Re: r-o bind in nfsd

[Al Viro <viro@ZenIV.linux.org.uk>]

On Fri, Mar 21, 2008 at 06:08:53PM +0100, Miklos Szeredi wrote:

> > And having the vfsmount available within vfs_...() functions means,
> > that the mnt_want_write() check can be moved inside, which means that
> > callers get simpler and less likely to be buggy.  Those are all
> > advantages IMO, regardless of any security module issues.
> 
> Or we can introduce another set of exported functions (path_mkdir(),
> ...), and leave vfs_...() alone.  And then the only question is if
> LSM's can live with ordering change.

I really don't see the point of new helpers; especially since one doesn't
have to _have_ vfsmount to use the old ones and since we don't have a lot
of users of each of those to start with.

As for the apparmor and friends...  I'm far past the point of trying to
give them feedback, seeing how any such feedback is ignored, if not worse
(the ugliness of some of the suggested kludges is bloody astonishing - e.g.
some guy proposed to stuff a reference to vfsmount into task_struct, etc.)