When a process drops CAP_SYS_ADMIN and calls fsconfig(FSCONFIG_SET_FLAG, "override_creds"), overlayfs saves those restricted credentials in ofs->creator_cred. ovl_fill_super() then wrapped the entire mount setup in with_ovl_creds(), switching to those restricted credentials for the duration. Mount setup calls clone_private_mount(), which checks CAP_SYS_ADMIN against current credentials. With restricted credentials active, this check fails with -EPERM and the mount fails even though the calling process is fully privileged. Mount setup is a one-time privileged operation and must run under the caller's credentials. with_ovl_creds() belongs only in post-mount I/O paths. Remove it from ovl_fill_super(). Fixes: 539a0879de47 ("ovl: allow to specify override credentials") Cc: stable@vger.kernel.org Signed-off-by: Disha Goel --- fs/overlayfs/super.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c index bd0a3f9039d2..29f9489b8242 100644 --- a/fs/overlayfs/super.c +++ b/fs/overlayfs/super.c @@ -1557,8 +1557,12 @@ int ovl_fill_super(struct super_block *sb, struct fs_context *fc) goto out_err; } - with_ovl_creds(sb) - err = ovl_fill_super_creds(fc, sb); + /* + * Mount setup must run under the caller's credentials, not + * creator_cred: clone_private_mount() requires CAP_SYS_ADMIN, + * which override_creds may have dropped. + */ + err = ovl_fill_super_creds(fc, sb); out_err: if (err) { -- 2.45.1