Received-SPF: pass (google.com: domain of linux-nfs-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Chuck Lever III <chuck.lever@oracle.com>
To:     Jeff Layton <jlayton@kernel.org>
CC:     Steve Dickson <steved@redhat.com>,
        Linux NFS Mailing List <linux-nfs@vger.kernel.org>,
        JianHong Yin <jiyin@redhat.com>
Subject: Re: [nfs-utils PATCH] Don't allow junction tests to trigger
 automounts
Thread-Topic: [nfs-utils PATCH] Don't allow junction tests to trigger
 automounts
Thread-Index: AQHZDwwkTu8unohjIEOexFngMQQ3nK5sAQ4A
Date:   Tue, 13 Dec 2022 16:25:56 +0000
Message-ID: <52DA8A58-FF23-4528-B094-D8849D1DE54A@oracle.com>
References: <20221213160104.198237-1-jlayton@kernel.org>
In-Reply-To: <20221213160104.198237-1-jlayton@kernel.org>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?2+1jG1yfnDnlWEq7xp0tkV5QAMzBOyn/xx8QSgVFaMuZwqz4Xlxslq63OpXK?=
 =?us-ascii?Q?91sHNv0UO/GiN8d4e6xFK3xsiIEiA4qTIKdbrKBy+nLhIil4TcU4wLGdu+bk?=
 =?us-ascii?Q?VsjJi/lBPW+BWm3JokoBHEfvZ8h79I9kOidM14/1b7jTqu15OBwRt/F8yIJr?=
 =?us-ascii?Q?RAIla/341fSEzteqz5Icy8oFjSp0uCak7dPYe2Hm1i5eFuQ8JR4K5VRgIg8o?=
 =?us-ascii?Q?80mpu2gyE8UIbfagvuWZ5IL0bXJIV8DQzhe+71jpPdRTSV/f6Ctng0QXS4nT?=
 =?us-ascii?Q?mwD9A6l5Undj3SJhVvxilRDm/51h2j2S4uOMHk7VPdDfq3EDgVcXCbc6RpeK?=
 =?us-ascii?Q?WkyQLFS6Lh0jy4NzgfTUBQjkqxSazpmlKMIhR7Y5cCEDor5TEYCev0mKix+d?=
 =?us-ascii?Q?wJBJp8PkWX+XhrO1kDMAM0vRm40+NaVgWHOLvTrFBihOK80H3aW0NgaRjqtu?=
 =?us-ascii?Q?txkXElTBrAptHhzO6ujJPjQKhAU/Zjs7hlSwG5mJptaTbzqATanDLMVF2n1B?=
 =?us-ascii?Q?4sgO+cwOK/ogCSgdqfvOV4Ebtz8ZVad5KANCaqlwVXTDwlU6igi1jhsxJFfx?=
 =?us-ascii?Q?QGSKtyJFeVj0uI1eJHEX14C2Yk8bGMsbcxY1Um2vUz5y7TzYebdq1bxeUdC5?=
 =?us-ascii?Q?HefhtNcsREIEaUjE/8cGqvTxCQHI71pfysxCSWsCmxI3rK6AoGrTbRF0HJkQ?=
 =?us-ascii?Q?QKhC5OhDY4g+4dqjrzPlgGB61hwhzwKhHgXUqJIiVL7GSNBlV3+KTj3V/JZ2?=
 =?us-ascii?Q?5DnjntSCkB/yQe7cchxL7eqFbLGUT+TH4WYGw2mybbHnFjNxcMse/SMycE9+?=
 =?us-ascii?Q?qKzNtkgD7J82gKwgcOzVzxUhLL5Ef+MH46SF9e0tJe8U8e0rmvvbo8h/+KF8?=
 =?us-ascii?Q?lkbb6AUBsQTz/GqMrBFAOLtVgguoVkROHg1fgUT5VSww7IElEYDp8nnBl5rx?=
 =?us-ascii?Q?ZhtNRUdtwZH2JJF5Vfmp1XQAVwM0BWcfYS+8cZCJu/7kUhW/XhP2u+irzDLj?=
 =?us-ascii?Q?FoodTnDcn/KExP6q5PhMWgBNaG/zkre/rHrTi+zPdW2zy0Z1zDps1KS64EYl?=
 =?us-ascii?Q?P6O1tlpu7jWF7cKGy1HoVwBT0FQGtlnYDBXK1WRAL5cnJWQcicpXsP4+2tqh?=
 =?us-ascii?Q?4PN5Bf57tiowL98KdpgNYlV8nuqQ8Pr5uRW7rXX6YvNAjyHR6HKdSWYl/2Cr?=
