linux-kernel - Re: device namespaces

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 14 Jun 2021 12:36:19 -0500
From:   ebiederm@...ssion.com (Eric W. Biederman)
To:     "Enrico Weigelt\, metux IT consult" <lkml@...ux.net>
Cc:     Christian Brauner <christian.brauner@...ntu.com>,
        Hannes Reinecke <hare@...e.de>, gregkh@...uxfoundation.org,
        containers@...ts.linux.dev, linux-kernel@...r.kernel.org
Subject: Re: device namespaces

"Enrico Weigelt, metux IT consult" <lkml@...ux.net> writes:

> On 11.06.21 20:14, Eric W. Biederman wrote:
>
> Hi,
>
>> I favor none of the virtual devices showing up in sysfs.  Maybe existing
>> userspace needs the devices in sysfs, but if the solution is simply to
>> skip sysfs for virtual devices that is much simpler.
>
> Sorry for being a little bit confused, but by virtual devices you mean
> things like pty's or all the other stuff we already see under
> /sys/device/virtual ?

By virtual devices I mean all devices that are not physical pieces
of hardware.  For block devices I mean devices such as loopback
devices that are created on demand.  Ramdisks that start this
conversation could also be considered virtual devices.

> How would you skip the virtual devices from sysfs ? Adding some filter
> into sysfs that looks at the device class (or some flag within it) ?

I would just not run the code to create sysfs entries when the virtual
devices are created.

If you have virtual devices showing up in their own filesystem they
don't even need major or minor numbers.  You can just have files
that accept ioctls like device nodes.  In principle it is
possible to skip a lot of the historical infrastructure.  If the
infrastructure is not needed it is worth skipping.

I haven't dug into the block layer recently enough to say what is needed
or not.  I think there are some thing such as stat on a mounted
filesystem that need a major and minor numbers.  Which probably means
you have to use major and minor numbers.  By virtue of using common
infrastructure that implies showing up in sysfs and devtmpfs.  Things
would be limited just by not mounting devtmpfs in a container.

It is worth checking how much of the common infrastructure you need when
you start creating virtual devices.

The only reason the network devices need changes to sysfs is to allow
different network devices with the same name to show up in different
network namespaces.

If you can fundamentally avoid the problem of devices with the same
name needing to show up in sysfs and devtmpfs by using filesystems
then sysfs and devtmpfs needs no changes.

Hotplug is sufficiently widespread now that it should be possible
to avoid the hard problem of having duplicate names for block devices,
one way or another.  Thus talking of changing sysfs seems completely
unnecessary.

Eric