mirror of
https://github.com/gentoo-mirror/gentoo.git
synced 2026-11-09 06:37:10 -08:00
Sam James
5e89a8507a
Bug: https://bugs.gentoo.org/976967 Bug: https://bugs.gentoo.org/981937 Closes: https://bugs.gentoo.org/977456 Signed-off-by: Sam James <sam@gentoo.org>
115 lines
4.4 KiB
Diff
115 lines
4.4 KiB
Diff
https://github.com/util-linux/util-linux/commit/473b6a5a3adb4ba4a72ec3d391a4339f55433249
|
|
|
|
From 473b6a5a3adb4ba4a72ec3d391a4339f55433249 Mon Sep 17 00:00:00 2001
|
|
From: Karel Zak <kzak@redhat.com>
|
|
Date: Thu, 3 Sep 2026 10:01:29 +0200
|
|
Subject: [PATCH] libmount: use USE_LIBMOUNT_MOUNTFD_SUPPORT for idmap hook
|
|
|
|
The idmap hookset was originally guarded by HAVE_MOUNTFD_API (kernel
|
|
headers have the new mount syscalls) rather than
|
|
USE_LIBMOUNT_MOUNTFD_SUPPORT (libmount is built with mountfd support).
|
|
|
|
This was intentional (commit 9040c0900, 2022) -- the idea was to keep
|
|
idmap working even with --disable-libmount-mountfd-support by calling
|
|
the raw open_tree() syscall directly, while using an inner #ifdef
|
|
USE_LIBMOUNT_MOUNTFD_SUPPORT to optionally reuse the sysapi fd_tree.
|
|
|
|
This fine-grained approach broke when the CVE-2026-78410 fix replaced
|
|
the raw open_tree() call with mnt_open_tree(), which is only available
|
|
under USE_LIBMOUNT_MOUNTFD_SUPPORT. The build fails with
|
|
--disable-libmount-mountfd-support because mnt_open_tree() is
|
|
undeclared.
|
|
|
|
Rather than maintaining two code paths for a feature that fundamentally
|
|
depends on the new mount API, gate the entire idmap hookset on
|
|
USE_LIBMOUNT_MOUNTFD_SUPPORT -- consistent with how hookset_mount is
|
|
guarded. Remove the now-redundant inner #ifdef.
|
|
|
|
Also add a note to mount.8 that X-mount.idmap requires the new
|
|
fd-based mount API.
|
|
|
|
Addresses: https://github.com/util-linux/util-linux/issues/4598
|
|
Signed-off-by: Karel Zak <kzak@redhat.com>
|
|
(cherry picked from commit e06799ac325a881a297d2ffd6fe568cacdcd00ab)
|
|
---
|
|
libmount/src/hook_idmap.c | 6 ++----
|
|
libmount/src/hooks.c | 2 +-
|
|
libmount/src/version.c | 2 +-
|
|
sys-utils/mount.8.adoc | 1 +
|
|
4 files changed, 5 insertions(+), 6 deletions(-)
|
|
|
|
diff --git a/libmount/src/hook_idmap.c b/libmount/src/hook_idmap.c
|
|
index 2c697b17154..b1477ac6600 100644
|
|
--- a/libmount/src/hook_idmap.c
|
|
+++ b/libmount/src/hook_idmap.c
|
|
@@ -32,7 +32,7 @@
|
|
# include <linux/nsfs.h>
|
|
#endif
|
|
|
|
-#if defined(HAVE_MOUNTFD_API) && defined(HAVE_LINUX_MOUNT_H)
|
|
+#ifdef USE_LIBMOUNT_MOUNTFD_SUPPORT
|
|
|
|
typedef enum idmap_type_t {
|
|
ID_TYPE_UID, /* uidmap entry */
|
|
@@ -317,7 +317,6 @@ static int hook_mount_post(
|
|
* Once a mount has been attached to the filesystem it can't be
|
|
* idmapped anymore. So create a new detached mount.
|
|
*/
|
|
-#ifdef USE_LIBMOUNT_MOUNTFD_SUPPORT
|
|
{
|
|
struct libmnt_sysapi *api = mnt_context_get_sysapi(cxt);
|
|
|
|
@@ -327,7 +326,6 @@ static int hook_mount_post(
|
|
DBG(HOOK, ul_debugobj(hs, " reuse tree FD"));
|
|
}
|
|
}
|
|
-#endif
|
|
if (fd_tree < 0)
|
|
fd_tree = mnt_open_tree(AT_FDCWD, target,
|
|
OPEN_TREE_CLONE | OPEN_TREE_CLOEXEC |
|
|
@@ -544,4 +542,4 @@ const struct libmnt_hookset hookset_idmap =
|
|
.deinit = hookset_deinit
|
|
};
|
|
|
|
-#endif /* HAVE_MOUNTFD_API && HAVE_LINUX_MOUNT_H */
|
|
+#endif /* USE_LIBMOUNT_MOUNTFD_SUPPORT */
|
|
diff --git a/libmount/src/hooks.c b/libmount/src/hooks.c
|
|
index 23eca4efdc4..5ae91edd7aa 100644
|
|
--- a/libmount/src/hooks.c
|
|
+++ b/libmount/src/hooks.c
|
|
@@ -45,7 +45,7 @@ static const struct libmnt_hookset *const hooksets[] =
|
|
&hookset_mount,
|
|
#endif
|
|
&hookset_mount_legacy,
|
|
-#if defined(HAVE_MOUNTFD_API) && defined(HAVE_LINUX_MOUNT_H)
|
|
+#ifdef USE_LIBMOUNT_MOUNTFD_SUPPORT
|
|
&hookset_idmap,
|
|
#endif
|
|
&hookset_owner
|
|
diff --git a/libmount/src/version.c b/libmount/src/version.c
|
|
index 5ec0d490cde..30cb340abe7 100644
|
|
--- a/libmount/src/version.c
|
|
+++ b/libmount/src/version.c
|
|
@@ -37,7 +37,7 @@ static const char *lib_features[] = {
|
|
#ifdef USE_LIBMOUNT_SUPPORT_NAMESPACES
|
|
"namespaces",
|
|
#endif
|
|
-#if defined(HAVE_MOUNTFD_API) && defined(HAVE_LINUX_MOUNT_H)
|
|
+#ifdef USE_LIBMOUNT_MOUNTFD_SUPPORT
|
|
"idmapping",
|
|
#endif
|
|
#ifdef USE_LIBMOUNT_MOUNTFD_SUPPORT
|
|
diff --git a/sys-utils/mount.8.adoc b/sys-utils/mount.8.adoc
|
|
index 8a6e09f1ab8..d71c5e1fc85 100644
|
|
--- a/sys-utils/mount.8.adoc
|
|
+++ b/sys-utils/mount.8.adoc
|
|
@@ -826,6 +826,7 @@ Set _mountpoint_'s mode after mounting.
|
|
|
|
*X-mount.idmap*=__id-type__:__id-mount__:__id-host__:__id-range__ [__id-type__:__id-mount__:__id-host__:__id-range__], *X-mount.idmap*=__file__::
|
|
Use this option to create an idmapped mount.
|
|
+This feature requires the new file-descriptor-based mount API (available since Linux 5.2).
|
|
An idmapped mount allows to change ownership of all files located under a mount according to the ID-mapping associated with a user namespace.
|
|
The ownership change is tied to the lifetime and localized to the relevant mount.
|
|
The relevant ID-mapping can be specified in two ways:
|
|
|