Changes in Makefile

0fc8f6200d2313278fbf4539bbab74677c685531 - Merge drm/drm-fixes into drm-misc-fixes

Mon, 27 Apr 2026 10:26:49 +0200

Merge drm/drm-fixes into drm-misc-fixesGetting fixes and updates from v7.1-rc1.Signed-off-by: Thomas Zimmermann List of files: /linux/tools/testing/selftests/filesystems/empty_mntns/Makefile

7c8a4671dc3247a26a702e5f5996e9f453d7070d - Merge tag 'vfs-7.1-rc1.mount.v2' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Wed, 15 Apr 2026 04:59:25 +0200

Merge tag 'vfs-7.1-rc1.mount.v2' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfsPull vfs mount updates from Christian Brauner: - Add FSMOUNT_NAMESPACE flag to fsmount() that creates a new mount namespace with the newly created filesystem attached to a copy of the real rootfs. This returns a namespace file descriptor instead of an O_PATH mount fd, similar to how OPEN_TREE_NAMESPACE works for open_tree(). This allows creating a new filesystem and immediately placing it in a new mount namespace in a single operation, which is useful for container runtimes and other namespace-based isolation mechanisms. This accompanies OPEN_TREE_NAMESPACE and avoids a needless detour via OPEN_TREE_NAMESPACE to get the same effect. Will be especially useful when you mount an actual filesystem to be used as the container rootfs. - Currently, creating a new mount namespace always copies the entire mount tree from the caller's namespace. For containers and sandboxes that intend to build their mount table from scratch this is wasteful: they inherit a potentially large mount tree only to immediately tear it down. This series adds support for creating a mount namespace that contains only a clone of the root mount, with none of the child mounts. Two new flags are introduced: - CLONE_EMPTY_MNTNS (0x400000000) for clone3(), using the 64-bit flag space - UNSHARE_EMPTY_MNTNS (0x00100000) for unshare() Both flags imply CLONE_NEWNS. The resulting namespace contains a single nullfs root mount with an immutable empty directory. The intended workflow is to then mount a real filesystem (e.g., tmpfs) over the root and build the mount table from there. - Allow MOVE_MOUNT_BENEATH to target the caller's rootfs, allowing to switch out the rootfs without pivot_root(2). The traditional approach to switching the rootfs involves pivot_root(2) or a chroot_fs_refs()-based mechanism that atomically updates fs->root for all tasks sharing the same fs_struct. This has consequences for fork(), unshare(CLONE_FS), and setns(). This series instead decomposes root-switching into individually atomic, locally-scoped steps: fd_tree = open_tree(-EBADF, "/newroot", OPEN_TREE_CLONE | OPEN_TREE_CLOEXEC); fchdir(fd_tree); move_mount(fd_tree, "", AT_FDCWD, "/", MOVE_MOUNT_BENEATH | MOVE_MOUNT_F_EMPTY_PATH); chroot("."); umount2(".", MNT_DETACH); Since each step only modifies the caller's own state, the fork/unshare/setns races are eliminated by design. A key step to making this possible is to remove the locked mount restriction. Originally MOVE_MOUNT_BENEATH doesn't support mounting beneath a mount that is locked. The locked mount protects the underlying mount from being revealed. This is a core mechanism of unshare(CLONE_NEWUSER | CLONE_NEWNS). The mounts in the new mount namespace become locked. That effectively makes the new mount table useless as the caller cannot ever get rid of any of the mounts no matter how useless they are. We can lift this restriction though. We simply transfer the locked property from the top mount to the mount beneath. This works because what we care about is to protect the underlying mount aka the parent. The mount mounted between the parent and the top mount takes over the job of protecting the parent mount from the top mount mount. This leaves us free to remove the locked property from the top mount which can consequently be unmounted: unshare(CLONE_NEWUSER | CLONE_NEWNS) and we inherit a clone of procfs on /proc then currently we cannot unmount it as: umount -l /proc will fail with EINVAL because the procfs mount is locked. After this series we can now do: mount --beneath -t tmpfs tmpfs /proc umount -l /proc after which a tmpfs mount has been placed beneath the procfs mount. The tmpfs mount has become locked and the procfs mount has become unlocked. This means you can safely modify an inherited mount table after unprivileged namespace creation. Afterwards we simply make it possible to move a mount beneath the rootfs allowing to upgrade the rootfs. Removing the locked restriction makes this very useful for containers created with unshare(CLONE_NEWUSER | CLONE_NEWNS) to reshuffle an inherited mount table safely and MOVE_MOUNT_BENEATH makes it possible to switch out the rootfs instead of using the costly pivot_root(2).* tag 'vfs-7.1-rc1.mount.v2' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: selftests/namespaces: remove unused utils.h include from listns_efault_test selftests/fsmount_ns: add missing TARGETS and fix cap test selftests/empty_mntns: fix wrong CLONE_EMPTY_MNTNS hex value in comment selftests/empty_mntns: fix statmount_alloc() signature mismatch selftests/statmount: remove duplicate wait_for_pid() mount: always duplicate mount selftests/filesystems: add MOVE_MOUNT_BENEATH rootfs tests move_mount: allow MOVE_MOUNT_BENEATH on the rootfs move_mount: transfer MNT_LOCKED selftests/filesystems: add clone3 tests for empty mount namespaces selftests/filesystems: add tests for empty mount namespaces namespace: allow creating empty mount namespaces selftests: add FSMOUNT_NAMESPACE tests selftests/statmount: add statmount_alloc() helper tools: update mount.h header mount: add FSMOUNT_NAMESPACE mount: simplify __do_loopback() mount: start iterating from start of rbtree List of files: /linux/tools/testing/selftests/filesystems/empty_mntns/Makefile

