+ ASSERT_EQ(sm.mnt_parent_id, clone_id);
+
+ ASSERT_EQ(umount2(".", MNT_DETACH), 0);
+}
+
+/*
+ * Test that MOVE_MOUNT_BENEATH on rootfs fails when chroot'd into a
+ * subdirectory of the same mount. The caller's fs->root.dentry doesn't
+ * match mnt->mnt_root so the kernel rejects it.
+ */
+TEST_F(move_mount, beneath_rootfs_in_chroot_fail)
+{
+ int fd_tree, ret;
+ uint64_t chroot_id, clone_id;
+
+ rmdir("/chroot_dir");
+ ASSERT_EQ(mkdir("/chroot_dir", 0755), 0);
+
+ chroot_id = get_unique_mnt_id("/chroot_dir");
+ ASSERT_NE(chroot_id, 0);
+ ASSERT_EQ(self->orig_root_id, chroot_id);
+
+ ASSERT_EQ(chdir("/chroot_dir"), 0);
+ ASSERT_EQ(chroot("."), 0);
+
+ fd_tree = sys_open_tree(AT_FDCWD, "/",
+ OPEN_TREE_CLONE | OPEN_TREE_CLOEXEC);
+ ASSERT_GE(fd_tree, 0);
+
+ clone_id = get_unique_mnt_id_fd(fd_tree);
+ ASSERT_NE(clone_id, 0);
+ ASSERT_NE(clone_id, chroot_id);
+
+ ASSERT_EQ(fchdir(fd_tree), 0);
+
+ /*
+ * Should fail: fs->root.dentry (/chroot_dir) doesn't match
+ * the mount's mnt_root (/).
+ */
+ ret = sys_move_mount(fd_tree, "", AT_FDCWD, "/",
+ MOVE_MOUNT_F_EMPTY_PATH | MOVE_MOUNT_BENEATH);
+ ASSERT_EQ(ret, -1);
+ ASSERT_EQ(errno, EINVAL);
+
+ close(fd_tree);
+}
+
+/*
+ * Test that MOVE_MOUNT_BENEATH on rootfs succeeds when chroot'd into a
+ * separate tmpfs mount. The caller's root dentry matches the mount's
+ * mnt_root since it's a dedicated mount.
+ */
+TEST_F(move_mount, beneath_rootfs_in_chroot_success)
+{
+ int fd_tree, ret;
+ uint64_t chroot_id, clone_id, root_id;
+ struct statmount sm;
+
+ rmdir("/chroot_dir");
+ ASSERT_EQ(mkdir("/chroot_dir", 0755), 0);
+ ASSERT_EQ(mount("tmpfs", "/chroot_dir", "tmpfs", 0, NULL), 0);
+
+ chroot_id = get_unique_mnt_id("/chroot_dir");
+ ASSERT_NE(chroot_id, 0);
+
+ ASSERT_EQ(chdir("/chroot_dir"), 0);
+ ASSERT_EQ(chroot("."), 0);
+
+ ASSERT_EQ(get_unique_mnt_id("/"), chroot_id);
+
+ fd_tree = sys_open_tree(AT_FDCWD, "/",
+ OPEN_TREE_CLONE | OPEN_TREE_CLOEXEC);
+ ASSERT_GE(fd_tree, 0);
+
+ clone_id = get_unique_mnt_id_fd(fd_tree);
+ ASSERT_NE(clone_id, 0);
+ ASSERT_NE(clone_id, chroot_id);
+
+ ASSERT_EQ(fchdir(fd_tree), 0);
+
+ ret = sys_move_mount(fd_tree, "", AT_FDCWD, "/",
+ MOVE_MOUNT_F_EMPTY_PATH | MOVE_MOUNT_BENEATH);
+ ASSERT_EQ(ret, 0);
+
+ close(fd_tree);
+
+ ASSERT_EQ(chroot("."), 0);
+
+ root_id = get_unique_mnt_id("/");
+ ASSERT_NE(root_id, 0);
+ ASSERT_EQ(root_id, clone_id);
+
+ ASSERT_EQ(statmount(chroot_id, 0, 0,
+ STATMOUNT_MNT_BASIC, &sm, sizeof(sm), 0), 0);
+ ASSERT_EQ(sm.mnt_parent_id, clone_id);
+
+ ASSERT_EQ(umount2(".", MNT_DETACH), 0);
+}
+
+/*
+ * Test MNT_LOCKED transfer when mounting beneath rootfs in a user+mount
+ * namespace. After mount-beneath the new root gets MNT_LOCKED and the
+ * old root has MNT_LOCKED cleared so it can be unmounted.
