From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 791E0C433FE for ; Mon, 21 Nov 2022 17:34:05 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230241AbiKUReE (ORCPT ); Mon, 21 Nov 2022 12:34:04 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55824 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229992AbiKUReD (ORCPT ); Mon, 21 Nov 2022 12:34:03 -0500 Received: from bedivere.hansenpartnership.com (bedivere.hansenpartnership.com [IPv6:2607:fcd0:100:8a00::2]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 01C34CD969; Mon, 21 Nov 2022 09:33:59 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=hansenpartnership.com; s=20151216; t=1669052039; bh=1NBtM3ic574n1Twrt+hz9W3YFOsRlGAK5kI5ykv3AJw=; h=Message-ID:Subject:From:To:Date:In-Reply-To:References:From; b=hfMHqNKVYci9A6OL7RrPHVSj1+fjQqUesByvXCWTpD4VnwLtv5YDW1JRN8Csya7op uLgPvLjaO2YbSOjN4wYahNIyWUkxX5TlI1+QLg3WaWhlujBxrtFTHrqy/uEngA/y2n 4d9ObYfWnPQFfG5r8u+cQVwMFWtQgcYi6z4E0Xh8= Received: from localhost (localhost [127.0.0.1]) by bedivere.hansenpartnership.com (Postfix) with ESMTP id 29B2B128647B; Mon, 21 Nov 2022 12:33:59 -0500 (EST) Received: from bedivere.hansenpartnership.com ([127.0.0.1]) by localhost (bedivere.hansenpartnership.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Xzyyntl5lLVC; Mon, 21 Nov 2022 12:33:59 -0500 (EST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=hansenpartnership.com; s=20151216; t=1669052038; bh=1NBtM3ic574n1Twrt+hz9W3YFOsRlGAK5kI5ykv3AJw=; h=Message-ID:Subject:From:To:Date:In-Reply-To:References:From; b=HoHMad2SLqp4HlUabcI9OV4eBb+9yM/KrRBmYc1yGrB3+7iRYKajqVC0FUeOCYulg 2XSfo2Ri/bc34rVnRpsXaX+LQpt123Zr9A2/dIVlxcff7qs5iYpgrK4abJ8D8k8uTb m7TFERR+spJqRcqq+FeAE6mRuyUxoiJWyP8Om2HA= Received: from lingrow.int.hansenpartnership.com (unknown [IPv6:2601:5c4:4302:c21::c14]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (prime256v1) server-signature RSA-PSS (2048 bits) server-digest SHA256) (Client did not present a certificate) by bedivere.hansenpartnership.com (Postfix) with ESMTPSA id 74E4812862F9; Mon, 21 Nov 2022 12:33:57 -0500 (EST) Message-ID: <94fe007e8eab8bc7ae3f56b88ad94646b4673657.camel@HansenPartnership.com> Subject: Re: [PATCH 2/4] fs: define a firmware security filesystem named fwsecurityfs From: James Bottomley To: Greg Kroah-Hartman Cc: Nayna , Nayna Jain , linuxppc-dev@lists.ozlabs.org, linux-fsdevel@vger.kernel.org, linux-efi@vger.kernel.org, linux-security-module , linux-kernel@vger.kernel.org, Michael Ellerman , npiggin@gmail.com, christophe.leroy@csgroup.eu, Dov Murik , George Wilson , Matthew Garrett , Dave Hansen , Benjamin Herrenschmidt , Paul Mackerras , Russell Currey , Andrew Donnellan , Stefan Berger Date: Mon, 21 Nov 2022 12:33:55 -0500 In-Reply-To: References: <8447a726-c45d-8ebb-2a74-a4d759631e64@linux.vnet.ibm.com> <44191f02-7360-bca3-be8f-7809c1562e68@linux.vnet.ibm.com> <88111914afc6204b2a3fb82ded5d9bfb6420bca6.camel@HansenPartnership.com> <10c85b8f4779700b82596c4a968daead65a29801.camel@HansenPartnership.com> Content-Type: text/plain; charset="UTF-8" User-Agent: Evolution 3.42.4 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: On Mon, 2022-11-21 at 16:05 +0100, Greg Kroah-Hartman wrote: > On Mon, Nov 21, 2022 at 09:03:18AM -0500, James Bottomley wrote: > > On Mon, 2022-11-21 at 12:05 +0100, Greg Kroah-Hartman wrote: > > > On Sun, Nov 20, 2022 at 10:14:26PM -0500, James Bottomley wrote: [...] > > > > I already explained in the email that sysfs contains APIs like > > > > simple_pin_... which are completely inimical to namespacing. > > > > > > Then how does the networking code handle the namespace stuff in > > > sysfs? That seems to work today, or am I missing something? > > > > have you actually tried? > > > > jejb@lingrow:~> sudo unshare --net bash > > lingrow:/home/jejb # ls /sys/class/net/ > > lo  tun0  tun10  wlan0 > > lingrow:/home/jejb # ip link show > > 1: lo: mtu 65536 qdisc noop state DOWN mode DEFAULT > > group > > default qlen 1000 > >     link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 > > > > So, as you see, I've entered a network namespace and ip link shows > > me the only interface I can see in that namespace (a down loopback) > > but sysfs shows me every interface on the system outside the > > namespace. > > Then all of the code in include/kobject_ns.h is not being used?  We > have a whole kobject namespace set up for networking, I just assumed > they were using it.  If not, I'm all for ripping it out. Hm, looking at the implementation, it seems to trigger off the superblock (meaning you have to remount inside a mount namespace) and it only works to control visibility in label based namespaces, so this does actually work jejb@lingrow:~/git/linux> sudo unshare --net --mount bash lingrow:/home/jejb # mount -t sysfs none /sys lingrow:/home/jejb # ls /sys/class/net/ lo The label based approach means that any given file can be shown in one and only one namespace, which works for net, but not much else (although it probably could be adapted). James