From mboxrd@z Thu Jan 1 00:00:00 1970 From: "J. Bruce Fields" Subject: Re: [RFC] vfs generic subtree support Date: Tue, 16 Feb 2010 14:39:38 -0500 Message-ID: <20100216193938.GC26292@fieldses.org> References: <20100216122029.GC30031@ZenIV.linux.org.uk> <87bpfpcq55.fsf@openvz.org> <20100216133836.GD30031@ZenIV.linux.org.uk> <87mxz9nutb.fsf@openvz.org> <20100216142154.GE30031@ZenIV.linux.org.uk> <87hbphns33.fsf@openvz.org> <20100216151257.GK11239@parisc-linux.org> <87sk91i4bk.fsf@openvz.org> <20100216192540.GA26292@fieldses.org> <20100216193205.GA20297@infradead.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: Dmitry Monakhov , Matthew Wilcox , Al Viro , linux-fsdevel@vger.kernel.org To: Christoph Hellwig Return-path: Received: from fieldses.org ([174.143.236.118]:51332 "EHLO fieldses.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S933228Ab0BPTjH (ORCPT ); Tue, 16 Feb 2010 14:39:07 -0500 Content-Disposition: inline In-Reply-To: <20100216193205.GA20297@infradead.org> Sender: linux-fsdevel-owner@vger.kernel.org List-ID: On Tue, Feb 16, 2010 at 02:32:05PM -0500, Christoph Hellwig wrote: > On Tue, Feb 16, 2010 at 02:25:40PM -0500, J. Bruce Fields wrote: > > It'd allow nfsd to implement export subtrees safely. > > > > (The current problem: there's not an easy way to determine whether an > > inode (looked up from a filehandle) is reachable from a given directory. > > So if you export a directory that isn't the root of a filesystem, you > > have an unfortunate choice: > > > > - turn on the "subtree_check" export option: add information > > sufficient to lookup the parent directory to each filehandle. > > But then filehandles change (and clients get ESTALE) on > > cross-directory rename. > > > > - Accept the possibility that someone could fake up a filehandle > > that grants access to files outside the exported subtree. OK > > if you're exporting the subtree just for convenience, but bad > > if you're exporting /usr/local and think /etc/some-secret is > > safe without /usr/local being on a separate partition. > > > > With subtrees presumably we could stick the subtree-id in the > > filehandle, and the subtree would provide a security boundary that's > > easy to check on filehandle lookup (by comparing the subtree-id in the > > filehandle to the one in the inode you find). And subtrees would be > > simpler to manage than separate partitions.) > > NFS exporting is in fact the reason why the XFS hierachial project > quotas were added, but only for space usage accounting and enforcement > reason. Adding the project ID to the file handles does indeed sound > like a good idea, I'll see if it's easily implementable. > > Note that in the end the best idea would be to simply allow mounting > multiple of these roots inside a single superblock. I lost you there. --b. > David Howell's > infrastructure for sharing a nfs superblock for multiple blocks > allows this, and I even implemented prototypes of this for ext2 and > xfs, and a rather mutilated version of my patches is still in btrfs.