+ */
+TEST_F(move_mount, beneath_rootfs_locked_transfer)
+{
+ int fd_tree, ret;
+ uint64_t clone_id, root_id;
+
+ ASSERT_EQ(setup_userns(), 0);
+
+ ASSERT_EQ(mount("", "/", NULL, MS_REC | MS_PRIVATE, NULL), 0);
+
+ fd_tree = sys_open_tree(AT_FDCWD, "/",
+ OPEN_TREE_CLONE | OPEN_TREE_CLOEXEC |
+ AT_RECURSIVE);
+ ASSERT_GE(fd_tree, 0);
+
+ clone_id = get_unique_mnt_id_fd(fd_tree);
+ ASSERT_NE(clone_id, 0);
+
+ ASSERT_EQ(fchdir(fd_tree), 0);
+
+ ret = sys_move_mount(fd_tree, "", AT_FDCWD, "/",
+ MOVE_MOUNT_F_EMPTY_PATH |
+ MOVE_MOUNT_BENEATH);
+ ASSERT_EQ(ret, 0);
+
+ close(fd_tree);
+
+ ASSERT_EQ(chroot("."), 0);
+
+ root_id = get_unique_mnt_id("/");
+ ASSERT_EQ(root_id, clone_id);
+
+ /*
+ * The old root should be unmountable (MNT_LOCKED was
+ * transferred to the clone). If MNT_LOCKED wasn't
+ * cleared, this would fail with EINVAL.
+ */
+ ASSERT_EQ(umount2(".", MNT_DETACH), 0);
+
+ /* Verify "/" is still the clone after detaching old root */
+ root_id = get_unique_mnt_id("/");
+ ASSERT_EQ(root_id, clone_id);
+}
+
+/*
+ * Test containment invariant: after mount-beneath rootfs in a user+mount
+ * namespace, the new root must be MNT_LOCKED. The lock transfer from the
+ * old root preserves containment -- the process cannot unmount the new root
+ * to escape the namespace.
+ */
+TEST_F(move_mount, beneath_rootfs_locked_containment)
+{
+ int fd_tree, ret;
+ uint64_t clone_id, root_id;
+
+ ASSERT_EQ(setup_userns(), 0);
+
+ ASSERT_EQ(mount("", "/", NULL, MS_REC | MS_PRIVATE, NULL), 0);
+
+ /* Sanity: rootfs must be locked in the new userns */
+ ASSERT_EQ(umount2("/", MNT_DETACH), -1);
+ ASSERT_EQ(errno, EINVAL);
+
+ fd_tree = sys_open_tree(AT_FDCWD, "/",
+ OPEN_TREE_CLONE | OPEN_TREE_CLOEXEC |
+ AT_RECURSIVE);
+ ASSERT_GE(fd_tree, 0);
+
+ clone_id = get_unique_mnt_id_fd(fd_tree);
+ ASSERT_NE(clone_id, 0);
+
+ ASSERT_EQ(fchdir(fd_tree), 0);
+
+ ret = sys_move_mount(fd_tree, "", AT_FDCWD, "/",
+ MOVE_MOUNT_F_EMPTY_PATH |
+ MOVE_MOUNT_BENEATH);
+ ASSERT_EQ(ret, 0);
+
+ close(fd_tree);
+
+ ASSERT_EQ(chroot("."), 0);
+
+ root_id = get_unique_mnt_id("/");
+ ASSERT_EQ(root_id, clone_id);
+
+ /* Detach old root (MNT_LOCKED was cleared from it) */
+ ASSERT_EQ(umount2(".", MNT_DETACH), 0);
+
+ /* Verify "/" is still the clone after detaching old root */
+ root_id = get_unique_mnt_id("/");
+ ASSERT_EQ(root_id, clone_id);
+
+ /*
+ * The new root must be locked (MNT_LOCKED was transferred
+ * from the old root). Attempting to unmount it must fail
+ * with EINVAL, preserving the containment invariant.
