Re: [patch] kernel sysfs events layer

Tim Hockin
2004-09-15T21:01:28Z

On Wed, Sep 15, 2004 at 04:49:18PM -0400, Robert Love wrote:
> On Wed, 2004-09-15 at 13:47 -0700, Tim Hockin wrote:
>
> > Are you not sending it with some specific device as the source? Or is it
> > just coming from some abstract root kobject?
>
> It comes the the physical device.
>
> Is there really a specific issue that you are seeing?

Well, two.

1) If you send me an event "/dev/hda3 mounted", but it was for some other
namespace, you just leaked potentially useful information.

I'm no security expert, but that seems to me to be a gratuitous leak.
Maybe it's just another example of why namespaces need to go away.

2) If you send me an event "/dev/hda3 mounted" do I also get an event when
I loopback mount /tmp/rh9.0-1.iso or when I bind mount /foo to /bar or
when I mount server:/export/home on /home?

If you're notifying me of mounts and unmounts, I really want to know about
all of them, not just mounts that have a hard local device. I'd rather
get "something was mounted" and be forced to probe that (that's a leak,
too, but less important).

Tim