Re: [PATCH RFC 0/5] nsfs: iterate through mount namespaces

[Josef Bacik <josef@toxicpanda.com>]

On Fri, Jul 19, 2024 at 01:41:47PM +0200, Christian Brauner wrote:
> Hey,
> 
> Recently, we added the ability to list mounts in other mount namespaces
> and the ability to retrieve namespace file descriptors without having to
> go through procfs by deriving them from pidfds.
> 
> This extends nsfs in two ways:
> 
> (1) Add the ability to retrieve information about a mount namespace via
>     NS_MNT_GET_INFO. This will return the mount namespace id and the
>     number of mounts currently in the mount namespace. The number of
>     mounts can be used to size the buffer that needs to be used for
>     listmount() and is in general useful without having to actually
>     iterate through all the mounts.
> 
>     The structure is extensible.
> 
> (2) Add the ability to iterate through all mount namespaces over which
>     the caller holds privilege returning the file descriptor for the
>     next or previous mount namespace.
> 
>     To retrieve a mount namespace the caller must be privileged wrt to
>     it's owning user namespace. This means that PID 1 on the host can
>     list all mounts in all mount namespaces or that a container can list
>     all mounts of its nested containers.
> 
>     Optionally pass a structure for NS_MNT_GET_INFO with
>     NS_MNT_GET_{PREV,NEXT} to retrieve information about the mount
>     namespace in one go.
> 
> (1) and (2) can be implemented for other namespace types easily.
> 

Love this, I think the only thing is a comment in include/uapi/linux/mount.h to
indicate what spare is used for with the new stuff.  I'll update the man page
when this stuff lands but it would be good to document it somewhere.  Other than
that you can add

Reviewed-by: Josef Bacik <josef@toxicpanda.com>

Thanks,

Josef