linux-kernel - Re: mount --move and shared namespaces

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Tue, 10 May 2016 16:48:26 +0100
From:	Al Viro <viro@...IV.linux.org.uk>
To:	Phillip Susi <psusi@...ntu.com>
Cc:	linux-kernel <linux-kernel@...r.kernel.org>
Subject: Re: mount --move and shared namespaces

On Mon, May 09, 2016 at 06:46:02PM -0400, Phillip Susi wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA512
> 
> It seems that mount --move does not work on a shared namespace ( now
> the default under systemd ), yet you can mount --bind and then umount
> the original, which seems to amount to exactly the same thing.  Why is
> the direct move not allowed?

You have something mounted on /foo and events from /foo propagated to
/bar.  You move the instance on /foo to /baz; what to do with one on
/bar?  Propagation from /baz might have nothing whatsoever in common
with that on /foo, so "move to the corresponding recepients of events
for /baz" is not an answer...

Move *into* shared is allowed - the one you move ends up relocated and
cloned, with clones attached to the places where events propagate to.
Move *from* shared...  No sane semantics.

And no, mount --move is *not* mount --bind + umount - it really moves
the vfsmount, so anything sitting in that subtree will find itself at
the new location.