+ */
+ ASSERT_EQ(umount2("/", MNT_DETACH), -1);
+ ASSERT_EQ(errno, EINVAL);
+}
+
+/*
+ * Test MNT_LOCKED transfer when mounting beneath a non-rootfs locked mount.
+ * Mounts created before unshare(CLONE_NEWUSER | CLONE_NEWNS) become locked
+ * in the new namespace. Mount-beneath transfers the lock from the displaced
+ * mount to the new mount, so the displaced mount can be unmounted.
+ */
+TEST_F(move_mount, beneath_non_rootfs_locked_transfer)
+{
+ int mnt_fd, ret;
+ uint64_t mnt_new_id, mnt_visible_id;
+
+ ASSERT_EQ(setup_locked_overmount(), 0);
+
+ mnt_fd = create_detached_tmpfs();
+ ASSERT_GE(mnt_fd, 0);
+
+ mnt_new_id = get_unique_mnt_id_fd(mnt_fd);
+ ASSERT_NE(mnt_new_id, 0);
+
+ /* Move mount beneath B (which is locked) */
+ ret = sys_move_mount(mnt_fd, "", AT_FDCWD, "/mnt_dir",
+ MOVE_MOUNT_F_EMPTY_PATH |
+ MOVE_MOUNT_BENEATH);
+ ASSERT_EQ(ret, 0);
+
+ close(mnt_fd);
+
+ /*
+ * B should now be unmountable (MNT_LOCKED was transferred
+ * to the new mount beneath it). If MNT_LOCKED wasn't
+ * cleared from B, this would fail with EINVAL.
+ */
+ ASSERT_EQ(umount2("/mnt_dir", MNT_DETACH), 0);
+
+ /* Verify the new mount is now visible */
+ mnt_visible_id = get_unique_mnt_id("/mnt_dir");
+ ASSERT_EQ(mnt_visible_id, mnt_new_id);
+}
+
+/*
+ * Test MNT_LOCKED containment when mounting beneath a non-rootfs mount
+ * that was locked during unshare(CLONE_NEWUSER | CLONE_NEWNS).
+ * Mounts created before unshare become locked in the new namespace.
+ * Mount-beneath transfers the lock, preserving containment: the new
+ * mount cannot be unmounted, but the displaced mount can.
+ */
+TEST_F(move_mount, beneath_non_rootfs_locked_containment)
+{
+ int mnt_fd, ret;
+ uint64_t mnt_new_id, mnt_visible_id;
+
+ ASSERT_EQ(setup_locked_overmount(), 0);
+
+ mnt_fd = create_detached_tmpfs();
+ ASSERT_GE(mnt_fd, 0);
+
+ mnt_new_id = get_unique_mnt_id_fd(mnt_fd);
+ ASSERT_NE(mnt_new_id, 0);
+
+ /*
+ * Move new tmpfs beneath B at /mnt_dir.
+ * Stack becomes: A -> new -> B
+ * Lock transfers from B to new.
+ */
+ ret = sys_move_mount(mnt_fd, "", AT_FDCWD, "/mnt_dir",
+ MOVE_MOUNT_F_EMPTY_PATH |
+ MOVE_MOUNT_BENEATH);
+ ASSERT_EQ(ret, 0);
+
+ close(mnt_fd);
+
+ /*
+ * B lost MNT_LOCKED -- unmounting it must succeed.
+ * This reveals the new mount at /mnt_dir.
+ */
+ ASSERT_EQ(umount2("/mnt_dir", MNT_DETACH), 0);
+
+ /* Verify the new mount is now visible */
+ mnt_visible_id = get_unique_mnt_id("/mnt_dir");
+ ASSERT_EQ(mnt_visible_id, mnt_new_id);
+
+ /*
+ * The new mount gained MNT_LOCKED -- unmounting it must
+ * fail with EINVAL, preserving the containment invariant.
+ */
+ ASSERT_EQ(umount2("/mnt_dir", MNT_DETACH), -1);
+ ASSERT_EQ(errno, EINVAL);
+}
+
+TEST_HARNESS_MAIN
projects / thirdparty / kernel / linux.git / commitdiff
