Re: [PATCH][RFC] nfsd/lockd: have locks_in_grace take a sb arg

[Stanislav Kinsbursky <skinsbursky@parallels.com>]

11.04.2012 22:20, J. Bruce Fields написал:
> Suppose you export subtree /export/foo of filesystem /export to a
> client, that client can also easily access anything else in /export; all
> it hsa to do is guess the filehandle of the thing it wants to access (or
> just guess filehandle of /export itself; root filehandles are likely
> especially easily to guess), and then work from there.

I see.
So, if I undertand you correctly, filesystem to export should be not 
only one per server, but also should not consist or any other files, 
which are not allowed to export.
Currently, in OpenVZ we have kernel threads per container. Thus even 
kernel threads are in "chroot jail".
But I'll check, do we have such vulnerability.
Thank you.

> (There's a workaround: you can set the subtree_check option.  That
> causes a number of problems (renaming a file to a different directory
> changes its filehandle, for example, so anyone trying to use it while it
> gets renamed gets an unexpected ESTALE).  So we don't recommend it.)
>
> So if all the containers are sharing the same filesystem, then anyone
> exporting a subdirectory of its own filesystem has essentially granted
> access to everyone's filesystem.
>
> For that reason it's really only recommended to export separate
> filesystems....

Thanks. Anyway, we are going to get rid of "chroot jails" and replace 
them by separated loop device.