https://github.com/util-linux/util-linux/commit/473b6a5a3adb4ba4a72ec3d391a4339f55433249 From 473b6a5a3adb4ba4a72ec3d391a4339f55433249 Mon Sep 17 00:00:00 2001 From: Karel Zak Date: Thu, 3 Sep 2026 10:01:29 +0200 Subject: [PATCH] libmount: use USE_LIBMOUNT_MOUNTFD_SUPPORT for idmap hook The idmap hookset was originally guarded by HAVE_MOUNTFD_API (kernel headers have the new mount syscalls) rather than USE_LIBMOUNT_MOUNTFD_SUPPORT (libmount is built with mountfd support). This was intentional (commit 9040c0900, 2022) -- the idea was to keep idmap working even with --disable-libmount-mountfd-support by calling the raw open_tree() syscall directly, while using an inner #ifdef USE_LIBMOUNT_MOUNTFD_SUPPORT to optionally reuse the sysapi fd_tree. This fine-grained approach broke when the CVE-2026-78410 fix replaced the raw open_tree() call with mnt_open_tree(), which is only available under USE_LIBMOUNT_MOUNTFD_SUPPORT. The build fails with --disable-libmount-mountfd-support because mnt_open_tree() is undeclared. Rather than maintaining two code paths for a feature that fundamentally depends on the new mount API, gate the entire idmap hookset on USE_LIBMOUNT_MOUNTFD_SUPPORT -- consistent with how hookset_mount is guarded. Remove the now-redundant inner #ifdef. Also add a note to mount.8 that X-mount.idmap requires the new fd-based mount API. Addresses: https://github.com/util-linux/util-linux/issues/4598 Signed-off-by: Karel Zak (cherry picked from commit e06799ac325a881a297d2ffd6fe568cacdcd00ab) --- libmount/src/hook_idmap.c | 6 ++---- libmount/src/hooks.c | 2 +- libmount/src/version.c | 2 +- sys-utils/mount.8.adoc | 1 + 4 files changed, 5 insertions(+), 6 deletions(-) diff --git a/libmount/src/hook_idmap.c b/libmount/src/hook_idmap.c index 2c697b17154..b1477ac6600 100644 --- a/libmount/src/hook_idmap.c +++ b/libmount/src/hook_idmap.c @@ -32,7 +32,7 @@ # include #endif -#if defined(HAVE_MOUNTFD_API) && defined(HAVE_LINUX_MOUNT_H) +#ifdef USE_LIBMOUNT_MOUNTFD_SUPPORT typedef enum idmap_type_t { ID_TYPE_UID, /* uidmap entry */ @@ -317,7 +317,6 @@ static int hook_mount_post( * Once a mount has been attached to the filesystem it can't be * idmapped anymore. So create a new detached mount. */ -#ifdef USE_LIBMOUNT_MOUNTFD_SUPPORT { struct libmnt_sysapi *api = mnt_context_get_sysapi(cxt); @@ -327,7 +326,6 @@ static int hook_mount_post( DBG(HOOK, ul_debugobj(hs, " reuse tree FD")); } } -#endif if (fd_tree < 0) fd_tree = mnt_open_tree(AT_FDCWD, target, OPEN_TREE_CLONE | OPEN_TREE_CLOEXEC | @@ -544,4 +542,4 @@ const struct libmnt_hookset hookset_idmap = .deinit = hookset_deinit }; -#endif /* HAVE_MOUNTFD_API && HAVE_LINUX_MOUNT_H */ +#endif /* USE_LIBMOUNT_MOUNTFD_SUPPORT */ diff --git a/libmount/src/hooks.c b/libmount/src/hooks.c index 23eca4efdc4..5ae91edd7aa 100644 --- a/libmount/src/hooks.c +++ b/libmount/src/hooks.c @@ -45,7 +45,7 @@ static const struct libmnt_hookset *const hooksets[] = &hookset_mount, #endif &hookset_mount_legacy, -#if defined(HAVE_MOUNTFD_API) && defined(HAVE_LINUX_MOUNT_H) +#ifdef USE_LIBMOUNT_MOUNTFD_SUPPORT &hookset_idmap, #endif &hookset_owner diff --git a/libmount/src/version.c b/libmount/src/version.c index 5ec0d490cde..30cb340abe7 100644 --- a/libmount/src/version.c +++ b/libmount/src/version.c @@ -37,7 +37,7 @@ static const char *lib_features[] = { #ifdef USE_LIBMOUNT_SUPPORT_NAMESPACES "namespaces", #endif -#if defined(HAVE_MOUNTFD_API) && defined(HAVE_LINUX_MOUNT_H) +#ifdef USE_LIBMOUNT_MOUNTFD_SUPPORT "idmapping", #endif #ifdef USE_LIBMOUNT_MOUNTFD_SUPPORT diff --git a/sys-utils/mount.8.adoc b/sys-utils/mount.8.adoc index 8a6e09f1ab8..d71c5e1fc85 100644 --- a/sys-utils/mount.8.adoc +++ b/sys-utils/mount.8.adoc @@ -826,6 +826,7 @@ Set _mountpoint_'s mode after mounting. *X-mount.idmap*=__id-type__:__id-mount__:__id-host__:__id-range__ [__id-type__:__id-mount__:__id-host__:__id-range__], *X-mount.idmap*=__file__:: Use this option to create an idmapped mount. +This feature requires the new file-descriptor-based mount API (available since Linux 5.2). An idmapped mount allows to change ownership of all files located under a mount according to the ID-mapping associated with a user namespace. The ownership change is tied to the lifetime and localized to the relevant mount. The relevant ID-mapping can be specified in two ways: