linux-kernel - Re: [PATCH 5/6] fsmount: do not use legacy MS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 21 Sep 2018 17:52:36 +0100
From:   David Howells <dhowells@...hat.com>
To:     Christian Brauner <christian@...uner.io>
Cc:     dhowells@...hat.com, Miklos Szeredi <mszeredi@...hat.com>,
        Al Viro <viro@...IV.linux.org.uk>,
        linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH 5/6] fsmount: do not use legacy MS_ flags

Christian Brauner <christian@...uner.io> wrote:

> So from reading the patch I got the impression that superblock mount
> options passed via fsconfig() are passed as strings like "ro" and are
> translated into approriate objects (e.g. flags etc.) by the kernel.

I'm having second throughts about that - at least for "ro": that one is
particularly problematic as it governs how source devices are opened.  I'm
kind of tempted to pass that as a flag to fsopen().

What I'd like to do in btrfs, ext4, etc. is open blockdevs as I get the
parameters that enumerate them - but I have to hold the looked-up paths till
the validate/get_tree stage so that I know the final ro/rw state before I can
do the opening.

> That seems like a future proof mechanism to extend mount options for
> userspace without having to worry about exceeding any integer types in the
> future. Maybe this would make sense for non-superblock options as well? I
> can see that this is less performant that checking flags and string parsing
> is a thing that is not particularly nice but it would be one option to solve
> the running out of flags problem.

Al disliked the idea of setting up a separate context to define the mount
options.

> > 	mount_setattr(int dfd, const char *path, unsigned int atflags,
> > 		      unsigned int attr_values,
> > 		      unsigned int attr_mask);
> 
> If we go with the flag arguments wouldn't it make sense to use a larger
> integer type?

You can't - at least not directly through syscall args.  They are 32-bit on a
32-bit system.

> > where atflags can potentially include AT_RECURSIVE.
> 
> Very much in favor of having this operate recursively!

It gets complicated with propagation.

David