Re: [RFC][PATCH] VFS: create /proc/<pid>/mountinfo

[Ram Pai <linuxram@us.ibm.com>]

On Mon, 2008-01-21 at 22:25 +0100, Miklos Szeredi wrote:
> > 	You have removed the code that checked if the peer or
> > 	master mount was in the same namespace before reporting their
> > 	corresponding mount-ids. One downside of that approach is the
> > 	user will see an mount_id in the output with no corresponding
> > 	line to explain the details of the mount_id.  
> 
> Before the change, the peer and master ID's were basically randomly
> chosen from the peers, which means, it wasn't possible to always
> determine, that two mounts were peers, or that they were slaves to the
> same peer group.
> 
> After the change, this is possible, since the peer ID will be the same
> for all mounts which are peers.  This means, that even though the peer
> ID might be in a different namespace, it is possible to determine all
> peers within the same namespace by comparing their peer ID's.


 I agree with your reasoning on the random id; showing a single
 id avoids clutter. But my point is, why not show a
 id for the master or peer residing in the same namespace?
 Showing a id with no corresponding entry for that id, can be
 intriguing.

 
 If no master-mount exists in the same namespace then print -1
 meaning "masked". 

 there is always atleast one peer-mount in a given namespace; so no
 issue there.

 

> > 
> > 	And reporting the mount-id of a mount is some other namespace
> > 	could subtly mean information-leak?
> 
> I don't think the mount ID itself can be sensitive, it really doesn't
> contain any information, other than being an identifier.
> 
> > 	One other comment I had received offline from Steve French was
> > 	that the patch did not consider the following case:
> > 
> > 	"Have you thought about whether this could handle the case in which cifs mounts with 
> > 	a relative path e.g. currently
> >          	mount -t cifs //server/share /mnt
> > 
> > 	can not be distinguished from
> >         	mount -t cifs //server/share/subdirectory /mnt
> > 
> > 	when you run the mount command (ie the cifs "prefixpath" in this case 
> > 	"/subdirectory" is not displayed)"
> 
> Why cifs not displaying '//server/share/subdirectory' as the source of
> the mount?

dont know. not tried it myself.

RP
> 
> Miklos