[Devel] [PATCH RHEL7 COMMIT] fs/ve: add new FS_VE_MOUNT flag to allow mount in container init userns

[Vasily Averin]

The commit is pushed to "branch-rh7-3.10.0-1127.18.2.vz7.163.x-ovz" and will appear at https://src.openvz.org/scm/ovz/vzkernel.git
after rh7-3.10.0-1127.18.2.vz7.163.39
------>
commit 4e8e69eb16b143f21e583c370ae860c81a76bd17
Author: Pavel Tikhomirov <ptikhomirov at virtuozzo.com>
Date:   Tue Oct 20 12:20:22 2020 +0300

    fs/ve: add new FS_VE_MOUNT flag to allow mount in container init userns
    
    Use this for overlayfs and remove FS_USERNS_MOUNT for it as we wan't
    overlayfs mounts in container to mimic overlayfs mounts on host, and
    thus they can only be mounted in init userns of container.
    
    https://jira.sw.ru/browse/PSBM-121284
    
    Fixes: 71dd847047f6 ("ve/fs/overlay: allow overlayfs to be used inside a
    Container")
    
    Signed-off-by: Pavel Tikhomirov <ptikhomirov at virtuozzo.com>
    
    Reviewed-by: Konstantin Khorenko <khorenko at virtuozzo.com>
---
 fs/overlayfs/super.c | 4 ++--
 fs/super.c           | 5 ++++-
 include/linux/fs.h   | 1 +
 3 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
index d17276d..46b8207 100644
--- a/fs/overlayfs/super.c
+++ b/fs/overlayfs/super.c
@@ -1588,8 +1588,8 @@ static struct file_system_type ovl_fs_type = {
 	.name		= "overlay",
 	.mount		= ovl_mount,
 	.kill_sb	= kill_anon_super,
-	.fs_flags	= FS_HAS_DOPS_WRAPPER |
-			  FS_VIRTUALIZED | FS_USERNS_MOUNT,
+	.fs_flags	= FS_HAS_DOPS_WRAPPER | FS_VIRTUALIZED |
+			  FS_VE_MOUNT,
 };
 MODULE_ALIAS_FS("overlay");
 
diff --git a/fs/super.c b/fs/super.c
index 1cf377a..cdb061e 100644
--- a/fs/super.c
+++ b/fs/super.c
@@ -510,7 +510,10 @@ struct super_block *sget_userns(struct file_system_type *type,
 
 	if (!(flags & (MS_KERNMOUNT|MS_SUBMOUNT)) &&
 	    !(type->fs_flags & FS_USERNS_MOUNT) &&
-	    !capable(CAP_SYS_ADMIN))
+	    !capable(CAP_SYS_ADMIN) &&
+	    /* FS_VE_MOUNT allows mount in container init userns */
+	    !((type->fs_flags & FS_VE_MOUNT) &&
+	       ve_capable(CAP_SYS_ADMIN)))
 		return ERR_PTR(-EPERM);
 retry:
 	spin_lock(&sb_lock);
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 55a92ce..969a041 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -2312,6 +2312,7 @@ struct file_system_type {
 #define FS_HAS_SUBTYPE		4
 #define FS_USERNS_MOUNT		8	/* Can be mounted by userns root */
 #define FS_VIRTUALIZED		64	/* Can mount this fstype inside ve */
+#define FS_VE_MOUNT		128	/* Can be mounted by ve-init userns root */
 #define FS_HAS_RM_XQUOTA	256	/* KABI: fs has the rm_xquota quota op */
 #define FS_HAS_INVALIDATE_RANGE	512	/* FS has new ->invalidatepage with length arg */
 #define FS_HAS_DIO_IODONE2	1024	/* KABI: fs supports new iodone */