)]}'
{
  "commit": "906f04fb1ebfed7b00ef33faa98499fc4f0e609d",
  "tree": "44b455a2c07aa18e9ead6d54d95f71f0dc64c9d2",
  "parents": [
    "a7064be65fda06712a73f858561e04591af74494",
    "eadfe727dd800fc5fca33e45dbfd392ade5bbbd6"
  ],
  "author": {
    "name": "Christian Brauner",
    "email": "brauner@kernel.org",
    "time": "Wed Oct 14 21:46:27 2026 +0200"
  },
  "committer": {
    "name": "Christian Brauner",
    "email": "brauner@kernel.org",
    "time": "Wed Oct 14 22:08:06 2026 +0200"
  },
  "message": "Merge patch series \"namespace: a mount that copy_tree() leaves out can\u0027t take over a lock\"\n\nChristian Brauner \u003cbrauner@kernel.org\u003e says:\n\nSince commit c62a4766937e (\"move_mount: transfer MNT_LOCKED\") a mount\ncan be moved beneath a locked mount. The lock moves from the old cover\nto the new mount which takes over the job of hiding what\u0027s under it and\nthe old cover can be unmounted. That works as long as the new mount\nstays. But the caller picks the new mount and copy_tree() leaves a\nmount of a mount namespace file out of every copy made without\nCL_COPY_MNT_NS_FILE, together with everything mounted on it, and never\nlooks at MNT_LOCKED. unshare(CLONE_NEWNS) and mount propagation make\nsuch copies.\n\nSo a task that is root in its own user namespace gets rid of a locked\ncover on a file without a race and without touching the filesystem\nbelow it. It makes a child with a mount namespace of its own, binds the\nchild\u0027s /proc/\u003cpid\u003e/ns/mnt beneath the cover with MOVE_MOUNT_BENEATH,\nwhich hands the lock to that bind, and calls unshare(CLONE_NEWNS). The\nnew mount namespace has nothing on the file. That\u0027s the usual way to\nmask a single file, a bind of /dev/null or of an empty file. With a\nbind of an ordinary file the file stays covered.\n\ncopy_tree() already refuses to leave out a locked unbindable mount with\n-EPERM since commit df7342b24018 (\"mount: Don\u0027t allow copying\nMNT_UNBINDABLE|MNT_LOCKED mounts\"). Do the same for a locked mount of a\nmount namespace file. That also covers a tree copied with\nCL_COPY_MNT_NS_FILE and attached into a mount namespace of another user\nnamespace where lock_mnt_tree() locks it. Note that unshare(CLONE_NEWNS)\nand clone(CLONE_NEWNS) fail with EPERM from such a mount namespace from\nthen on. The mount can\u0027t be left out and it can\u0027t be unmounted.\n\nAnd refuse to move a mount of a mount namespace file beneath a locked\nmount in the first place. Otherwise the task ends up with a mount it\ncan\u0027t unmount and an unshare() that fails for good.\n\n* patches from https://patch.msgid.link/20261014-work-namei-locked-mnt_ns_file-v1-0-24035bd5d8e9@kernel.org:\n  selftests/filesystems: test that a mntns file can\u0027t take over a lock\n  namespace: a mount that copy_tree() leaves out can\u0027t take over a lock\n\nLink: https://patch.msgid.link/20261014-work-namei-locked-mnt_ns_file-v1-0-24035bd5d8e9@kernel.org\nSigned-off-by: Christian Brauner (Amutable) \u003cbrauner@kernel.org\u003e\n",
  "tree_diff": []
}