Re: xattr names for unprivileged stacking?

Christian Schoenebeck
2020-08-29T18:22:30Z

On Samstag, 29. August 2020 20:04:48 CEST Al Viro wrote:
> On Sat, Aug 29, 2020 at 07:51:47PM +0200, Miklos Szeredi wrote:
> > On Sat, Aug 29, 2020 at 6:14 PM Al Viro <viro@zeniv.linux.org.uk> wrote:
> > > On Sat, Aug 29, 2020 at 05:07:17PM +0100, Matthew Wilcox wrote:
> > > > > The fact that ADS inodes would not be in the dentry cache and hence
> > > > > not visible to pathwalks at all then means that all of the issues
> > > > > such as mounting over them, chroot, etc don't exist in the first
> > > > > place...
> > > >
> > > > Wait, you've now switched from "this is dentry cache infrastructure"
> > > > to "it should not be in the dentry cache". So I don't understand what
> > > > you're arguing for.
> > >
> > > Bloody wonderful, that. So now we have struct file instances with no
> > > dentry associated with them? Which would have to be taken into account
> > > all over the place...
> >
> > It could have a temporary dentry allocated for the lifetime of the
> > file and dropped on last dput. I.e. there's a dentry, but no cache.
> > Yeah, yeah, d_path() issues, however that one will have to be special
> > cased anyway.
>
> d_path() is the least of the problems, actually. Directory tree structure
> on those, OTOH, is a serious problem. If you want to have getdents(2) on
> that shite, you want an opened descriptor that looks like a directory. And
> _that_ opens a large can of worms. Because now you have fchdir(2) to cope
> with, lookups going through /proc/self/fd/<n>/..., etc., etc.
>
> Al, fully expecting "we'll special-case our way out of everything - how hard
> could that be?" in response...

Independent of what and how all this is presented to user space, I think all
this will only ever land if it does not deviate too much from the existing
unified VFS model.

The most relevant change that I see is that (probably similar to Miklos) that
a user visible file(/dir) kernel internally links a dedicated directory which
contains the streams, but as far as the kernel is concerned, that's a
directory, streams are files, they are still inodes, and they are still part
of the dentry cache, etc.

Starting to handle ADS streams as some completely separate new thing in the
model will most certainly just end up with much more code and problems than
adding filters here and there for making certain things inaccessible from user
space (e.g. prohibiting chdir() into that special directory, prevent mounting
things onto ADS files, ot whatever other presentation measures might be
desired for security reasons).

And no: stat(mainfile) must still return the block count of the main stream
only, not any aggregated data, otherwise it will break user space. Thinks like
'du' must explicitly be made ADS aware instead.

Best regards,
Christian Schoenebeck