Messages in this thread | | | Date | Thu, 29 Sep 2022 22:27:19 +0100 | From | Al Viro <> | Subject | Re: [PATCH 3/4] proc: Point /proc/net at /proc/thread-self/net instead of /proc/self/net |
| |
On Thu, Sep 29, 2022 at 10:21:04PM +0100, Al Viro wrote: > On Thu, Sep 29, 2022 at 02:13:57PM -0700, Linus Torvalds wrote: > > On Thu, Sep 29, 2022 at 12:34 PM Al Viro <viro@zeniv.linux.org.uk> wrote: > > > > > > Apparmor takes mount+dentry and turns that into pathname. Then acts > > > upon the resulting string. *AFTER* the original had been resolved. > > > > Ok. So it would have to act like a bind mount. > > > > Which is probably not too bad. > > > > In fact, maybe it would be ok for this to act like a hardlink and just > > fill in the inode - not safe for a filesystem in general due to the > > whole rename loop issue, but for /proc it might be fine? > > _Which_ hardlink? > > Linus, where in dentry tree would you want it to be seen? Because > apparmor profile wants /proc/net/dev to land at /proc/<pid>/net/dev > and will fail with anything else. > > Do you really want multiple dentries with the same name in the same > parent, refering to different directory inodes with different contents? > > And that's different inodes with different contents - David's complaint > is precisely about seeing the same thing for all threads and apparmor > issue is with *NOT* seeing each of those things at the same location.
Put it another way:
David: when I'm opening /proc/net/whatever, I want its contents to match this thread's netns, not that of some other thread. dhclient+apparmor: whatever you get from /proc/net/dev, it would better be at /proc/<pid>/net/dev, no matter which thread you happen to be.
It's not that we want to see the same thing in several places; it's that we want to see *different* things in the same place. Opposite to what hardlinks or bindings would be about.
| |