[Devel] [PATCH hci-8.1 v3] block: let container root set the block size of and flush its device

[no-reply at sashiko.virtuozzo.com]

> From: Eva Kurchatova <eva.kurchatova at virtuozzo.com>
> 
> BLKBSZSET and BLKFLSBUF check CAP_SYS_ADMIN in the initial user
> namespace, so root in a container cannot set the block size of a block
> device it has been given, nor flush its buffers, and mkfs.xfs on a loop
> device there stops with "cannot set blocksize 512 on block device
> /dev/loopN: Permission denied", or with "Flushing the data device
> failed, err=13" once it gets past the first.
> 
> Check the capability relative to the container, as the other block
> code adapted for containers does, and let container root through only
> where its device cgroup grants write access to the device: a device
> handed to a container read-only may be held by a filesystem outside
> it, and neither its cache nor its block size should be touched from
> inside.
> 
> https://virtuozzo.atlassian.net/browse/VSTOR-137668
> Feature: ve: allow various syscalls in CT root userns
> 
> Signed-off-by: Eva Kurchatova <eva.kurchatova at virtuozzo.com>
> Reviewed-by: Pavel Tikhomirov <ptikhomirov at virtuozzo.com>
> Signed-off-by: Konstantin Khorenko <khorenko at virtuozzo.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.vzint.dev/#/patchset/20261029-vstor-137668-block-let-container-root-set-the-block-size-v3-1-c3fd7db3777c@virtuozzo.com?part=1