linux-kernel - Re: [PATCH] proc: align mnt_id in /proc/pid/fdinfo and /proc/pid/mountinfo

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 21 Nov 2019 11:03:18 +0100
From:   Miklos Szeredi <miklos@...redi.hu>
To:     "Chen, Hu" <hu1.chen@...el.com>
Cc:     Andrey Vagin <avagin@...nvz.org>,
        Alexander Viro <viro@...iv.linux.org.uk>,
        Alexey Dobriyan <adobriyan@...il.com>,
        linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] proc: align mnt_id in /proc/pid/fdinfo and /proc/pid/mountinfo

On Thu, Nov 21, 2019 at 8:28 AM Chen, Hu <hu1.chen@...el.com> wrote:
>
> For Android application process, we found that the mnt_id read from
> /proc/pid/fdinfo doesn't exist in /proc/pid/mountinfo. Thus CRIU fails
> to dump such process and it complains
>
> "(00.019206) Error (criu/files-reg.c:1299): Can't lookup mount=42 for
> fd=-3 path=/data/dalvik-cache/x86_64/system@...mework@...t.art"
>
> This is due to how Android application is launched. In Android, there is
> a special process called Zygote which handles the forking of each new
> application process:
> 0. Zygote opens and maps some files, for example
>    "/data/dalvik-cache/x86_64/system@...mework@...t.art" in its current
>    mount namespace, say "old mnt ns".
> 1. Zygote waits for the request to fork a new application.
> 2. Zygote gets a request, it forks and run the new process in a new
>    mount namespace, say "new mnt ns".
>
> The file opened in step 0 ties to the mount point in "old mnt ns". The
> mnt_id of that mount is listed in /proc/pid/fdinfo. However,
> /proc/pid/mountinfo points to current ns, i.e., "new mnt ns".
>
> Althgouh this issue is exposed in Android, we believe it's generic.
> Prcoess may open files and enter new mnt ns.
>
> To address it, this patch searches the mirror mount in current ns with
> MAJOR and MINOR and shows the mirror's mnt_id.

This is a hack.   I suggest instead to add a new line to fdinfo with
the MAJOR:MINOR number of the device.

Thanks,
Miklos