[PATCH container] fix #7267: do not inherit host attributes for rootfs

[PATCH container] fix #7267: do not inherit host attributes for rootfs

[Filip Schauer]

With the introduction of 0db559517ac6 (mountpoint_insert_staged: inherit
attributes if directory already exists) mountpoints started preserving
attributes of the underlying directory they were mounted over. This also
unintentionally applied to the rootfs, causing "/" inside the container
to be owned by "nobody".

This commit exempts the rootfs from the attribute preservation, to avoid
inheriting attributes from the host.

Signed-off-by: Filip Schauer <f.schauer@proxmox.com>
---
 src/PVE/LXC.pm            | 18 ++++++++++--------
 src/lxc-pve-prestart-hook |  6 ++++--
 2 files changed, 14 insertions(+), 10 deletions(-)

diff --git a/src/PVE/LXC.pm b/src/PVE/LXC.pm
index bab27b8..2df0e6c 100644
--- a/src/PVE/LXC.pm
+++ b/src/PVE/LXC.pm
@@ -2121,7 +2121,7 @@ sub mountpoint_stage {
 }
 
 sub mountpoint_insert_staged {
-    my ($mount_fd, $rootdir_fd, $mp_dir, $opt, $root_uid, $root_gid) = @_;
+    my ($mount_fd, $rootdir_fd, $mp_dir, $opt, $root_uid, $root_gid, $keep_attrs) = @_;
 
     if (!defined($rootdir_fd)) {
         sysopen($rootdir_fd, '.', O_PATH | O_DIRECTORY)
@@ -2130,12 +2130,14 @@ sub mountpoint_insert_staged {
 
     my $dest_fd = walk_tree_nofollow_fd('/', $rootdir_fd, $mp_dir, 1, $root_uid, $root_gid);
 
-    # Preserve attributes of destination directory
-    my ($mode, $uid, $gid) = (stat($dest_fd))[2, 4, 5];
-    PVE::Tools::fchownat(fileno($mount_fd), '', $uid, $gid, PVE::Tools::AT_EMPTY_PATH)
-        or die "failed to propagate uid and gid to mountpoint: $!\n";
-    PVE::Tools::fchmodat(fileno($mount_fd), '.', $mode, 0)
-        or die "failed to propagate access mode to mountpoint: $!\n";
+    if ($keep_attrs) {
+        # Preserve attributes of destination directory
+        my ($mode, $uid, $gid) = (stat($dest_fd))[2, 4, 5];
+        PVE::Tools::fchownat(fileno($mount_fd), '', $uid, $gid, PVE::Tools::AT_EMPTY_PATH)
+            or die "failed to propagate uid and gid to mountpoint: $!\n";
+        PVE::Tools::fchmodat(fileno($mount_fd), '.', $mode, 0)
+            or die "failed to propagate access mode to mountpoint: $!\n";
+    }
 
     PVE::Tools::move_mount(
         fileno($mount_fd),
@@ -2476,7 +2478,7 @@ sub mountpoint_hotplug : prototype($$$$$) {
         chdir('/')
             or die "failed to change root directory within the container's mount namespace: $!\n";
 
-        mountpoint_insert_staged($mount_fd, undef, $mp->{mp}, $opt, $root_uid, $root_gid);
+        mountpoint_insert_staged($mount_fd, undef, $mp->{mp}, $opt, $root_uid, $root_gid, 1);
     });
 }
 
diff --git a/src/lxc-pve-prestart-hook b/src/lxc-pve-prestart-hook
index 41af242..d264ab9 100755
--- a/src/lxc-pve-prestart-hook
+++ b/src/lxc-pve-prestart-hook
@@ -95,11 +95,12 @@ PVE::LXC::Tools::lxc_hook(
                 $mountpoint, $dir, $storage_cfg, undef, $root_uid, $root_gid,
             );
 
-            my ($dest_dir, $dest_base_fd);
+            my ($dest_dir, $dest_base_fd, $keep_attrs);
             if ($rootdir_fd) {
                 # Mount relative to the rootdir fd.
                 $dest_base_fd = $rootdir_fd;
                 $dest_dir = './' . $mountpoint->{mp};
+                $keep_attrs = 1;
             } else {
                 # Assert that 'rootfs' is the first one:
                 die "foreach_mount() error\n" if $opt ne 'rootfs';
@@ -109,10 +110,11 @@ PVE::LXC::Tools::lxc_hook(
                 sysopen($dest_base_fd, '/', O_PATH | O_DIRECTORY)
                     or die "failed to open '.': $!\n";
                 $dest_dir = $rootdir;
+                $keep_attrs = 0;
             }
 
             PVE::LXC::mountpoint_insert_staged(
-                $mount_fd, $dest_base_fd, $dest_dir, $opt, $root_uid, $root_gid,
+                $mount_fd, $dest_base_fd, $dest_dir, $opt, $root_uid, $root_gid, $keep_attrs,
             );
 
             # From now on we mount inside our rootfs:
-- 
2.47.3

applied: [PATCH container] fix #7267: do not inherit host attributes for rootfs

[Fabian Grünbichler]

On Wed, 28 Jan 2026 17:54:05 +0100, Filip Schauer wrote:
> With the introduction of 0db559517ac6 (mountpoint_insert_staged: inherit
> attributes if directory already exists) mountpoints started preserving
> attributes of the underlying directory they were mounted over. This also
> unintentionally applied to the rootfs, causing "/" inside the container
> to be owned by "nobody".
> 
> This commit exempts the rootfs from the attribute preservation, to avoid
> inheriting attributes from the host.
> 
> [...]

Applied, thanks (and sorry for missing this in the original patch!)!

[1/1] fix #7267: do not inherit host attributes for rootfs
      commit: abebdaa0573092ac1a7cc18ee2cf15ff3c54ff56

Best regards,
-- 
Fabian Grünbichler <f.gruenbichler@proxmox.com>