linux-kernel - Re: [PATCH -V14 0/11] Generic name to handle and open by handle syscalls

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20100708150331.10c6ef52@notabene.brown>
Date:	Thu, 8 Jul 2010 15:03:31 +1000
From:	Neil Brown <neilb@...e.de>
To:	Andreas Dilger <andreas.dilger@...cle.com>
Cc:	"J. Bruce Fields" <bfields@...ldses.org>,
	Miklos Szeredi <miklos@...redi.hu>, david@...morbit.com,
	aneesh.kumar@...ux.vnet.ibm.com, hch@...radead.org,
	viro@...iv.linux.org.uk, adilger@....com, corbet@....net,
	serue@...ibm.com, hooanon05@...oo.co.jp,
	linux-fsdevel@...r.kernel.org, sfrench@...ibm.com,
	philippe.deniel@....FR, linux-kernel@...r.kernel.org
Subject: Re: [PATCH -V14 0/11] Generic name to handle and open by handle
 syscalls

On Wed, 7 Jul 2010 18:03:36 -0600
Andreas Dilger <andreas.dilger@...cle.com> wrote:

> On 2010-07-07, at 16:21, Neil Brown wrote:
> > It doesn't matter if there is an underlying block device, or if it is shared
> > among subvolmes.  st_dev is *the* primary key for filesystems.  Every "struct super_block" has a unique s_dev and that is returned in st_dev.
> > 
> > For "traditional" filesystem, this is the major/minor number of the block
> > device.
> > For NFS and btrfs and other filesystems which don't have exclusive use of a
> > block device, 'set_anon_super' is used to get a unique s_dev based on a major
> > number of '0'.
> 
> But the major/minor number returned is essentially random between different clients, so there is no way to use it on another node that is accessing the same filesystem.  Conversely, the UUID will be the same on all of the clients.
> 
> > So you can *always* use st_dev as an identifier for the filesystem which is
> > stable and unique as long as you hold an active reference to the filesystem
> > (open file descriptor, cwd in fs, etc).
> 
> Only on a single system.

Well the system call only runs on a single system.
If you want a cluster-unique name, get the cluster software to generate it
or enforce it.
Performing a mapping is not hard.

> 
> > If you poll(2) /proc/mounts to get notifications of changes to the mount
> > table, then it should be quite easy to cache st-dev -> uuid mappings in a
> > race-free way.
> 
> This sounds unpleasant for any application to implement.  It might be OK for a user-space NFS/CIFS server, but it is complex and error-prone for any normal usage, and doesn't seem like a good API design to me.

Define "normal usage" for filehandle-based lookup ???

Identifing a filesystem by st_dev is completely reliable.  That is a good
start for API design.

Identifing by UUID is not unless uniqueness is enforced, and ....

> 
> > There might be value in getting name_to_handle to return the st_dev of the
> > target file to ensure that you haven't unexepected crossed into a different
> > filesystem.  I would prefer that to returning a uuid:  st_dev is guaranteed
> > to be unique, a uuid is only supposed to be unique (i.e. that is not
> > enforced).
> 
> UUID duplication (w.r.t. multiple mounts of the same underlying device) doesn't matter at all for regular file opens, where the only interest is getting a handle for the inode.  I wouldn't be against requiring the UUID be unique if that was needed, or failing regular opens in the rare case that there is a non-unique UUID pointing to different devices, or failing directory opens for the case of multiple mountpoints.

It has already been said that requiring uuids to be unique breaks current
practice (involving mounting dm snapshots of active filesystems).
Failing legitimate syscalls in rare circumstances sounds like bad API design
to me.

NeilBrown


> 
> Cheers, Andreas
> --
> Andreas Dilger
> Lustre Technical Lead
> Oracle Corporation Canada Inc.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/