Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755251AbbEZQP1 (ORCPT ); Tue, 26 May 2015 12:15:27 -0400 Received: from mail-ob0-f175.google.com ([209.85.214.175]:33991 "EHLO mail-ob0-f175.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753458AbbEZQPX (ORCPT ); Tue, 26 May 2015 12:15:23 -0400 Date: Tue, 26 May 2015 11:14:51 -0500 From: Seth Forshee To: Miklos Szeredi Cc: "Eric W. Biederman" , alexey@kurnosov.spb.ru, Andy Lutomirski , Serge Hallyn , fuse-devel , Linux-Fsdevel , Kernel Mailing List Subject: Re: [fuse-devel] fuse_get_context() and namespaces Message-ID: <20150526161451.GB10248@ubuntu-hedt> References: <20150331011423.GC13083@unsen.q53.spb.ru> <20150401155515.GA2994@unsen.q53.spb.ru> <20150502155623.GD13083@unsen.q53.spb.ru> <20150522144702.GA126334@ubuntu-hedt> <87iobk4id8.fsf@x220.int.ebiederm.org> <20150522185932.GC126334@ubuntu-hedt> <20150526152138.GB4531@tucsk.suse.de> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20150526152138.GB4531@tucsk.suse.de> User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 5655 Lines: 128 On Tue, May 26, 2015 at 05:21:38PM +0200, Miklos Szeredi wrote: > On Fri, May 22, 2015 at 01:59:32PM -0500, Seth Forshee wrote: > > On Fri, May 22, 2015 at 12:44:35PM -0500, Eric W. Biederman wrote: > > > Seth Forshee writes: > > > > > > > On Fri, May 22, 2015 at 04:23:55PM +0200, Miklos Szeredi wrote: > > > >> On Sat, May 2, 2015 at 5:56 PM, wrote: > > > >> > > > > >> > 3.10.0-229 form Scientific Linux and native 4.0.1-1 (from elrepo). > > > >> > SL 7.1 on the host and SL 6.6 on the LXC guest. At least in 3.10 > > > >> > the 499dcf2024092e5cce41d05599a5b51d1f92031a is present. > > > >> > Steps to reproduce: > > > >> > > > > >> > On first console: > > > >> > [root@sl7test ~]# lxc-start -n test-2 /bin/su - > > > >> > [root@test-2 ~]# diff -u hello.py /usr/share/doc/fuse-python-0.2.1/example/hello.py > > > >> > --- hello.py 2015-05-02 11:12:13.963093580 -0400 > > > >> > +++ /usr/share/doc/fuse-python-0.2.1/example/hello.py 2010-04-14 18:29:21.000000000 -0400 > > > >> > @@ -41,8 +41,6 @@ > > > >> > class HelloFS(Fuse): > > > >> > > > > >> > def getattr(self, path): > > > >> > - dic = Fuse.GetContext(self) > > > >> > - print dic > > > >> > st = MyStat() > > > >> > if path == '/': > > > >> > st.st_mode = stat.S_IFDIR | 0755 > > > >> > [root@test-2 ~]# python hello.py -f /mnt/ > > > >> > > > > >> > On second console: > > > >> > [root@test-2 ~]# echo $$ > > > >> > 41 > > > >> > [root@test-2 ~]# ls /mnt/ > > > >> > hello > > > >> > > > > >> > Output of first console: > > > >> > {'gid': 0, 'pid': 12083, 'uid': 0} > > > >> > > > >> Thanks. > > > >> > > > >> Digging in mailbox... There was a thread last year about adding > > > >> support for running fuse daemon in a container: > > > >> > > > >> http://thread.gmane.org/gmane.linux.kernel/1811658 > > > >> > > > >> Not sure what happened, but no updated patches have been posted or > > > >> maybe I just missed them. > > > > > > > > I haven't sent updated patches in a while. I still intend to, but I > > > > shifted focus to first getting general support for mounts from user > > > > namespaces into the vfs (which will give a clearer direction for some of > > > > the concerns raised about the fuse patches). > > > > > > > > All of this code is available in the userns-mounts branch of > > > > git://kernel.ubuntu.com/sforshee/linux.git, and I don't think the fuse > > > > patches actually depend on any of the stuff that precedes them. I'm > > > > planning to start submitting some of the earlier patches from that > > > > branch soon, and eventually get back to resubmitting the fuse patches. > > > > > > > > This is about pid namespaces though, and the fuse pid namespace patch > > > > from that series (see below) should be more or less independent of the > > > > rest of the patches. Potentially that could be merged separately from > > > > the user namespae stuff. > > > > > > [snip] > > > > > > > @@ -2076,7 +2077,15 @@ static int convert_fuse_file_lock(const struct fuse_file_lock *ffl, > > > > > > > > fl->fl_start = ffl->start; > > > > fl->fl_end = ffl->end; > > > > - fl->fl_pid = ffl->pid; > > > > + > > > > + /* > > > > + * Convert pid into the connection's pid namespace. If the > > > > + * pid does not map into the namespace fl_pid will get set > > > > + * to 0. > > > > + */ > > > > + rcu_read_lock(); > > > > + fl->fl_pid = pid_vnr(find_pid_ns(ffl->pid, fc->pid_ns)); > > > > + rcu_read_unlock(); > > > > > > Scratches my head. This looks wrong. > > > > > > I would have expected pid_nr_ns. Am I missing something reading this > > > patch quickly? > > > > Here we're in the context of a F_GETLK operation. We've requested the > > lock information from the fuse process, and ffl->pid is the pid number > > in that process's pid namespace so it needs to be translated into > > current's namespace. First we have to look up the struct pid, then > > pid_vnr is just a wrapper for pid_nr_ns in the current pid namespace: > > > > pid_t pid_vnr(struct pid *pid) > > { > > return pid_nr_ns(pid, task_active_pid_ns(current)); > > } > > > > Oh, but the comment is wrong, so maybe that's what confused you. > > s/connection/caller/ there and it should make more sense. > > Attaching updated patch against fuse.git for-next. Check namespace in both > device read and write. Check them at the start (doesn't matter if requests are > stuck in the queue, if server isn't playing by the rules, then all is lost > anyway). > > One thing: we return error if current tgid isn't valid in server's namespace. > That's looks good. However we silently succeed and set in.h.pid to zero if > current pid isn't representable in the server's namespace. That doesn't sound > quite right. > > Again the question is, does it make sense to allow access by tasks whose pid > isn't representable in the server. If not, then they should be rejected instead > of succeeding with an invalid PID, right? All of the fuse filesystems I looked at didn't pay any attention at all to in.h.pid, and I don't see any reason to make them unusable by processes outside the pid namespace. Filesystems which do care about pids can reject requests when in.h.pid is 0 if they wish. Of course it's a different matter if there are existing filesystems which could be broken by in.h.pid == 0. Seth -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/