linux-kernel - [GIT PULL 08/12 for v7.0] vfs nullfs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20260206-vfs-nullfs-v70-20f5788c0c2f@brauner>
Date: Fri,  6 Feb 2026 17:50:04 +0100
From: Christian Brauner <brauner@...nel.org>
To: Linus Torvalds <torvalds@...ux-foundation.org>
Cc: Christian Brauner <brauner@...nel.org>,
	linux-fsdevel@...r.kernel.org,
	linux-kernel@...r.kernel.org
Subject: [GIT PULL 08/12 for v7.0] vfs nullfs

Hey Linus,

/* Summary */

Add a completely catatonic minimal pseudo filesystem called "nullfs" and
make pivot_root() work in the initramfs.

Currently pivot_root() does not work on the real rootfs because it
cannot be unmounted. Userspace has to recursively delete initramfs
contents manually before continuing boot, using the fragile switch_root
sequence (overmount + chroot).

Add nullfs, a minimal immutable filesystem that serves as the true root
of the mount hierarchy. The mutable rootfs (tmpfs/ramfs) is mounted on
top of it. This allows userspace to simply:

      chdir(new_root);
      pivot_root(".", ".");
      umount2(".", MNT_DETACH);

without the traditional switch_root workarounds. systemd already handles
this correctly. It tries pivot_root() first and falls back to MS_MOVE
only when that fails.

This also means rootfs mounts in unprivileged namespaces no longer need
MNT_LOCKED, since the immutable nullfs guarantees nothing can be
revealed by unmounting the covering mount.

nullfs is a single-instance filesystem (get_tree_single()) marked
SB_NOUSER | SB_I_NOEXEC | SB_I_NODEV with an immutable empty root
directory. This means sooner or later it can be used to overmount other
directories to hide their contents without any additional protection
needed.

We enable it unconditionally. If we see any real regression we'll hide
it behind a boot option.

nullfs has extensions beyond this in the future. It will serve as a
concept to support the creation of completely empty mount namespaces -
which is work coming up in the next cycle.

/* Testing */

gcc (Debian 14.2.0-19) 14.2.0
Debian clang version 19.1.7 (3+b1)

No build failures or warnings were observed.

/* Conflicts */

Merge conflicts with mainline or other vfs branches
====================================================

Conflict with the vfs fserror branch in fs/Makefile. The fserror branch
added fserror.o, while the nullfs branch added nullfs.o. The resolution
includes both.

diff --cc fs/Makefile
index f238cc5ea2e9,becf133e4791..cf4a745e9679
--- a/fs/Makefile
+++ b/fs/Makefile
@@@ -16,7 -16,7 +16,7 @@@ obj-y :=	open.o read_write.o file_table
 		stack.o fs_struct.o statfs.o fs_pin.o nsfs.o \
 		fs_dirent.o fs_context.o fs_parser.o fsopen.o init.o \
 		kernel_read_file.o mnt_idmapping.o remap_range.o pidfs.o \
- 		file_attr.o fserror.o
 -		file_attr.o nullfs.o
++		file_attr.o fserror.o nullfs.o

 obj-$(CONFIG_BUFFER_HEAD)	+= buffer.o mpage.o
 obj-$(CONFIG_PROC_FS)		+= proc_namespace.o

Merge conflicts with other trees
================================

The following changes since commit 8f0b4cce4481fb22653697cced8d0d04027cb1e8:

  Linux 6.19-rc1 (2025-12-14 16:05:07 +1200)

are available in the Git repository at:

  git@...olite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs tags/vfs-7.0-rc1.nullfs

for you to fetch changes up to 313c47f4fe4d07eb2969f429a66ad331fe2b3b6f:

  fs: use nullfs unconditionally as the real rootfs (2026-01-14 11:23:39 +0100)

----------------------------------------------------------------
vfs-7.0-rc1.nullfs

Please consider pulling these changes from the signed vfs-7.0-rc1.nullfs tag.

Thanks!
Christian

----------------------------------------------------------------
Christian Brauner (6):
      fs: ensure that internal tmpfs mount gets mount id zero
      fs: add init_pivot_root()
      fs: add immutable rootfs
      docs: mention nullfs
      Merge patch series "fs: add immutable rootfs"
      fs: use nullfs unconditionally as the real rootfs

 .../filesystems/ramfs-rootfs-initramfs.rst         |  26 ++--
 fs/Makefile                                        |   2 +-
 fs/init.c                                          |  17 +++
 fs/internal.h                                      |   1 +
 fs/mount.h                                         |   1 +
 fs/namespace.c                                     | 159 +++++++++++++--------
 fs/nullfs.c                                        |  70 +++++++++
 include/linux/init_syscalls.h                      |   1 +
 include/uapi/linux/magic.h                         |   1 +
 init/do_mounts.c                                   |  12 +-
 10 files changed, 216 insertions(+), 74 deletions(-)
 create mode 100644 fs/nullfs.c