I've confirmed the bug, using fuseext2 to mount a filesystem containing an suid-root executable.
Tyler: file_remove_privs() only gets called on write. overlayfs copies up the file as soon as it is opened read/write, no writing necessary. The suid file gets copied into upperdir, then it can be executed from init_user_ns.
I've confirmed the bug, using fuseext2 to mount a filesystem containing an suid-root executable.
Tyler: file_remove_privs() only gets called on write. overlayfs copies up the file as soon as it is opened read/write, no writing necessary. The suid file gets copied into upperdir, then it can be executed from init_user_ns.