 =?us-ascii?Q?xTmt0YO0KyvZ7XQbgnE8QhsfxZv5gzc3uyrI/wiAlsGL0hEDYfgdwRRjLvwx?=
 =?us-ascii?Q?R6/KzBw/5Q0KY/ADiXKE6TfT+ft4Lu/T45UmA6ND7Uf/4voxDQpSj0hfDW/t?=
 =?us-ascii?Q?TZXl8kIRGb66Dqt1b4qnxWcA4SF1UHgd7u2UFq9yZvhexVI4tiIzfy8qX3nx?=
 =?us-ascii?Q?QxsyiHBvXi5MaNBK7AZhqBu2NkVsG7KiqntJcgdFXeDRQovZje4vXP4w+wSI?=
 =?us-ascii?Q?D01Vzy1kHcdgbDgYGE6Gm1xiEs18aTeLrI4ag+KyN9XputEnxYVvji8XULoJ?=
 =?us-ascii?Q?5WK9eGGscBPZ016oZoXKz/L+Ovo1HqcaZWb9I9KDzzHZxNarmZo9P9vA4nlT?=
 =?us-ascii?Q?1bWQC2qVNfUEaPr2KlWFIUgwPNwHsUdigVs9TeDYSovPBwlhZI0RWM1G/CtE?=
 =?us-ascii?Q?Nw=3D=3D?=
Content-Type: text/plain; charset="us-ascii"
Content-ID: <8020E515E350DB4281368E7EF5777B47@namprd10.prod.outlook.com>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: CH0PR10MB5131.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 8855d9b1-8fd9-445c-6318-08dadd26b691
X-MS-Exchange-CrossTenant-originalarrivaltime: 13 Dec 2022 16:25:56.7198
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: gWyGHD72o/Jy6oyOer2i0SONkrTiyuXCBsTvk0dE/URbedxDpQFh4Dhvz+/31ggQHNcuF5EsEzNCAs4P1VJ0/g==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BL3PR10MB6020
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.205,Aquarius:18.0.923,Hydra:6.0.545,FMLib:17.11.122.1
 definitions=2022-12-13_03,2022-12-13_01,2022-06-22_01
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 bulkscore=0 mlxlogscore=999 mlxscore=0
 adultscore=0 malwarescore=0 spamscore=0 phishscore=0 suspectscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2210170000
 definitions=main-2212130145
X-Proofpoint-GUID: B-XkKWpgAXS6f5nFfMUdeOgSIoi_7HtT
X-Proofpoint-ORIG-GUID: B-XkKWpgAXS6f5nFfMUdeOgSIoi_7HtT
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,
        RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_NONE autolearn=ham
        autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-nfs.vger.kernel.org>
X-Mailing-List: linux-nfs@vger.kernel.org


> On Dec 13, 2022, at 11:01 AM, Jeff Layton <jlayton@kernel.org> wrote:
>=20
> JianHong reported some strange behavior with automounts on an nfs server
> without an explicit pseudoroot. When clients issued a readdir in the
> pseudoroot, automounted directories that were not yet mounted would show
> up even if they weren't exported, though the clients wouldn't be able to
> do anything with them.
