From: Al Viro <viro@zeniv.linux.org.uk>
To: Andrei Vagin <avagin@gmail.com>
Cc: Christian Brauner <brauner@kernel.org>,
linux-fsdevel <linux-fsdevel@vger.kernel.org>,
LKML <linux-kernel@vger.kernel.org>,
criu@lists.linux.dev
Subject: Re: do_change_type(): refuse to operate on unmounted/not ours mounts
Date: Fri, 25 Jul 2025 00:00:52 +0100 [thread overview]
Message-ID: <20250724230052.GW2580412@ZenIV> (raw)
In-Reply-To: <CANaxB-xXgW1FEj6ydBT2=cudTbP=fX6x8S53zNkWcw1poL=L2A@mail.gmail.com>
On Thu, Jul 24, 2025 at 01:02:48PM -0700, Andrei Vagin wrote:
> Hi Al and Christian,
>
> The commit 12f147ddd6de ("do_change_type(): refuse to operate on
> unmounted/not ours mounts") introduced an ABI backward compatibility
> break. CRIU depends on the previous behavior, and users are now
> reporting criu restore failures following the kernel update. This change
> has been propagated to stable kernels. Is this check strictly required?
Yes.
> Would it be possible to check only if the current process has
> CAP_SYS_ADMIN within the mount user namespace?
Not enough, both in terms of permissions *and* in terms of "thou
shalt not bugger the kernel data structures - nobody's priveleged
enough for that".
What the hell is CRIU trying to do there?
next prev parent reply other threads:[~2025-07-24 23:00 UTC|newest]
Thread overview: 19+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-07-24 20:02 do_change_type(): refuse to operate on unmounted/not ours mounts Andrei Vagin
2025-07-24 23:00 ` Al Viro [this message]
2025-07-24 23:38 ` Andrei Vagin
2025-07-26 17:12 ` Andrei Vagin
2025-07-26 17:53 ` Al Viro
2025-07-26 21:01 ` Andrei Vagin
2025-07-31 2:40 ` Pavel Tikhomirov
2025-07-31 7:53 ` Christian Brauner
2025-07-31 8:11 ` Pavel Tikhomirov
2025-08-13 18:56 ` Al Viro
2025-08-13 19:09 ` Tycho Andersen
2025-08-13 19:41 ` Al Viro
2025-08-14 4:08 ` Pavel Tikhomirov
2025-08-14 4:42 ` Al Viro
2025-08-14 5:51 ` [PATCH][RFC][CFT] use uniform permission checks for all mount propagation changes Al Viro
2025-08-14 5:52 ` kernel test robot
2025-08-14 5:57 ` [RFC][CFT] selftest for permission checks in " Al Viro
2025-08-14 6:37 ` Al Viro
2025-08-14 7:07 ` do_change_type(): refuse to operate on unmounted/not ours mounts Pavel Tikhomirov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20250724230052.GW2580412@ZenIV \
--to=viro@zeniv.linux.org.uk \
--cc=avagin@gmail.com \
--cc=brauner@kernel.org \
--cc=criu@lists.linux.dev \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.