Received: by 2002:a05:7412:2a8c:b0:e2:908c:2ebd with SMTP id u12csp1754317rdh; Tue, 26 Sep 2023 02:29:59 -0700 (PDT) X-Google-Smtp-Source: AGHT+IHuClWVLWK9vjcti++9SdsuSSSX9LWL/pY3sOL2nEWSMEtElExnq1tM/Oga5hp+UXzy5xEw X-Received: by 2002:a05:6a20:4421:b0:14e:429e:b0e3 with SMTP id ce33-20020a056a20442100b0014e429eb0e3mr8867990pzb.52.1695720599098; Tue, 26 Sep 2023 02:29:59 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1695720599; cv=none; d=google.com; s=arc-20160816; b=gR1qtwM7mDAjlB2g5fbVfpSBqHmoPVwBkvmBpwvr9d41Oo6wVslLKBFBjyXkY44+zk fNfAcFWM3MGVy0XGfqq8EU4oLcNzHWB0XyNgXUMU3GFD7cHmHeccEiNN/VJZ6RJIC9VZ HF7xFIbgZvdzod18j7HgVOVnH8W/LZEvU6uh/CqKj/WGImuwNAmuROrvRhbQiIYRHdVg ZjMu4vImeccguXSuXP40sdYIODkqtI9gBUhxLv982/ECUL0DpHltAL47bt2j9iMoj/ED +RTXAuhOr4c51x7m+Bdds4BhFP4fYGA0y+JIkhhRQnjrUH2WoMPs/DZC9EOvMNXN7sA2 Spqw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:cc:to:subject :message-id:date:from:in-reply-to:references:mime-version :dkim-signature; bh=bsSkGdr3lR16TyaxQNyV8wP3RWSIxpxumK3mahZfc/s=; fh=Anzs+nQHB3PsqLQPI9Ht3Trkk8lJLBlJ8+hgqMW47y8=; b=Nt6VreARXHG5FdNwFfMh048tNHJhhq92GvcUtH8teR/8+WXqun7Pw+GA6dkwz3EgVd rryjZIksaNMF3z/gVNHVgrMJw+taWLmX2+rZ7n+nevOzTLw1IVtiSoOMgGeu5gDRjjVP aDqj5ubdczEVl7oTw546hznDj0zWhxX3ZFM91BQJamcssdorXJ5V1vuXXIKA2gz0TReF ek4PIiVQ+IYVCFIZBxf9LBenqEL0uqQfJ/ddcU+TgelyG/yOrqvVPU2cXGiss+Ppku1w AchmnZBCKXmNugHoma/jJWjnNfTxKcDwgEqXxOC+gyF/yG20gNeQLNyKR16MU/R7sUh4 mqpA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@ionos.com header.s=google header.b=YN2dmb6I; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.33 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=ionos.com Return-Path: Received: from lipwig.vger.email (lipwig.vger.email. [23.128.96.33]) by mx.google.com with ESMTPS id e1-20020a17090301c100b001c3976e22f5si8444040plh.515.2023.09.26.02.29.56 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 26 Sep 2023 02:29:59 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.33 as permitted sender) client-ip=23.128.96.33; Authentication-Results: mx.google.com; dkim=pass header.i=@ionos.com header.s=google header.b=YN2dmb6I; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.33 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=ionos.com Received: from out1.vger.email (depot.vger.email [IPv6:2620:137:e000::3:0]) by lipwig.vger.email (Postfix) with ESMTP id EEFE181DDD05; Mon, 25 Sep 2023 23:09:57 -0700 (PDT) X-Virus-Status: Clean X-Virus-Scanned: clamav-milter 0.103.10 at lipwig.vger.email Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233733AbjIZGJs (ORCPT + 99 others); Tue, 26 Sep 2023 02:09:48 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40426 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233739AbjIZGJj (ORCPT ); Tue, 26 Sep 2023 02:09:39 -0400 Received: from mail-lj1-x232.google.com (mail-lj1-x232.google.com [IPv6:2a00:1450:4864:20::232]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 05E88F3 for ; Mon, 25 Sep 2023 23:09:33 -0700 (PDT) Received: by mail-lj1-x232.google.com with SMTP id 38308e7fff4ca-2c12ae20a5cso128932321fa.2 for ; Mon, 25 Sep 2023 23:09:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ionos.com; s=google; t=1695708571; x=1696313371; darn=vger.kernel.org; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:from:to:cc:subject:date :message-id:reply-to; bh=bsSkGdr3lR16TyaxQNyV8wP3RWSIxpxumK3mahZfc/s=; b=YN2dmb6IE+DxPOTkI333RIN8ATkayptRV/QvcUkUEoddmeZG3+9819pPc4g632L4Ck /3XsRfdpdoV8xtx2vNfQQyrH25Vu8LEXzHCNFvL7BBJJyWZfzeGkcnND8jtNpTc+cDw8 Q184xDXaThaQvXnZoirp5WXi9PWk5KcoA9wZpBta1p4GkGLay3P058GPI7JglgG9pg4R 45IV47LXNRXXdXxDYc1RKjW7Pb5S/OjDvSvNoZln+ek+f/P2w2FXNjhVVgOj5mCjJq+1 XnM78E+PQxZ+VGjeWQXXh92nRfvqY+tWrzRbLQ2mdCtvIem+Jt5w7NkA4EJS1Q8wBjDS yeuw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1695708571; x=1696313371; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=bsSkGdr3lR16TyaxQNyV8wP3RWSIxpxumK3mahZfc/s=; b=qfj8Srl5XfAyMMnwmBYAvoP265gy4bIIboDpctFZfodHlf2uVAEE7jSoOw1BIVWNFh 8FulTG7rlXVpN6jBTa+q+imWaVk2FuYOVb9uv24PWv09T1tNS5NS+8O29JlsjBHFI3XS Ewsec6mUQzSXwh5k1F8zv50Q6QQPR6o30iT+b9r5MXVdW1Zhf6z2GKFfJcQOsWCiLsYV dOZOrEwmD+gLZFHI0tAtVV6vzUsZ1njmfUBxOAKiQ4a0wh1c0bXu12uMbiePm1OOvwBp RdfNgORANPUtQY7HUKfI+mP94xptJqIPkWHPZuSTaO2dVUbOMBXvcUww8u7AY4PmEWid ZTdQ== X-Gm-Message-State: AOJu0Yx/cosYsYKqwOPn2SHYog7QMU+hPLfMYFT3KIGspgjmayPX35Bb x3VDetDt1IRSafJPoQcvVKH2w8MfYLD2zExDs4i3/w== X-Received: by 2002:a2e:9b4b:0:b0:2bd:d34:f892 with SMTP id o11-20020a2e9b4b000000b002bd0d34f892mr7816213ljj.3.1695708571258; Mon, 25 Sep 2023 23:09:31 -0700 (PDT) MIME-Version: 1.0 References: <20230922062558.1739642-1-max.kellermann@ionos.com> In-Reply-To: From: Max Kellermann Date: Tue, 26 Sep 2023 08:09:20 +0200 Message-ID: Subject: Re: [PATCH 1/2] fs/ceph/debugfs: make all files world-readable To: Xiubo Li Cc: Ilya Dryomov , Jeff Layton , ceph-devel@vger.kernel.org, linux-kernel@vger.kernel.org Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Spam-Status: No, score=-0.9 required=5.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, SPF_HELO_NONE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lipwig.vger.email Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (lipwig.vger.email [0.0.0.0]); Mon, 25 Sep 2023 23:09:58 -0700 (PDT) On Mon, Sep 25, 2023 at 7:18=E2=80=AFAM Xiubo Li wrote: > I am not sure whether will this make sense. Because the 'debug' under > '/sys/kernel/' is also only accessible by privileged process. Not exactly correct. It is by default accessible to processes who have CAP_DAC_OVERRIDE and additionally it is accessible to (unprivileged) processes running as uid=3D0 (those two traits usually overlap). But we don't want to run kernel-exporter as uid=3D0 and neither do we want to give it CAP_DAC_OVERRIDE; both would be too much, it would affect much more than just (read) access to debugfs. Instead, we mount debugfs with "gid=3DX,mode=3D0710". That way, we can give (unprivileged) processes which are member of a certain group access to debugfs, and we put our kernel-exporter process in that group. We can use these mount options to change debugfs defaults, but if a debugfs implementor (such as cephfs) decides to override these global debugfs settings by passing stricter file permissions, we can't easily override that. And that is what my patch is about: restore the ability to override debugfs permissions with a mount option, as debugfs was designed. Max