>=20
> The issue was that triggering the automount on a directory would cause
> the mountd upcall to time out, which would cause nfsd to include the
> automounted dentry in the readdir response. Eventually, the automount
> would work and report that it wasn't exported and subsequent attempts to
> access the dentry would (properly) fail.
>=20
> We never want mountd to trigger an automount. The kernel should do that
> if it wants to use it. Change the junction checks to do an O_PATH open
> and use fstatat with AT_NO_AUTOMOUNT.
>=20
> Cc: Chuck Lever <chuck.lever@oracle.com>
> Link: https://bugzilla.redhat.com/show_bug.cgi?id=3D2148353

And also https://bugzilla.kernel.org/show_bug.cgi?id=3D216777 ?


> Reported-by: JianHong Yin <jiyin@redhat.com>
> Signed-off-by: Jeff Layton <jlayton@kernel.org>
> ---
> support/junction/junction.c | 10 +++++-----
> 1 file changed, 5 insertions(+), 5 deletions(-)
>=20
> diff --git a/support/junction/junction.c b/support/junction/junction.c
> index 41cce261cb52..0628bb0ffffb 100644
> --- a/support/junction/junction.c
> +++ b/support/junction/junction.c
> @@ -63,7 +63,7 @@ junction_open_path(const char *pathname, int *fd)
> 	if (pathname =3D=3D NULL || fd =3D=3D NULL)
> 		return FEDFS_ERR_INVAL;
>=20
> -	tmp =3D open(pathname, O_DIRECTORY);
> +	tmp =3D open(pathname, O_PATH|O_DIRECTORY);
> 	if (tmp =3D=3D -1) {
> 		switch (errno) {
> 		case EPERM:
> @@ -93,7 +93,7 @@ junction_is_directory(int fd, const char *path)
> {
> 	struct stat stb;
>=20
> -	if (fstat(fd, &stb) =3D=3D -1) {
> +	if (fstatat(fd, "", &stb, AT_NO_AUTOMOUNT|AT_EMPTY_PATH) =3D=3D -1) {
> 		xlog(D_GENERAL, "%s: failed to stat %s: %m",
> 				__func__, path);
> 		return FEDFS_ERR_ACCESS;
> @@ -121,7 +121,7 @@ junction_is_sticky_bit_set(int fd, const char *path)
> {
> 	struct stat stb;
>=20
> -	if (fstat(fd, &stb) =3D=3D -1) {
> +	if (fstatat(fd, "", &stb, AT_NO_AUTOMOUNT|AT_EMPTY_PATH) =3D=3D -1) {
> 		xlog(D_GENERAL, "%s: failed to stat %s: %m",
> 				__func__, path);
> 		return FEDFS_ERR_ACCESS;
> @@ -155,7 +155,7 @@ junction_set_sticky_bit(int fd, const char *path)
> {
> 	struct stat stb;
>=20
> -	if (fstat(fd, &stb) =3D=3D -1) {
> +	if (fstatat(fd, "", &stb, AT_NO_AUTOMOUNT|AT_EMPTY_PATH) =3D=3D -1) {
> 		xlog(D_GENERAL, "%s: failed to stat %s: %m",
> 			__func__, path);
> 		return FEDFS_ERR_ACCESS;
> @@ -393,7 +393,7 @@ junction_get_mode(const char *pathname, mode_t *mode)
> 	if (retval !=3D FEDFS_OK)
> 		return retval;
>=20
> -	if (fstat(fd, &stb) =3D=3D -1) {
> +	if (fstatat(fd, "", &stb, AT_NO_AUTOMOUNT|AT_EMPTY_PATH) =3D=3D -1) {
> 		xlog(D_GENERAL, "%s: failed to stat %s: %m",
> 			__func__, pathname);
> 		(void)close(fd);
> --=20
> 2.38.1
>=20

--
Chuck Lever