4e9f7592b6f5fe4929b2d755785788acba123db5 - Merge patch series "namespace: allow creating empty mount namespaces"

Wed, 11 Mar 2026 23:01:17 +0100

Merge patch series "namespace: allow creating empty mount namespaces"Christian Brauner says:Currently, creating a new mount namespace always copies the entire mounttree from the caller's namespace. For containers and sandboxes thatintend to build their mount table from scratch this is wasteful: theyinherit a potentially large mount tree only to immediately tear it down.This series adds support for creating a mount namespace that containsonly a clone of the root mount, with none of the child mounts. Two newflags are introduced:- CLONE_EMPTY_MNTNS (0x400000000) for clone3(), using the 64-bit flag space.- UNSHARE_EMPTY_MNTNS (0x00100000) for unshare(), reusing the CLONE_PARENT_SETTID bit which has no meaning for unshare.Both flags imply CLONE_NEWNS. The resulting namespace contains a singlenullfs root mount with an immutable empty directory. The intendedworkflow is to then mount a real filesystem (e.g., tmpfs) over the rootand build the mount table from there.* patches from https://patch.msgid.link/20260306-work-empty-mntns-consolidated-v1-0-6eb30529bbb0@kernel.org: selftests/filesystems: add clone3 tests for empty mount namespaces selftests/filesystems: add tests for empty mount namespaces namespace: allow creating empty mount namespacesLink: https://patch.msgid.link/20260306-work-empty-mntns-consolidated-v1-0-6eb30529bbb0@kernel.orgSigned-off-by: Christian Brauner List of files: /linux/tools/testing/selftests/filesystems/empty_mntns/Makefile

5b8ffd63fbd94fe71f1baf50a55e31be54a97ca9 - selftests/filesystems: add clone3 tests for empty mount namespaces

Fri, 06 Mar 2026 17:28:39 +0100

selftests/filesystems: add clone3 tests for empty mount namespacesAdd a test suite for the CLONE_EMPTY_MNTNS flag exercising the emptymount namespace functionality through the clone3() syscall.The clone3() code path is distinct from the unshare() path alreadytested in empty_mntns_test.c. With clone3(), CLONE_EMPTY_MNTNS(0x400000000ULL) is a 64-bit flag that implies CLONE_NEWNS. Theimplication happens in kernel_clone() before copy_process(), unlikeunshare() where it goes through UNSHARE_EMPTY_MNTNS toCLONE_EMPTY_MNTNS conversion in unshare_nsproxy_namespaces().The tests cover:- basic functionality: clone3 child gets empty mount namespace with exactly one mount, root and cwd point to the same mount- CLONE_NEWNS implication: CLONE_EMPTY_MNTNS works without explicit CLONE_NEWNS, also works with redundant CLONE_NEWNS- flag interactions: combines correctly with CLONE_NEWUSER, CLONE_NEWPID, CLONE_NEWUTS, CLONE_NEWIPC, CLONE_PIDFD- mutual exclusion: CLONE_EMPTY_MNTNS | CLONE_FS returns EINVAL because the implied CLONE_NEWNS conflicts with CLONE_FS- error paths: EPERM without capabilities, unknown 64-bit flags rejected- parent isolation: parent mount namespace is unchanged after clone- many parent mounts: child still gets exactly one mount- mount properties: root mount is nullfs, is its own parent, is the only listmount entry- overmount workflow: child can mount tmpfs over nullfs root to build a writable filesystem from scratch- repeated clone3: each child gets a distinct mount namespace- setns: parent can join child's empty mount namespace via setns()- regression: plain CLONE_NEWNS via clone3 still copies the full mount treeLink: https://patch.msgid.link/20260306-work-empty-mntns-consolidated-v1-3-6eb30529bbb0@kernel.orgSigned-off-by: Christian Brauner List of files: /linux/tools/testing/selftests/filesystems/empty_mntns/Makefile

32f54f2bbccfdeff81d930d18ccf3161a1c203b9 - selftests/filesystems: add tests for empty mount namespaces

Fri, 06 Mar 2026 17:28:38 +0100

selftests/filesystems: add tests for empty mount namespacesAdd a test suite for the UNSHARE_EMPTY_MNTNS and CLONE_EMPTY_MNTNSflags exercising the empty mount namespace functionality through thekselftest harness.The tests cover:- basic functionality: unshare succeeds, exactly one mount exists in the new namespace, root and cwd point to the same mount- flag interactions: UNSHARE_EMPTY_MNTNS works standalone without explicit CLONE_NEWNS, combines correctly with CLONE_NEWUSER and other namespace flags (CLONE_NEWUTS, CLONE_NEWIPC)- edge cases: EPERM without capabilities, works from a user namespace, many source mounts still result in one mount, cwd on a different mount gets reset to root- error paths: invalid flags return EINVAL- regression: plain CLONE_NEWNS still copies the full mount tree, other namespace unshares are unaffected- mount properties: the root mount has the expected statmount properties, is its own parent, and is the only entry returned by listmount- repeated unshare: consecutive UNSHARE_EMPTY_MNTNS calls each produce a new namespace with a distinct mount ID- overmount workflow: verifies the intended usage pattern of creating an empty mount namespace with a nullfs root and then mounting tmpfs over it to build a writable filesystem from scratchLink: https://patch.msgid.link/20260306-work-empty-mntns-consolidated-v1-2-6eb30529bbb0@kernel.orgSigned-off-by: Christian Brauner List of files: /linux/tools/testing/selftests/filesystems/empty_mntns/Makefile