Re: [RFC] pivot_root(2) races

[Al Viro <viro@zeniv.linux.org.uk>]

On Sun, Feb 08, 2026 at 09:49:40PM -0800, Linus Torvalds wrote:
> On Sun, 8 Feb 2026 at 16:32, Al Viro <viro@zeniv.linux.org.uk> wrote:
> >
> >         AFAICS, the original rationale had been about the kernel threads
> > that would otherwise keep the old root busy.
> 
> I don't think it was even about just kernel threads, it was about the
> fact that pivot_root was done early, but after other user space things
> could have been started.
> 
> Of course, now it's used much more widely than the original "handle
> initial root switching in user space"
> 
> >         Unfortunately, the way it's been done (all the way since the
> > original posting) is racy.  If pivot_root() is called while another
> > thread is in the middle of fork(), it will not see the fs_struct of
> > the child to be.
> 
> I think that what is much more serious than races is the *non*racy behavior.
> 
> Maybe I'm missing something, but it looks like anybody can just switch
> things around for _other_ namespaces if they have CAP_SYS_ADMIN in
> _their_ namespace. It's just using may_mount()", which i sabout the
> permission to modify the locall namespace.
> 
> I probably am missing something, and just took a very quick look, and
> am missing some check for "only change processes we have permission to
> change".

Not really - look at those check_mnt() in pivot_root(2).
static inline int check_mnt(const struct mount *mnt)
{
        return mnt->mnt_ns == current->nsproxy->mnt_ns;
}

SYSCALL_DEFINE2(pivot_root, const char __user *, new_root,
                const char __user *, put_old)
{
	...
        if (!check_mnt(root_mnt) || !check_mnt(new_mnt))
		return -EINVAL;

IOW, try to do that to another namespace and you'll get -EINVAL,
no matter what permissions you might have in your namespace
(or globally, for that matter).

may_mount() check is "if you don't have CAP_SYS_ADMIN in your namespace,
you are not getting anywhere at all"; check_mount() ones - "... and
it would better be your namespace you are about to change"