From: Al Viro <viro@ZenIV.linux.org.uk>
To: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Ian Kent <raven@themaw.net>,
Kernel Mailing List <linux-kernel@vger.kernel.org>,
David Howells <dhowells@redhat.com>,
Oleg Nesterov <onestero@redhat.com>,
Trond Myklebust <trond.myklebust@primarydata.com>,
"J. Bruce Fields" <bfields@fieldses.org>,
Benjamin Coddington <bcodding@redhat.com>,
Jeff Layton <jeff.layton@primarydata.com>
Subject: Re: [RFC PATCH v4 03/12] vfs - move mnt_namespace definition to linux/mount.h
Date: Fri, 20 Mar 2015 02:47:38 +0000 [thread overview]
Message-ID: <20150320024738.GU29656@ZenIV.linux.org.uk> (raw)
In-Reply-To: <87d244fp2a.fsf@x220.int.ebiederm.org>
On Thu, Mar 19, 2015 at 08:14:05PM -0500, Eric W. Biederman wrote:
> > Yes please, I'd be more confident if you did this than me, there's
> > already enough to worry about with the series.
>
> Given that this patchset is a security hole waiting to happen I don't
> see why Al should bother unless there are good reasons to do this
> otherwise.
There might be, actually. &...->mnt_ns->ns is a lot saner candidate for
a reference in nsproxy than ...->mnt_ns - *that* is the part nsproxy-related
code cares about anyway, and unlike the rest of struct mnt_namespace it
doesn't have to be opaque for everything outside of (small part of) core
VFS. Additionally, ->mnt_ns is a bad name choice - it sounds like a field
of struct mount and, worse yet, there *is* a field of struct mount with
that name. Confusing for no good reason and makes both harder to grep for.
And current_mnt_ns() is definitely open-coded too many times - the first
commit in that series makes sense regardless of anything else.
next prev parent reply other threads:[~2015-03-20 2:47 UTC|newest]
Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-03-17 2:44 [RFC PATCH v4 00/12] Second attempt at contained helper execution Ian Kent
2015-03-17 2:44 ` [RFC PATCH v4 01/12] nsproxy - make create_new_namespaces() non-static Ian Kent
2015-03-17 2:45 ` [RFC PATCH v4 02/12] kmod - rename call_usermodehelper() flags parameter Ian Kent
2015-03-17 2:45 ` [RFC PATCH v4 03/12] vfs - move mnt_namespace definition to linux/mount.h Ian Kent
2015-03-19 19:47 ` Al Viro
2015-03-20 0:57 ` Ian Kent
2015-03-20 1:14 ` Eric W. Biederman
2015-03-20 2:11 ` Ian Kent
2015-03-20 2:47 ` Al Viro [this message]
2015-03-17 2:45 ` [RFC PATCH v4 04/12] kmod - add namespace aware thread runner Ian Kent
2015-03-17 2:45 ` [RFC PATCH v4 05/12] kmod - teach call_usermodehelper() to use a namespace Ian Kent
2015-03-17 2:45 ` [RFC PATCH v4 06/12] kmod - add namespace info store Ian Kent
2015-03-17 2:45 ` [RFC PATCH v4 07/12] kmod - add call_usermodehelper_ns() Ian Kent
2015-03-17 2:45 ` [RFC PATCH v4 08/12] nfsd - use namespace if not executing in init namespace Ian Kent
2015-03-17 2:45 ` [RFC PATCH v4 09/12] nfs - cache_lib " Ian Kent
2015-03-17 2:45 ` [RFC PATCH v4 10/12] nfs - objlayout " Ian Kent
2015-03-17 2:46 ` [RFC PATCH v4 11/12] KEYS - use correct memory allocation flag in call_usermodehelper_keys() Ian Kent
2015-03-17 2:46 ` [RFC PATCH v4 12/12] KEYS: exec request-key within the requesting task's init namespace Ian Kent
2015-03-18 17:41 ` [RFC PATCH v4 00/12] Second attempt at contained helper execution J. Bruce Fields
2015-03-19 21:38 ` Eric W. Biederman
2015-03-20 2:10 ` Ian Kent
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20150320024738.GU29656@ZenIV.linux.org.uk \
--to=viro@zeniv.linux.org.uk \
--cc=bcodding@redhat.com \
--cc=bfields@fieldses.org \
--cc=dhowells@redhat.com \
--cc=ebiederm@xmission.com \
--cc=jeff.layton@primarydata.com \
--cc=linux-kernel@vger.kernel.org \
--cc=onestero@redhat.com \
--cc=raven@themaw.net \
--cc=trond.myklebust@primarydata.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox