lkml.org 
[lkml]   [2021]   [Aug]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH] proc: prevent mount proc on same mountpoint in one pid namespace
    On Sat, Aug 21, 2021 at 01:31:05AM -0700, cgel.zte@gmail.com wrote:
    > From: Yang Yang <yang.yang29@zte.com.cn>
    >
    > Patch "proc: allow to mount many instances of proc in one pid namespace"
    > aims to mount many instances of proc on different mountpoint, see
    > tools/testing/selftests/proc/proc-multiple-procfs.c.
    >
    > But there is a side-effects, user can mount many instances of proc on
    > the same mountpoint in one pid namespace, which is not allowed before.
    > This duplicate mount makes no sense but wastes memory and CPU, and user
    > may be confused why kernel allows it.
    >
    > The logic of this patch is: when try to mount proc on /mnt, check if
    > there is a proc instance mount on /mnt in the same pid namespace. If
    > answer is yes, return -EBUSY.
    >
    > Since this check can't be done in proc_get_tree(), which call
    > get_tree_nodev() and will create new super_block unconditionally.
    > And other nodev fs may faces the same case, so add a new hook in
    > fs_context_operations.

    NAK. As attack prevention it's worthless (you can just bind-mount
    a tmpfs directory between them). Besides, filesystem does *not*
    get to decide where it would be mounted. Especially since it couldn't
    rely upon that, anyway, what with mount --bind possible *after* it had
    been initially mounted.

    \
     
     \ /
      Last update: 2021-08-21 16:11    [W:3.432 / U:0.996 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site