linux-kernel - Re: [PATCH 3/4] proc: Point /proc/net at /proc/thread-self/net instead of /proc/self/net

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <YzYMQDTAYCCax0WZ@ZenIV>
Date:   Thu, 29 Sep 2022 22:21:04 +0100
From:   Al Viro <viro@...iv.linux.org.uk>
To:     Linus Torvalds <torvalds@...ux-foundation.org>
Cc:     David Laight <David.Laight@...lab.com>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>,
        "Eric W. Biederman" <ebiederm@...ssion.com>,
        "Serge E. Hallyn" <serge@...lyn.com>
Subject: Re: [PATCH 3/4] proc: Point /proc/net at /proc/thread-self/net
 instead of /proc/self/net

On Thu, Sep 29, 2022 at 02:13:57PM -0700, Linus Torvalds wrote:
> On Thu, Sep 29, 2022 at 12:34 PM Al Viro <viro@...iv.linux.org.uk> wrote:
> >
> > Apparmor takes mount+dentry and turns that into pathname.  Then acts
> > upon the resulting string.  *AFTER* the original had been resolved.
> 
> Ok. So it would have to act like a bind mount.
> 
> Which is probably not too bad.
> 
> In fact, maybe it would be ok for this to act like a hardlink and just
> fill in the inode - not safe for a filesystem in general due to the
> whole rename loop issue, but for /proc it might be fine?

_Which_ hardlink?

Linus, where in dentry tree would you want it to be seen?  Because
apparmor profile wants /proc/net/dev to land at /proc/<pid>/net/dev
and will fail with anything else.

Do you really want multiple dentries with the same name in the same
parent, refering to different directory inodes with different contents?

And that's different inodes with different contents - David's complaint
is precisely about seeing the same thing for all threads and apparmor
issue is with *NOT* seeing each of those things at the same location.