Re: overlayfs: unprivileged writes can use ext4's reserved blocks with the default resuid

["Theodore Tso" <tytso@mit.edu>]

On Mon, Oct 19, 2026 at 06:03:17AM -0500, Claudio Fernando Pinto wrote:
> Hello,
> 
> ovl_fill_super() lowers CAP_SYS_RESOURCE in the creator credentials with
> the comment "Never override disk quota limits or use reserved space"
> (fs/overlayfs/super.c:1511 in v7.3-rc7). On an ext4 upper with the
> default reserve owner, the second half does not hold:
> ext4_has_free_clusters() grants the reserve when the allocating task's
> fsuid equals s_resuid, 0 by default, before it looks at the capability
> (fs/ext4/balloc.c:654-657). Writes through overlayfs run with the
> mounter's credentials (ovl_write_iter() sets .cred = ovl_creds(sb) and
> backing_file_write_iter() applies it), so with a root mounter the fsuid
> that reaches ext4 is 0, and an unprivileged writer can spend the blocks
> reserved for root.

I'm not sure why overlayfs is trying to override disk quota limits.
What's the background behind this?

	/* Never override disk quota limits or use reserved space */
	cap_lower(creator_cred->cap_effective, CAP_SYS_RESOURCE);

More the point, why do we have creator_cred in the first place?  We're
not lowering CAP_FOWNER or CAP_DAC_OVERRIDE and fsuid is 0.  So if
we're allowing some file system operations with the mounter's creds,
why is CAP_SYS_RESOURCE special?  Also note that if fsuid is 0, then
regardless of CAP_SYS_RESOURCE, any writes will be charged against
user 0's quota, and user 0 doesn't have any limits (often it doesn't)
there won't be any disk quota limits anyway.

						- Ted