Greetings!
Preface
-------
This patch set can be applied over:
git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace.git d35bec8a5788
Overview
--------
Directories and files can be created and deleted by dynamically loaded modules.
Not all of these files are virtualized and safe inside the container.
However, subset=pid is not enough because many containers wants to have
/proc/meminfo, /proc/cpuinfo, etc. We need a way to limit the visibility of
files per procfs mountpoint.
Introduced changes
------------------
Allow to specify the names of files and directories in the subset= parameter and
thereby make a whitelist of top-level permitted names.
Alexey Gladkov (2):
proc: use subset option to hide some top-level procfs entries
docs: proc: update documentation about subset= parameter
Documentation/filesystems/proc.rst | 6 +++
fs/proc/base.c | 15 +++++-
fs/proc/generic.c | 75 +++++++++++++++++++++------
fs/proc/inode.c | 18 ++++---
fs/proc/internal.h | 12 +++++
fs/proc/root.c | 81 ++++++++++++++++++++++++------
include/linux/proc_fs.h | 11 ++--
7 files changed, 175 insertions(+), 43 deletions(-)
--
2.25.4
Signed-off-by: Alexey Gladkov <[email protected]>
---
Documentation/filesystems/proc.rst | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/Documentation/filesystems/proc.rst b/Documentation/filesystems/proc.rst
index e2ecf248feb5..68acd335cd8c 100644
--- a/Documentation/filesystems/proc.rst
+++ b/Documentation/filesystems/proc.rst
@@ -2177,6 +2177,12 @@ information about processes information, just add identd to this group.
subset=pid hides all top level files and directories in the procfs that
are not related to tasks.
+subset=NAME[:NAME...] allows to give access to the listed file names or
+directories located at the top level of procfs. These files and directories
+do not have to be present at the time of mounting procfs. They may appear later
+when the kernel module that creates them loads. The list of names can be
+combined with subst=pid.
+
5 Filesystem behavior
----------------------------
--
2.25.4