From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 13B51C433F5 for ; Thu, 29 Sep 2022 21:15:40 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229802AbiI2VPf (ORCPT ); Thu, 29 Sep 2022 17:15:35 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59900 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229502AbiI2VPc (ORCPT ); Thu, 29 Sep 2022 17:15:32 -0400 Received: from zeniv.linux.org.uk (zeniv.linux.org.uk [IPv6:2a03:a000:7:0:5054:ff:fe1c:15ff]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A02565E326; Thu, 29 Sep 2022 14:15:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=linux.org.uk; s=zeniv-20220401; h=Sender:In-Reply-To:Content-Type: MIME-Version:References:Message-ID:Subject:Cc:To:From:Date:Reply-To: Content-Transfer-Encoding:Content-ID:Content-Description; bh=BHyZXwz0JpdIs839aZuS4LVragG1ByLHmjarMItcZwU=; b=KOsF3K4ixph6tVuWA1nGXJ4JN1 oreveL4oBOsfZ98hMXtlgpTWlYRQe9nZF4IIdbUuFc9aCHiQUub43l4guA73tEr5akI0p18O9OVzj xMpTcRpd9MwJwxdvcte9eL6rzE0iTh5Xtnn2Rh5ibQRD2m1e3MTPh5G0ZYSwleCdR0Sjk8GXhIlAj NgDuDttPXT5627G6g+6CiEOglO8MpPBbWFvro2WIl8uyjuX6/IgLADZWgt50g/csDCZgmL+oSaiSJ /6GYHWste/6KiaQ24RbUp4x76FhGjhbJDDORF7tHyIXIJQaHNDzVyO8q0smSnO7XJcmhya7EAQ/yE LcWu3AXg==; Received: from viro by zeniv.linux.org.uk with local (Exim 4.96 #2 (Red Hat Linux)) id 1oe0sQ-0055y5-2H; Thu, 29 Sep 2022 21:15:27 +0000 Date: Thu, 29 Sep 2022 22:15:26 +0100 From: Al Viro To: Linus Torvalds Cc: David Laight , "linux-kernel@vger.kernel.org" , "netdev@vger.kernel.org" , "Eric W. Biederman" , "Serge E. Hallyn" Subject: Re: [PATCH 3/4] proc: Point /proc/net at /proc/thread-self/net instead of /proc/self/net Message-ID: References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: Sender: Al Viro Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Thu, Sep 29, 2022 at 08:34:52PM +0100, Al Viro wrote: > On Thu, Sep 29, 2022 at 12:05:32PM -0700, Linus Torvalds wrote: > > On Thu, Sep 29, 2022 at 12:00 PM Al Viro wrote: > > > > > > Which is insane, especially since the entire problem is due to wanting > > > that directory to be different for different threads... > > > > Absolutely. This is all due to Apparmor (a) basing things on pathnames > > and (b) then getting those pathnames wrong. > > > > Which is why I'm just suggesting we short-circuit the path-name part, > > and not make this be a real symlink that actually walks a real path. > > > > The proc handling uses "readlink" to make it *look* like a > > symlink, but then "get_link" to actually look it up (and never walk it > > as a path). > > > > Something similar? > > Apparmor takes mount+dentry and turns that into pathname. Then acts > upon the resulting string. *AFTER* the original had been resolved. > IOW, it doesn't see the symlink contents - only the location where the > entire thing ends up. > > AFAICS, the only way to make it STFU is either > * fix the idiotic policy > or > * make the per-thread directory show up as /proc//net > > As in "../.. from there lands you in /proc". Because that's what > apparmor does to generate the string it treats as the pathname... FWIW, what e.g. debian profile for dhclient has is @{PROC}/@{pid}/net/dev r, Note that it's not @{PROC}/net/dev r, precisely because the rules are applied after the pathname got resolved. *IF* we want that rule to allow opening /proc/net/dev, we'd better have it yield a dentry in procfs that would have "dev" as ->d_name, with its parent having "net" as ->d_name and its grandparent being the child of procfs root with ->d_name containing decimal representation of PID. Worse, original poster in _this_ thread wants the same /proc/net/dev to to yield different files for different threads belonging to the same process and we'd need _all_ of them to have identical chain of ->d_name occuring on the way to root.