<div dir="ltr"><div>Acked-by: Luke Nowakowski-Krijger <<a href="mailto:luke.nowakowskikrijger@canonical.com">luke.nowakowskikrijger@canonical.com</a>> </div> <div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, Mar 2, 2023 at 1:24 PM Alexander Mikhalitsyn <<a href="mailto:aleksandr.mikhalitsyn@canonical.com">aleksandr.mikhalitsyn@canonical.com</a>> wrote: </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">BugLink: <a href="http://bugs.launchpad.net/bugs/2009065" rel="noreferrer" target="_blank">http://bugs.launchpad.net/bugs/2009065</a> SRU Justification: [Impact] Unprivileged LXC containers users with idmapped root (Ubuntu kernels >= 5.19) getting all overlayfs mounts inside mounted as R/O. Impacted Ubuntu versions J/K/L. Jammy is affected only with hwe-5.19. [Fix] 813fa2cd9e259dacd8f9086226287dc167c8c0c5 "UBUNTU: SAUCE: overlayfs: handle idmapped mounts in ovl_do_(set|remove)xattr" [Test Plan] Reproducer: $ cd /idmapped/mount/path $ mkdir {work,upper,lower,ovl} $ mount -t overlay overlay -o lowerdir=lower,upperdir=upper,workdir=work ovl $ touch ovl/test touch: cannot touch 'ovl/test': Read-only file system [Where problems could occur] The regression can be considered as low, because we just making things to work the same way as in upstream. [Other Info] We need to apply this patch to Jammy/hwe-5.19 tree too. The same patch can be applied to kinetic/master, lunar/master, unstable (6.2) tree. Alexander Mikhalitsyn (1): UBUNTU: SAUCE: overlayfs: handle idmapped mounts in ovl_do_(set|remove)xattr fs/overlayfs/overlayfs.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) -- 2.34.1 -- kernel-team mailing list <a href="mailto:kernel-team@lists.ubuntu.com" target="_blank">kernel-team@lists.ubuntu.com</a> <a href="https://lists.ubuntu.com/mailman/listinfo/kernel-team" rel="noreferrer" target="_blank">https://lists.ubuntu.com/mailman/listinfo/kernel-team</a> </blockquote></div></div>