Merge patch series "fs: allow detached mounts in clone_private_mount()"

Christian Brauner <brauner@kernel.org> says:

In container workloads idmapped mounts are often used as layers for
overlayfs. Recently I added the ability to specify layers in overlayfs
as file descriptors instead of path names. It should be possible to
simply use the detached mounts directly when specifying layers instead
of having to attach them beforehand. They are discarded after overlayfs
is mounted anyway so it's pointless system calls for userspace and
pointless locking for the kernel.

This just recently come up again in [1]. So enable clone_private_mount()
to use detached mounts directly. Following conditions must be met:

- Provided path must be the root of a detached mount tree.
- Provided path may not create mount namespace loops.
- Provided path must be mounted.

It would be possible to be stricter and require that the caller must
have CAP_SYS_ADMIN in the owning user namespace of the anonymous mount
namespace but since this restriction isn't enforced for move_mount()
there's no point in enforcing it for clone_private_mount().

* patches from https://lore.kernel.org/r/20250123-avancieren-erfreuen-3d61f6588fdd@brauner:
  selftests: add tests for using detached mount with overlayfs
  fs: allow detached mounts in clone_private_mount()

Link: https://lore.kernel.org/r/20250123-avancieren-erfreuen-3d61f6588fdd@brauner


Signed-off-by: Christian Brauner <brauner@kernel.org>