From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933050AbdBVPrG (ORCPT ); Wed, 22 Feb 2017 10:47:06 -0500 Received: from vmicros1.altlinux.org ([194.107.17.57]:40368 "EHLO vmicros1.altlinux.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932643AbdBVPrA (ORCPT ); Wed, 22 Feb 2017 10:47:00 -0500 Date: Wed, 22 Feb 2017 18:37:19 +0300 From: "Dmitry V. Levin" To: Oleg Nesterov Cc: Alexey Gladkov , Linux Kernel Mailing List , "Kirill A. Shutemov" , Vasiliy Kulikov , Al Viro , "Eric W. Biederman" , Pavel Emelyanov Subject: Re: [PATCH] Add pidfs filesystem Message-ID: <20170222153718.GA9258@altlinux.org> References: <20170218225307.GA10345@comp-core-i7-2640m-0182e6.fortress> <20170221145746.GA31914@redhat.com> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=x-unknown; protocol="application/pgp-signature"; boundary="sdtB3X0nJg68CQEu" Content-Disposition: inline In-Reply-To: <20170221145746.GA31914@redhat.com> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org --sdtB3X0nJg68CQEu Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Tue, Feb 21, 2017 at 03:57:47PM +0100, Oleg Nesterov wrote: > On 02/18, Alexey Gladkov wrote: > > > > This patch allows to mount only the part of /proc related to pids > > without rest objects. Since this is an addon to /proc, flags applied to > > /proc have an effect on this pidfs filesystem. >=20 > I leave this to you and Eric, but imo it would be nice to avoid another > filesystem. >=20 > > Why not implement it as another flag to /proc ? > > > > The /proc flags is stored in the pid_namespace and are global for > > namespace. It means that if you add a flag to hide all except the pids, > > then it will act on all mounted instances of /proc. >=20 > But perhaps we can use mnt_flags? For example, lets abuse MNT_NODEV, see > the simple patch below. Not sure it is correct/complete, just to illustra= te > the idea. >=20 > With this patch you can mount proc with -onodev and it will only show > pids/self/thread_self: >=20 > # mkdir /tmp/D > # mount -t proc -o nodev none /tmp/D > # ls /tmp/D > 1 11 13 15 17 19 20 22 24 28 3 31 33 4 56 7 9 thread-self > 10 12 14 16 18 2 21 23 27 29 30 32 34 5 6 8 self > # cat /tmp/D/meminfo > cat: /tmp/D/meminfo: No such file or directory > # ls /tmp/D/irq > ls: cannot open directory /tmp/D/irq: No such file or directory >=20 > No? I like the idea of using mnt_flags to turn procfs into pidfs, thus avoiding yet another filesystem, but MNT_NODEV has a different meaning, namely "do not interpret character or block special devices on the file system". I've actually found a system nearby that already mounts /proc with nodev: # grep 'proc.*nodev' /proc/mounts proc /var/lib/vz/root/1002/proc proc rw,nosuid,nodev,noexec,relatime,gid=3D= 19,hidepid=3D2 0 0 proc /var/lib/vz/root/1003/proc proc rw,nosuid,nodev,noexec,relatime,gid=3D= 19,hidepid=3D2 0 0 proc /var/lib/vz/root/1004/proc proc rw,nosuid,nodev,noexec,relatime,gid=3D= 19,hidepid=3D2 0 0 proc /var/lib/vz/root/1005/proc proc rw,nosuid,nodev,noexec,relatime,gid=3D= 19,hidepid=3D2 0 0 --=20 ldv --sdtB3X0nJg68CQEu Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- iQIcBAEBCAAGBQJYrbAuAAoJEAVFT+BVnCUI4vEP/iOnUyKJO+kDhTEHvF5vxGKb LTObqt8nr7h3YqHNnD8+RR8/8QzJVBlJ8Dvcyqkrc1WAqnq+lJLGQIIPxuHZZL1R SBvFYtJuK7klVuF6rcb+4sR1z7+GDcpeLhdcvjB+IfZSd28FhRRBEe/SdyQ8uBwm SCQ59SM04VYWM2dEH+j0CJWX0B8JQx5it34WA6Kxf7lZ+D/mGuS4CtXqt0/yime/ Ra6WgfgmQUB15U7Hu+9amMoCn2L3FZfc7NgB/3r12cqgx+FjVVKPz6Wq6o9NIR+8 uG/MRva4PPB3nfQvV30dlJ4NCzMWWFnDVIVwDzdGZfgTgKLtu3j/Ik2PmE6aW5I9 ipMSSJWUyKPkEBrt8iCWJM3JNny5fK/yK17Aay2Oyqhv+7o2FEjZhv6OLDo0VCPf uxVmLYMreX9CaD4HKpDyemUVSwSh67UJ36PluPnDZAmEwgJON+Cq25WIz4svW8BL 5T1GikSlLzx4apVY6j/wJUxnyR7WQRnzMvZeqvGAtOL66ojfaqiEZDeCbPO+GMI0 TrLpEjl7/nzZhN6nyDbAp7yhMeMslBIffTKMevSwsFiREHAnWbdi8YzR1avKpjBc Hnll/qmEhiBB7SjpiTH+s1JV7C3L95YXxamDXIPNFJMcjJ7Yp+OgNTAkcOFHrG9S FHkUMnejS5JZqH5HjlEg =To75 -----END PGP SIGNATURE----- --sdtB3X0nJg68CQEu--