bybrooklyn/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-04-18 06:44:00 -04:00
Code Issues Packages Projects Releases Wiki Activity

fs: add immutable rootfs

Browse Source 
Currently pivot_root() doesn't work on the real rootfs because it
cannot be unmounted. Userspace has to do a recursive removal of the
initramfs contents manually before continuing the boot.

Really all we want from the real rootfs is to serve as the parent mount
for anything that is actually useful such as the tmpfs or ramfs for
initramfs unpacking or the rootfs itself. There's no need for the real
rootfs to actually be anything meaningful or useful. Add a immutable
rootfs called "nullfs" that can be selected via the "nullfs_rootfs"
kernel command line option.

The kernel will mount a tmpfs/ramfs on top of it, unpack the initramfs
and fire up userspace which mounts the rootfs and can then just do:

  chdir(rootfs);
  pivot_root(".", ".");
  umount2(".", MNT_DETACH);

and be done with it. (Ofc, userspace can also choose to retain the
initramfs contents by using something like pivot_root(".", "/initramfs")
without unmounting it.)

Technically this also means that the rootfs mount in unprivileged
namespaces doesn't need to become MNT_LOCKED anymore as it's guaranteed
that the immutable rootfs remains permanently empty so there cannot be
anything revealed by unmounting the covering mount.

In the future this will also allow us to create completely empty mount
namespaces without risking to leak anything.

systemd already handles this all correctly as it tries to pivot_root()
first and falls back to MS_MOVE only when that fails.

This goes back to various discussion in previous years and a LPC 2024
presentation about this very topic.

Link: https://patch.msgid.link/20260112-work-immutable-rootfs-v2-3-88dd1c34a204@kernel.org
Signed-off-by: Christian Brauner <brauner@kernel.org>
This commit is contained in:
Christian Brauner
2026-01-12 16:47:10 +01:00
parent 3c1b73fc6a
commit 576ee5dfd4
7 changed files with 159 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

82
fs/namespace.c
View File

@@ -75,6 +75,17 @@ static int __init initramfs_options_setup(char *str)
__setup("initramfs_options=", initramfs_options_setup);
bool nullfs_rootfs = false;
static int __init nullfs_rootfs_setup(char *str)
{
if (*str)
return 0;
nullfs_rootfs = true;
return 1;
}
__setup("nullfs_rootfs", nullfs_rootfs_setup);
static u64 event;
static DEFINE_XARRAY_FLAGS(mnt_id_xa, XA_FLAGS_ALLOC);
static DEFINE_IDA(mnt_group_ida);
@@ -4582,8 +4593,9 @@ int path_pivot_root(struct path *new, struct path *old)
* pointed to by put_old must yield the same directory as new_root. No other
* file system may be mounted on put_old. After all, new_root is a mountpoint.
*
* Also, the current root cannot be on the 'rootfs' (initial ramfs) filesystem.
* See Documentation/filesystems/ramfs-rootfs-initramfs.rst for alternatives
* Also, the current root cannot be on the 'rootfs' (initial ramfs) filesystem
* unless the kernel was booted with "nullfs_rootfs". See
* Documentation/filesystems/ramfs-rootfs-initramfs.rst for alternatives
* in this situation.
*
* Notes:
@@ -5976,24 +5988,72 @@ struct mnt_namespace init_mnt_ns = {
static void __init init_mount_tree(void)
{
struct vfsmount *mnt;
struct mount *m;
struct vfsmount *mnt, *nullfs_mnt;
struct mount *mnt_root;
struct path root;
/*
* When nullfs is used, we create two mounts:
*
* (1) nullfs with mount id 1
* (2) mutable rootfs with mount id 2
*
* with (2) mounted on top of (1).
*/
if (nullfs_rootfs) {
nullfs_mnt = vfs_kern_mount(&nullfs_fs_type, 0, "nullfs", NULL);
if (IS_ERR(nullfs_mnt))
panic("VFS: Failed to create nullfs");
}
mnt = vfs_kern_mount(&rootfs_fs_type, 0, "rootfs", initramfs_options);
if (IS_ERR(mnt))
panic("Can't create rootfs");
m = real_mount(mnt);
init_mnt_ns.root = m;
init_mnt_ns.nr_mounts = 1;
mnt_add_to_ns(&init_mnt_ns, m);
if (nullfs_rootfs) {
VFS_WARN_ON_ONCE(real_mount(nullfs_mnt)->mnt_id != 1);
VFS_WARN_ON_ONCE(real_mount(mnt)->mnt_id != 2);
/* The namespace root is the nullfs mnt. */
mnt_root = real_mount(nullfs_mnt);
init_mnt_ns.root = mnt_root;
/* Mount mutable rootfs on top of nullfs. */
root.mnt = nullfs_mnt;
root.dentry = nullfs_mnt->mnt_root;
LOCK_MOUNT_EXACT(mp, &root);
if (unlikely(IS_ERR(mp.parent)))
panic("VFS: Failed to mount rootfs on nullfs");
scoped_guard(mount_writer)
attach_mnt(real_mount(mnt), mp.parent, mp.mp);
pr_info("VFS: Finished mounting rootfs on nullfs\n");
} else {
VFS_WARN_ON_ONCE(real_mount(mnt)->mnt_id != 1);
/* The namespace root is the mutable rootfs. */
mnt_root = real_mount(mnt);
init_mnt_ns.root = mnt_root;
}
/*
* We've dropped all locks here but that's fine. Not just are we
* the only task that's running, there's no other mount
* namespace in existence and the initial mount namespace is
* completely empty until we add the mounts we just created.
*/
for (struct mount *p = mnt_root; p; p = next_mnt(p, mnt_root)) {
mnt_add_to_ns(&init_mnt_ns, p);
init_mnt_ns.nr_mounts++;
}
init_task.nsproxy->mnt_ns = &init_mnt_ns;
get_mnt_ns(&init_mnt_ns);
root.mnt = mnt;
root.dentry = mnt->mnt_root;
/* The root and pwd always point to the mutable rootfs. */
root.mnt = mnt;
root.dentry = mnt->mnt_root;
set_fs_pwd(current->fs, &root);
set_fs_root(current->fs, &root);