From: Al Viro <viro@zeniv.linux.org.uk>
To: Linus Torvalds <torvalds@linux-foundation.org>
Cc: David Laight <David.Laight@aculab.com>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
"netdev@vger.kernel.org" <netdev@vger.kernel.org>,
"Eric W. Biederman" <ebiederm@xmission.com>,
"Serge E. Hallyn" <serge@hallyn.com>
Subject: Re: [PATCH 3/4] proc: Point /proc/net at /proc/thread-self/net instead of /proc/self/net
Date: Thu, 29 Sep 2022 22:21:04 +0100 [thread overview]
Message-ID: <YzYMQDTAYCCax0WZ@ZenIV> (raw)
In-Reply-To: <CAHk-=wgiBBXeY9ioZ8GtsxAcd42c265zwN7bYVY=cir01OimzA@mail.gmail.com>
On Thu, Sep 29, 2022 at 02:13:57PM -0700, Linus Torvalds wrote:
> On Thu, Sep 29, 2022 at 12:34 PM Al Viro <viro@zeniv.linux.org.uk> wrote:
> >
> > Apparmor takes mount+dentry and turns that into pathname. Then acts
> > upon the resulting string. *AFTER* the original had been resolved.
>
> Ok. So it would have to act like a bind mount.
>
> Which is probably not too bad.
>
> In fact, maybe it would be ok for this to act like a hardlink and just
> fill in the inode - not safe for a filesystem in general due to the
> whole rename loop issue, but for /proc it might be fine?
_Which_ hardlink?
Linus, where in dentry tree would you want it to be seen? Because
apparmor profile wants /proc/net/dev to land at /proc/<pid>/net/dev
and will fail with anything else.
Do you really want multiple dentries with the same name in the same
parent, refering to different directory inodes with different contents?
And that's different inodes with different contents - David's complaint
is precisely about seeing the same thing for all threads and apparmor
issue is with *NOT* seeing each of those things at the same location.
next prev parent reply other threads:[~2022-09-29 21:21 UTC|newest]
Thread overview: 28+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-09-29 15:22 [PATCH 3/4] proc: Point /proc/net at /proc/thread-self/net instead of /proc/self/net David Laight
2022-09-29 18:21 ` Linus Torvalds
2022-09-29 18:50 ` Al Viro
2022-09-29 19:00 ` Al Viro
2022-09-29 19:05 ` Linus Torvalds
2022-09-29 19:34 ` Al Viro
2022-09-29 21:13 ` Linus Torvalds
2022-09-29 21:21 ` Al Viro [this message]
2022-09-29 21:27 ` Al Viro
2022-09-29 21:31 ` Linus Torvalds
2022-09-29 21:15 ` Al Viro
2022-09-29 21:29 ` Linus Torvalds
2022-09-29 22:14 ` Eric W. Biederman
2022-09-29 22:48 ` [CFT][PATCH] proc: Update /proc/net to point at the accessing threads network namespace Eric W. Biederman
2022-09-29 23:38 ` Al Viro
2022-09-30 3:19 ` kernel test robot
2022-09-30 6:07 ` kernel test robot
2022-09-30 9:30 ` David Laight
2022-09-30 16:17 ` Eric W. Biederman
2022-09-30 21:28 ` David Laight
2022-10-01 23:11 ` Al Viro
2022-10-03 9:36 ` David Laight
2022-10-03 14:03 ` Al Viro
2022-10-03 17:07 ` Eric W. Biederman
2022-10-03 18:49 ` Al Viro
2022-10-04 8:53 ` David Laight
2022-10-05 13:10 ` [proc] 5336f1902b: BUG:KASAN:global-out-of-bounds_in_memchr kernel test robot
2022-09-29 19:00 ` [PATCH 3/4] proc: Point /proc/net at /proc/thread-self/net instead of /proc/self/net Linus Torvalds
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=YzYMQDTAYCCax0WZ@ZenIV \
--to=viro@zeniv.linux.org.uk \
--cc=David.Laight@aculab.com \
--cc=ebiederm@xmission.com \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=serge@hallyn.com \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).