[PATCH v2] nfsd: do not allow exporting of special kernel filesystems

[PATCH v2] nfsd: do not allow exporting of special kernel filesystems

[Amir Goldstein]

pidfs and nsfs recently gained support for encode/decode of file handles
via name_to_handle_at(2)/opan_by_handle_at(2).

These special kernel filesystems have custom ->open() and ->permission()
export methods, which nfsd does not respect and it was never meant to be
used for exporting those filesystems by nfsd.

Therefore, do not allow nfsd to export filesystems with custom ->open()
or ->permission() methods.

Update comments and Documentation/filesystems/nfs/exporting.rst to
express the fact the those methods are for open_by_handle(2) system only
and not compatible with nfsd.

Fixes: b3caba8f7a34a ("pidfs: implement file handle support")
Fixes: 5222470b2fbb3 ("nsfs: support file handles")
Reviewed-by: NeilBrown <neil@brown.name>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
---

Christian,

Most of the stakeholders approved the approach in v1 [1] and
only comments were regarding lack of documentation for the new
incomapatible methods.

I did my best to add minimal documentation to express the fact
that those methods are not compatible with nfsd and remote filesystem
export in general.

Further documentations regarding the new uses of export_operations
beyond their original use for nfs export is outside the scope of this
patch and frankly, outside the reach of my documentation skills...

Thanks,
Amir.

Changes since v1:
- Use helper exportfs_may_export()
- Minimal documentation for open/permission methods
- Add RVBs

[1] https://lore.kernel.org/linux-fsdevel/20260121085028.558164-1-amir73il@gmail.com/

 Documentation/filesystems/nfs/exporting.rst | 13 ++++++++-
 fs/nfsd/export.c                            |  9 ++++--
 include/linux/exportfs.h                    | 31 +++++++++++++++++----
 3 files changed, 43 insertions(+), 10 deletions(-)

diff --git a/Documentation/filesystems/nfs/exporting.rst b/Documentation/filesystems/nfs/exporting.rst
index de64d2d002a20..da5236cb35012 100644
--- a/Documentation/filesystems/nfs/exporting.rst
+++ b/Documentation/filesystems/nfs/exporting.rst
@@ -100,7 +100,8 @@ Filesystem Issues
 
 For a filesystem to be exportable it must:
 
-   1. provide the filehandle fragment routines described below.
+   1. implement all the mandatory routines described below and
+      none of the export incompatible routines below.
    2. make sure that d_splice_alias is used rather than d_add
       when ->lookup finds an inode for a given parent and name.
 
@@ -151,6 +152,16 @@ struct which has the following members:
     to find potential names, and matches inode numbers to find the correct
     match.
 
+  permission: (incompatible for export to remote filesystem)
+    Allow filesystems to specify a custom permission function for the
+    open_by_handle_at(2) syscall instead of the default CAP_DAC_READ_SEARCH
+    check. This custom permission function is not respected by nfsd.
+
+  open: (incompatible for export to remote filesystem)
+    Allow filesystems to specify a custom open function for the
+    open_by_handle_at(2) syscall instead of the default file_open_root().
+    This custom open function is not respected by nfsd.
+
   flags
     Some filesystems may need to be handled differently than others. The
     export_operations struct also includes a flags field that allows the
diff --git a/fs/nfsd/export.c b/fs/nfsd/export.c
index 2a1499f2ad196..fef23d579b797 100644
--- a/fs/nfsd/export.c
+++ b/fs/nfsd/export.c
@@ -427,7 +427,9 @@ static int check_export(const struct path *path, int *flags, unsigned char *uuid
 	 *       either a device number (so FS_REQUIRES_DEV needed)
 	 *       or an FSID number (so NFSEXP_FSID or ->uuid is needed).
 	 * 2:  We must be able to find an inode from a filehandle.
-	 *       This means that s_export_op must be set.
+	 *       This means that s_export_op must be set and comply with
+	 *       the requirements for remote filesystem export.
+	 *       See Documentation/filesystems/nfs/exporting.rst.
 	 * 3: We must not currently be on an idmapped mount.
 	 */
 	if (!(inode->i_sb->s_type->fs_flags & FS_REQUIRES_DEV) &&
@@ -437,8 +439,9 @@ static int check_export(const struct path *path, int *flags, unsigned char *uuid
 		return -EINVAL;
 	}
 
