Linux EXT4 FS development
 help / color / mirror / Atom feed
* overlayfs: unprivileged writes can use ext4's reserved blocks with the default resuid
@ 2026-10-19  9:03 Claudio Fernando Pinto
  2026-10-19 21:55 ` Amir Goldstein
  2026-10-20  3:54 ` Theodore Tso
  0 siblings, 2 replies; 5+ messages in thread
From: Claudio Fernando Pinto @ 2026-10-19  9:03 UTC (permalink / raw)
  To: linux-unionfs
  Cc: Miklos Szeredi, Amir Goldstein, linux-ext4, Theodore Ts'o

Hello,

ovl_fill_super() lowers CAP_SYS_RESOURCE in the creator credentials with
the comment "Never override disk quota limits or use reserved space"
(fs/overlayfs/super.c:1511 in v7.3-rc7). On an ext4 upper with the
default reserve owner, the second half does not hold:
ext4_has_free_clusters() grants the reserve when the allocating task's
fsuid equals s_resuid, 0 by default, before it looks at the capability
(fs/ext4/balloc.c:654-657). Writes through overlayfs run with the
mounter's credentials (ovl_write_iter() sets .cred = ovl_creds(sb) and
backing_file_write_iter() applies it), so with a root mounter the fsuid
that reaches ext4 is 0, and an unprivileged writer can spend the blocks
reserved for root.

Reproducer, a 64 MiB ext4 image with the default 5% reserve (1146
blocks), the same user ("nobody") filling it once directly and once
through an overlay mounted by root:

  direct:  reserve=1146 free_after=1146  (reserve kept)
  overlay: reserve=1146 free_after=327   (819 reserved blocks used)

v7.3-rc7 (24a19b953e2a), arm64 under QEMU, writer uid 65534; the same
on 7.0.14 in Docker Desktop's VM (1148 and 331). Script below.

I ran into this in an out-of-tree stacked filesystem I work on, which
copied the overlayfs approach and had the same gap. There I now run
data writes, fallocate, clone and copy_file_range with a copy of the
mounter credentials that carries the writer's fsuid, fsgid and groups
(built the way ovl_create_or_link() builds creation credentials, and
cached per file while the same identity writes), so ext4 decides the
reserve as it would for a direct write. I do not know whether that is
the direction you would want here, given the per-write cost and copy-up
also allocating with the mounter credentials, or whether this case is
already known and accepted as one of the behaviours that cannot be
implemented with full fidelity. Is it worth a patch, or should the
comment just say that resuid/resgid still apply?

Thanks,
Claudio

---8<--- repro.sh (run as root) ---8<---
#!/bin/sh
set -u
cd /tmp
for case in direct overlay; do
    rm -f img; truncate -s 64M img
    mkfs.ext4 -q -F -b 4096 img
    mkdir -p /mnt/low; mount -o loop img /mnt/low
    cd /mnt/low; mkdir -p upper work lower /mnt/ovl; cd /tmp
    chmod 1777 /mnt/low/upper /mnt/low/lower
    target=/mnt/low/upper
    if [ $case = overlay ]; then
        o=lowerdir=/mnt/low/lower,upperdir=/mnt/low/upper
        o=$o,workdir=/mnt/low/work
        mount -t overlay overlay -o $o /mnt/ovl
        target=/mnt/ovl
    fi
    set -- $(stat -f -c '%f %a' /mnt/low); reserve=$(($1 - $2))
    dd="dd if=/dev/zero of=$target/fill bs=64k 2>/dev/null"
    su -s /bin/sh nobody -c "$dd"
    sync
    set -- $(stat -f -c '%f %a' /mnt/low)
    echo "$case: reserve=$reserve free_after=$1"
    [ $case = overlay ] && umount /mnt/ovl
    umount /mnt/low
done

^ permalink raw reply	[flat|nested] 5+ messages in thread
end of thread, other threads:[~2026-10-20 21:28 UTC | newest]

Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-10-19  9:03 overlayfs: unprivileged writes can use ext4's reserved blocks with the default resuid Claudio Fernando Pinto
2026-10-19 21:55 ` Amir Goldstein
2026-10-20  3:54 ` Theodore Tso
2026-10-20  8:39   ` Claudio Fernando Pinto
2026-10-20 21:27   ` Amir Goldstein

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox