netdev - Re: [RFC][PATCH net] bpf: Use mount_nodev not mount

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <8737pce4zn.fsf@x220.int.ebiederm.org>
Date:	Fri, 20 May 2016 17:31:24 -0500
From:	ebiederm@...ssion.com (Eric W. Biederman)
To:	Hannes Frederic Sowa <hannes@...essinduktion.org>
Cc:	Daniel Borkmann <daniel@...earbox.net>,
	Alexei Starovoitov <ast@...nel.org>,
	"David S. Miller" <davem@...emloft.net>, netdev@...r.kernel.org
Subject: Re: [RFC][PATCH net] bpf: Use mount_nodev not mount_ns to mount the bpf filesystem

Hannes Frederic Sowa <hannes@...essinduktion.org> writes:

> On 18.05.2016 22:43, Daniel Borkmann wrote:
>> Eric, please send the patch officially and feel free to add my Ack.

Done.

>> Given
>> the circumstances, moving to mount_nodev() seems the best way forward. To
>> also address above mentioned concern from Hannes, we need to remove the
>> FS_USERNS_MOUNT flag along with the change. It looks like the fix is best
>> addressed in a single patch if you want to include it. If not, we can
>> otherwise send it separately as well, I don't mind.
>
> I agree. Would make most sense to make the change in one patch. Later on
> we can reason about if it makes sense to use the net namespace to split
> bpf maps and programs or maybe even introduce a new primitive for that.

I will let you two take care of the FS_USERNS_MOUNT flag.

Removal of the FS_USERNS_MOUNT flag because it was added prematurely is
a completely different analysis of consequences and possible regressions
in userspace.  The two changes should be kept separate to make it easy
to handle the unlikely case that either of them cause a regression.

But I have not objections to removing the FS_USERNS_MOUNT flag from the
bpf filesystem.

Eric