Merge branch 'linus' into x86/urgent, to pick up fixes and refresh the branch

Signed-off-by: Ingo Molnar <mingo@kernel.org>

Merge tag 'vfs-6.15-rc1.overlayfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull vfs overlayfs updates from Christian Brauner:
"Currently overlayfs uses the mounter's credentials fo

Merge tag 'vfs-6.15-rc1.overlayfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull vfs overlayfs updates from Christian Brauner:
"Currently overlayfs uses the mounter's credentials for its
override_creds() calls. That provides a consistent permission model.

This patches allows a caller to instruct overlayfs to use its
credentials instead. The caller must be located in the same user
namespace hierarchy as the user namespace the overlayfs instance will
be mounted in. This provides a consistent and simple security model.

With this it is possible to e.g., mount an overlayfs instance where
the mounter must have CAP_SYS_ADMIN but the credentials used for
override_creds() have dropped CAP_SYS_ADMIN. It also allows the usage
of custom fs{g,u}id different from the callers and other tweaks"

* tag 'vfs-6.15-rc1.overlayfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
selftests/ovl: add third selftest for "override_creds"
selftests/ovl: add second selftest for "override_creds"
selftests/filesystems: add utils.{c,h}
selftests/ovl: add first selftest for "override_creds"
ovl: allow to specify override credentials

show more ...

Merge patch series "ovl: add override_creds mount option"

Christian Brauner <brauner@kernel.org> says:

Currently overlayfs uses the mounter's credentials for it's
override_creds() calls. That provi

Merge patch series "ovl: add override_creds mount option"

Christian Brauner <brauner@kernel.org> says:

Currently overlayfs uses the mounter's credentials for it's
override_creds() calls. That provides a consistent permission model.

This patches allows a caller to instruct overlayfs to use its
credentials instead. The caller must be located in the same user
namespace hierarchy as the user namespace the overlayfs instance will be
mounted in. This provides a consistent and simple security model.

With this it is possible to e.g., mount an overlayfs instance where the
mounter must have CAP_SYS_ADMIN but the credentials used for
override_creds() have dropped CAP_SYS_ADMIN. It also allows the usage of
custom fs{g,u}id different from the callers and other tweaks.

* patches from https://lore.kernel.org/r/20250219-work-overlayfs-v3-0-46af55e4ceda@kernel.org:
selftests/ovl: add third selftest for "override_creds"
selftests/ovl: add second selftest for "override_creds"
selftests/filesystems: add utils.{c,h}
selftests/ovl: add first selftest for "override_creds"
ovl: allow to specify override credentials

Link: https://lore.kernel.org/r/20250219-work-overlayfs-v3-0-46af55e4ceda@kernel.org
Signed-off-by: Christian Brauner <brauner@kernel.org>

show more ...

selftests/ovl: add third selftest for "override_creds"

Add a simple test to verify that the new "override_creds" option works.

Link: https://lore.kernel.org/r/20250219-work-overlayfs-v3-4-46af55e4c

selftests/ovl: add third selftest for "override_creds"

Add a simple test to verify that the new "override_creds" option works.

Link: https://lore.kernel.org/r/20250219-work-overlayfs-v3-4-46af55e4ceda@kernel.org
Reviewed-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Christian Brauner <brauner@kernel.org>

show more ...

selftests/filesystems: add utils.{c,h}

Add a new set of helpers that will be used in follow-up patches.

Signed-off-by: Christian Brauner <brauner@kernel.org>