From mboxrd@z Thu Jan  1 00:00:00 1970
From: Oleg Nesterov <oleg@redhat.com>
Subject: Re: [REVIEW][PATCH 3/3] vfs: Fix a regression in mounting proc
Date: Wed, 27 Nov 2013 20:47:22 +0100
Message-ID: <20131127194722.GA32673@redhat.com>
References: <20131118031932.GA17621@mail.hallyn.com> <52899D09.5080202@cn.fujitsu.com> <20131118140830.GA22075@mail.hallyn.com> <20131118180134.GA24156@mail.hallyn.com> <87k3g5gnuv.fsf@xmission.com> <20131126181043.GA25492@mail.hallyn.com> <87siui1z1g.fsf_-_@xmission.com> <87pppmzoin.fsf_-_@xmission.com> <20131127161300.GA24773@redhat.com> <871u21oeyr.fsf@xmission.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Cc: "Serge E. Hallyn" <serge@hallyn.com>,
	Gao feng <gaofeng@cn.fujitsu.com>,
	Containers <containers@lists.linux-foundation.org>,
	linux-fsdevel@vger.kernel.org, Aditya Kali <adityakali@google.com>,
	Andy Lutomirski <luto@amacapital.net>
To: "Eric W. Biederman" <ebiederm@xmission.com>
Return-path: <linux-fsdevel-owner@vger.kernel.org>
Received: from mx1.redhat.com ([209.132.183.28]:5563 "EHLO mx1.redhat.com"
	rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP
	id S1756551Ab3K0TqR (ORCPT <rfc822;linux-fsdevel@vger.kernel.org>);
	Wed, 27 Nov 2013 14:46:17 -0500
Content-Disposition: inline
In-Reply-To: <871u21oeyr.fsf@xmission.com>
Sender: linux-fsdevel-owner@vger.kernel.org
List-ID: <linux-fsdevel.vger.kernel.org>

Just to avoid the possible confusion, let me repeat that the fix itsef
looks "obviously fine" to me, "i_nlink != 2" looks obviously wrong.

I am not arguing with this patch, I am just trying to understand this
logic.

On 11/27, Eric W. Biederman wrote:
>
> [... snip ...]

Thanks a lot.

> For the real concern about jail environments where proc and sysfs are
> not mounted at all a fs_visible check is all that is really required,

this is what I can't understand...

Lets ignore the implementation details. Suppose that proc was never
mounted. Then "mount -t proc" should fail after CLONE_NEWUSER | NEWNS?

Oleg.