linux-kernel - Re: [PATCH v2] fs: add new O_MNT flag for opening mount root from mountpoint fd

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Fri, 15 Nov 2019 07:37:58 +0000
From:   Pavel Tikhomirov <ptikhomirov@...tuozzo.com>
To:     Al Viro <viro@...iv.linux.org.uk>
CC:     Jeff Layton <jlayton@...nel.org>,
        "J . Bruce Fields" <bfields@...ldses.org>,
        Arnd Bergmann <arnd@...db.de>,
        Paul Moore <paul@...l-moore.com>,
        Richard Guy Briggs <rgb@...hat.com>,
        "linux-fsdevel@...r.kernel.org" <linux-fsdevel@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "linux-arch@...r.kernel.org" <linux-arch@...r.kernel.org>,
        "Andrei Vagin (C)" <avagin@...il.com>
Subject: Re: [PATCH v2] fs: add new O_MNT flag for opening mount root from
 mountpoint fd

On 11/14/19 5:13 PM, Al Viro wrote:
> On Thu, Nov 14, 2019 at 12:04:54PM +0300, Pavel Tikhomirov wrote:
> 
>> More precisely the algorithm is:
>> a) openat mpfd to a new mountpoint through parent mount's root -
>> p_rootfd (which we already have) or mountpoint fd under a sibling mount
>> - s_mpfd if our mountpoint is already overmounted.
>> b) create a new mount on mpfd via /proc/<pid>/fd/<N> interface
>> c) openat it's rootfd via O_MNT from mpfd
>>
>> If we have mpfd and rootfd for each mount through /proc/<pid>/fd/<N>
>> interface we will be able to bindmount any part of each of already
>> created mounts to restore other mounts  and we will be able to configure
>> mounts, e.g. change sharing or other options even if mounts are
>> invisible from fs-root.
> 
> Everything else aside (and I'm not thrilled about the idea in general),
> you are not handling the situation when that overmount is, in turn,
> overmounted.

Sorry but I don't understand why overmounted overmount is a special 
case... Let me explain in other words. I use mathematical induction as a 
proof technique. Base of induction is when we have no mounts (exept 
root), it is obvious that we can access all directories in the system. 
Step of induction is when we add one more mount and before that step 
we've had an access to all directories in the system (have mpfds and 
rootfds for all mounts).

If step adds a mount mnt we need to only consider it's parent, siblings 
and children which will be there after the step, all other mounts does 
not change anything.

Propagations of mnt can't become mnt's children or siblings or parent, 
luckily for us. So we can actually consider one mount from propagation 
group at a time.

Now if mp is just visible from parent's p_rootfd we open mpfd. Else we 
have some sibling from which s_mpfd the mp is visible and we open mpfd 
from it. And the last case if we're crawling under some mount (child) we 
can open mpfd through c_mpfd.

Now our mpfd is open so we use O_MNT to open our rootfd. (And here we 
change c_mpfd to our rootfd as our new child switched parent)

>  Or when there's an automount set on top of it, etc.

I'm not common with automounts actually, so I might miss something here. 
Can you please show actual mount tree where this problem can happen?

> 

-- 
Best regards, Tikhomirov Pavel
Software Developer, Virtuozzo.