Re: [PATCHv2 1/5] VFS: DazukoFS, stackable-fs, file access control

[John Ogness <dazukocode@ogness.net>]

On 2009-02-13, Al Viro <viro@ZenIV.linux.org.uk> wrote:
>> You could write an additional mount helper (and putting that into
>> /sbin/mount.dazukofs) that does all the security checks:
>> 
>>  - that the device is the same as mountpoint
>>  - that the device belonging to the underlying '/mnt' is not
>>    mounted anywhere else (in this namespace, at least)
>>  - exit(1) otherwise
>> 
>> Sure, it may not protect against all the cases Al can come up with,
>> but it is better than having nothing.
>
> It's still racy, at the very least.  Folks, seriously, you can not
> rely on the underlying tree being inaccessible elsewhere.  Anything
> that does stacking has to cope with that possibility; it's not
> bypassable by userland helpers.

Indeed. As long as the stackable filesystem is synchronizing with the
lower layer before doing read actions and synchronizes after all
actions, there should be no problem.

Currently I see a problem when a new directory is created directly on
the lower mount (rather than through the stackable filesystem). A
refcount for "." as seen from the stackable filesystem is then
incorrect. I will investigate this.

And I will look to see why there is any danger at all. There should
not be.

John Ogness