linux-kernel - Re: [PATCH] proc: move proc mount options out of pid

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1642748.MrLhTUgxmu@pegasus>
Date:	Fri, 24 May 2013 09:35:40 +0000
From:	Stephen Mell <sub.atomic.fusion@...il.com>
To:	Gu Zheng <guz.fnst@...fujitsu.com>
Cc:	linux-kernel@...r.kernel.org
Subject: Re: [PATCH] proc: move proc mount options out of pid_namespace

On Friday, May 24, 2013 17:14:13 Gu Zheng wrote:

> One fuzzy way in my mind, I'm not sure whether it's OK, but we can discuss it.
> Split hide_pid, pid_gid, and proc_self from pid_namespace, and create struct proc_sb_info(maybe the name "proc_mount_info" is better). 
> And create a new list domain in the pid_namespace to contain the proc_sb_info instances. Each time we mount proc in a new directory only
> create a new proc_sb_info instance, and added it to the list in pid_namespace. 
> But this leads to another problem, how to get the right proc_sb_info instance in proc permission checking routine, do you have any idea?
> what do you think of this way?

I understand now what you're getting at.
However, I'd like to make the argument that it is desirable to have each proc mount, even those that reference the same namespace, have a different superblock. One option that I intend to add is the ability to specify which pid namespace proc is mounted for, rather than forcing the current one. If this were to be added, it wouldn't work to share superblocks, as that would prevent remounts of proc from switching which namespace that the refer to (or that is my understanding, which may be incorrect).
Considering the small number of proc mounts that tend to be around anyway, perhaps this outweighs the drawbacks.
Let me know what you think.

> Thanks,
> Gu

Thanks,
Stephen
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/