Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Thu, 29 Sep 2022 22:21:04 +0100
From:   Al Viro <viro@zeniv.linux.org.uk>
To:     Linus Torvalds <torvalds@linux-foundation.org>
Cc:     David Laight <David.Laight@aculab.com>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        "netdev@vger.kernel.org" <netdev@vger.kernel.org>,
        "Eric W. Biederman" <ebiederm@xmission.com>,
        "Serge E. Hallyn" <serge@hallyn.com>
Subject: Re: [PATCH 3/4] proc: Point /proc/net at /proc/thread-self/net
 instead of /proc/self/net
Message-ID: <YzYMQDTAYCCax0WZ@ZenIV>
References: <dacfc18d6667421d97127451eafe4f29@AcuMS.aculab.com>
 <CAHk-=wgS_XpzEL140ovgLwGv6yXvV7Pu9nKJbCuo5pnRfcEbvg@mail.gmail.com>
 <YzXo/DIwq65ypHNH@ZenIV>
 <YzXrOFpPStEwZH/O@ZenIV>
 <CAHk-=wjLgM06JrS21W4g2VquqCLab+qu_My67cv6xuH7NhgHpw@mail.gmail.com>
 <YzXzXNAgcJeJ3M0d@ZenIV>
 <CAHk-=wgiBBXeY9ioZ8GtsxAcd42c265zwN7bYVY=cir01OimzA@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <CAHk-=wgiBBXeY9ioZ8GtsxAcd42c265zwN7bYVY=cir01OimzA@mail.gmail.com>
Sender: Al Viro <viro@ftp.linux.org.uk>
Precedence: bulk

On Thu, Sep 29, 2022 at 02:13:57PM -0700, Linus Torvalds wrote:
> On Thu, Sep 29, 2022 at 12:34 PM Al Viro <viro@zeniv.linux.org.uk> wrote:
> >
> > Apparmor takes mount+dentry and turns that into pathname.  Then acts
> > upon the resulting string.  *AFTER* the original had been resolved.
> 
> Ok. So it would have to act like a bind mount.
> 
> Which is probably not too bad.
> 
> In fact, maybe it would be ok for this to act like a hardlink and just
> fill in the inode - not safe for a filesystem in general due to the
> whole rename loop issue, but for /proc it might be fine?

_Which_ hardlink?

Linus, where in dentry tree would you want it to be seen?  Because
apparmor profile wants /proc/net/dev to land at /proc/<pid>/net/dev
and will fail with anything else.

Do you really want multiple dentries with the same name in the same
parent, refering to different directory inodes with different contents?

And that's different inodes with different contents - David's complaint
is precisely about seeing the same thing for all threads and apparmor
issue is with *NOT* seeing each of those things at the same location.