[Devel] [PATCH v7 VZ10] fs: enforce container device-mount policy in the common mount path

[Konstantin Khorenko]

On 7/23/26 15:49, Vasileios Almpanis wrote:
...
> +static int vfs_format_sb_flags(char *buff, size_t size, size_t *off,
> +			       unsigned int sb_flags)
> +{
> +	int err;
> +
> +	err = __vfs_format_flags(common_set_sb_flag, sb_flags, buff, size, off);
> +	if (err)
> +		return err;

The commit message says "fc->sb_flags is vetted alongside the option
string", but common_set_sb_flag only covers dirsync, lazytime, mand,
ro and sync.

static const struct constant_table common_set_sb_flag[] = {
        { "dirsync",    SB_DIRSYNC },
        { "lazytime",   SB_LAZYTIME },
        { "mand",       SB_MANDLOCK },
        { "ro",         SB_RDONLY },
        { "sync",       SB_SYNCHRONOUS },
        { },
};

path_mount() lets three more SB_* bits through to fc->sb_flags:

        sb_flags = flags & (SB_RDONLY |
                            SB_SYNCHRONOUS |
                            SB_MANDLOCK |
                            SB_DIRSYNC |
                            SB_SILENT |
                            SB_POSIXACL |
                            SB_LAZYTIME |
                            SB_I_VERSION);

and MS_I_VERSION is also in MS_RMT_MASK, so it stays changeable on
remount.  A container whose policy does not allow an iversion-style
option can still set SB_I_VERSION (or SB_POSIXACL on filesystems that
do not recompute it in fill_super) through the flag word, bypassing
the option check.

> +
> +	/*
> +	 * "rw" has no flag bit of its own - it is simply the absence of
> +	 * SB_RDONLY. Emit it explicitly so the ve_devmnt policy can allow or
> +	 * deny read-write access as a first-class option; otherwise a mount or
> +	 * remount that leaves the superblock read-write carries no token and
> +	 * slips past the "every option must be allowed" check.
> +	 *
> +	 * @sb_flags is the effective post-operation flag word, so this reflects
> +	 * the state the superblock actually ends up in. A remount that only
> +	 * touches an unrelated flag (e.g. "sync") keeps its current SB_RDONLY
> +	 * and so does not emit "rw".
> +	 */
> +	if (!(sb_flags & SB_RDONLY))
> +		return __vfs_emit_flag("rw", buff, size, off);
> +
> +	return 0;
> +}
> +
>  /**
>   * vfs_parse_fs_param_source - Handle setting "source" via parameter
>   * @fc: The filesystem context to modify
...