-	if (!exportfs_can_decode_fh(inode->i_sb->s_export_op)) {
-		dprintk("exp_export: export of invalid fs type.\n");
+	if (!exportfs_may_export(inode->i_sb->s_export_op)) {
+		dprintk("exp_export: export of invalid fs type (%s).\n",
+			inode->i_sb->s_type->name);
 		return -EINVAL;
 	}
 
diff --git a/include/linux/exportfs.h b/include/linux/exportfs.h
index f0cf2714ec52d..8ac0de399dd51 100644
--- a/include/linux/exportfs.h
+++ b/include/linux/exportfs.h
@@ -192,7 +192,9 @@ struct handle_to_path_ctx {
 #define FILEID_VALID_USER_FLAGS	(FILEID_IS_CONNECTABLE | FILEID_IS_DIR)
 
 /**
- * struct export_operations - for nfsd to communicate with file systems
+ * struct export_operations
+ *
+ * Methods for nfsd to communicate with file systems:
  * @encode_fh:      encode a file handle fragment from a dentry
  * @fh_to_dentry:   find the implied object and get a dentry for it
  * @fh_to_parent:   find the implied object's parent and get a dentry for it
@@ -200,6 +202,10 @@ struct handle_to_path_ctx {
  * @get_parent:     find the parent of a given directory
  * @commit_metadata: commit metadata changes to stable storage
  *
+ * Methods for open_by_handle(2) syscall with special kernel file systems:
+ * @permission:     custom permission for opening a file by handle
+ * @open:           custom open routine for opening file by handle
+ *
  * See Documentation/filesystems/nfs/exporting.rst for details on how to use
  * this interface correctly.
  *
@@ -243,14 +249,18 @@ struct handle_to_path_ctx {
  *    is also a directory.  In the event that it cannot be found, or storage
  *    space cannot be allocated, a %ERR_PTR should be returned.
  *
+ * commit_metadata:
+ *    @commit_metadata should commit metadata changes to stable storage.
+ *
  * permission:
- *    Allow filesystems to specify a custom permission function.
+ *    Allow filesystems to specify a custom permission function for the
+ *    open_by_handle_at(2) syscall instead of the default CAP_DAC_READ_SEARCH
+ *    check. This custom permission function is not respected by nfsd.
  *
  * open:
- *    Allow filesystems to specify a custom open function.
- *
- * commit_metadata:
- *    @commit_metadata should commit metadata changes to stable storage.
+ *    Allow filesystems to specify a custom open function for the
+ *    open_by_handle_at(2) syscall instead of the default file_open_root().
+ *    This custom open function is not respected by nfsd.
  *
  * Locking rules:
  *    get_parent is called with child->d_inode->i_rwsem down
@@ -317,6 +327,15 @@ static inline bool exportfs_can_decode_fh(const struct export_operations *nop)
 	return nop && nop->fh_to_dentry;
 }
 
+static inline bool exportfs_may_export(const struct export_operations *nop)
+{
+	/*
+	 * Do not allow nfs export for filesystems with custom ->open() and
+	 * ->permission() ops, which nfsd does not respect (e.g. pidfs, nsfs).
+	 */
+	return exportfs_can_decode_fh(nop) && !nop->open && !nop->permission;
+}
+
 static inline bool exportfs_can_encode_fh(const struct export_operations *nop,
 					  int fh_flags)
 {
-- 
2.52.0

Re: [PATCH v2] nfsd: do not allow exporting of special kernel filesystems

[Christoph Hellwig]

On Thu, Jan 22, 2026 at 03:19:42PM +0100, Amir Goldstein wrote:
> Most of the stakeholders approved the approach in v1 [1] and
> only comments were regarding lack of documentation for the new
> incomapatible methods.
> 
> I did my best to add minimal documentation to express the fact
> that those methods are not compatible with nfsd and remote filesystem
> export in general.
> 
> Further documentations regarding the new uses of export_operations
> beyond their original use for nfs export is outside the scope of this
> patch and frankly, outside the reach of my documentation skills...

As last time I'd be happy to help write documentation, but even
after looking at the methods, their documentations and the commits
adding them I do not understand them.  So getting an explanation
from Christian would be really helpful to move forward here.

Note that you and Jan reviewed those patches, so I'd hope you two
know at least a little about the use case as well.

Btw, the nsfs ->open method seems identical to the default.


>   * permission:
> + *    Allow filesystems to specify a custom permission function for the
> + *    open_by_handle_at(2) syscall instead of the default CAP_DAC_READ_SEARCH
> + *    check. This custom permission function is not respected by nfsd.

may_decode_fh actually does a lot more things if the capable check
fails. (btw, shouldn't that use (ns_)capable_noaudit to not generate
audit messages?).