linux-kernel - Re: Detecting bind-mounts

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 05 Nov 2010 10:24:29 +0000
From:	Pádraig Brady <P@...igBrady.com>
To:	Michael Tokarev <mjt@....msk.ru>
CC:	Linux-kernel <linux-kernel@...r.kernel.org>
Subject: Re: Detecting bind-mounts

On 04/11/10 20:45, Michael Tokarev wrote:
> Hello.
> 
> There are quite some talks on the 'net - questions, not
> answers - about detecting bind mounts - be it a directory
> or a file.
> 
> There are 2 (mostly) different kinds of applications.  One
> is cp/tar/find with --same-filesystem option (or equivalent),
> that should not cross mountpoints.  And one more, apps like
> mountpoint(1) from sysvinit - a utility to determine if a
> given path is a mountpoint.
> 
> Neither of the two work when two directores on the same
> filesystem are bind-mounted.
> 
> The usual idiom is to compare st_dev of current directory and
> the parent - if they're different that's a mount point.  But
> in this case, two st_devs will be the same, so such a mount
> point will not be detected.
> 
> It is even worse for bind-mounted files (as opposed to dirs):
> there's no path/file/.. entry to stat(2), and cutting the
> last component from the pathname does not work reliable due
> to symlinks (it may be a symlink from different filesystem).
> 
> So far I know only one way to detect a bind mount like this,
> and it is unreliable anyway.  It is to parse /proc/mounts
> and try to find the object(s) in question.  Unreliable because
> of, again, symlinks, and possible complex mounts and bind-
> mounts.  And this is also very slow - imagine using this way
> for find/tar/cp --one-file-system.
> 
> Is there some simpler and more reliable way? Maybe use mount
> syscall, like we use kill($pid, 0) to check existance of a
> process?
> 
> And as far as I understand, the same applies to multiple
> mounts of the same filesystem.

The `stat` command recently got support for
printing the mount point for a file:
http://git.savannah.gnu.org/gitweb/?p=coreutils.git;a=commit;h=ddf6fb86

`stat` will output the alias for a bind mounted file
while `df` will output the initial mount point of its backing device
So you could do something like:

file=.
df_mnt=$(df -P "$file" | sed -n '2s/.* \([^ ]*$\)/\1/p')
stat_mnt=$(stat -c%m "$file")
test "$df_mnt" = "$stat_mnt" || echo "bind mount"

cheers,
Pádraig.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/