From mboxrd@z Thu Jan  1 00:00:00 1970
From: ebiederm@xmission.com (Eric W. Biederman)
Subject: Re: [REVIEW][PATCH 3/3] vfs: Fix a regression in mounting proc
Date: Wed, 27 Nov 2013 11:52:20 -0800
Message-ID: <87iovdmxl7.fsf@xmission.com>
References: <20131118031932.GA17621@mail.hallyn.com>
	<52899D09.5080202@cn.fujitsu.com>
	<20131118140830.GA22075@mail.hallyn.com>
	<20131118180134.GA24156@mail.hallyn.com> <87k3g5gnuv.fsf@xmission.com>
	<20131126181043.GA25492@mail.hallyn.com>
	<87siui1z1g.fsf_-_@xmission.com> <87pppmzoin.fsf_-_@xmission.com>
	<20131127161300.GA24773@redhat.com> <871u21oeyr.fsf@xmission.com>
	<20131127194722.GA32673@redhat.com>
Mime-Version: 1.0
Content-Type: text/plain
Cc: "Serge E. Hallyn" <serge@hallyn.com>,
	Gao feng <gaofeng@cn.fujitsu.com>,
	Containers <containers@lists.linux-foundation.org>,
	linux-fsdevel@vger.kernel.org, Aditya Kali <adityakali@google.com>,
	Andy Lutomirski <luto@amacapital.net>
To: Oleg Nesterov <oleg@redhat.com>
Return-path: <linux-fsdevel-owner@vger.kernel.org>
Received: from out01.mta.xmission.com ([166.70.13.231]:51048 "EHLO
	out01.mta.xmission.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
	with ESMTP id S1754857Ab3K0Twb (ORCPT
	<rfc822;linux-fsdevel@vger.kernel.org>);
	Wed, 27 Nov 2013 14:52:31 -0500
In-Reply-To: <20131127194722.GA32673@redhat.com> (Oleg Nesterov's message of
	"Wed, 27 Nov 2013 20:47:22 +0100")
Sender: linux-fsdevel-owner@vger.kernel.org
List-ID: <linux-fsdevel.vger.kernel.org>

Oleg Nesterov <oleg@redhat.com> writes:

> Just to avoid the possible confusion, let me repeat that the fix itsef
> looks "obviously fine" to me, "i_nlink != 2" looks obviously wrong.
>
> I am not arguing with this patch, I am just trying to understand this
> logic.
>
> On 11/27, Eric W. Biederman wrote:
>>
>> [... snip ...]
>
> Thanks a lot.
>
>> For the real concern about jail environments where proc and sysfs are
>> not mounted at all a fs_visible check is all that is really required,
>
> this is what I can't understand...
>
> Lets ignore the implementation details. Suppose that proc was never
> mounted. Then "mount -t proc" should fail after CLONE_NEWUSER | NEWNS?

Yes.

Eric