From: David Howells <dhowells@redhat.com>
To: viro@zeniv.linux.org.uk
Cc: linux-security-module@vger.kernel.org,
Casey Schaufler <casey@schaufler-ca.com>,
James Morris <jamorris@linux.microsoft.com>,
Stephen Smalley <sds@tycho.nsa.gov>,
Miklos Szeredi <mszeredi@redhat.com>,
dhowells@redhat.com, torvalds@linux-foundation.org,
casey@schaufler-ca.com, sds@tycho.nsa.gov,
nicolas.dichtel@6wind.com, raven@themaw.net,
christian@brauner.io, jlayton@redhat.com, kzak@redhat.com,
mszeredi@redhat.com, linux-api@vger.kernel.org,
linux-fsdevel@vger.kernel.org,
linux-security-module@vger.kernel.org,
linux-kernel@vger.kernel.org
Subject: [PATCH 0/4] Mount notifications
Date: Fri, 24 Jul 2020 14:11:22 +0100 [thread overview]
Message-ID: <159559628247.2141315.2107013106060144287.stgit@warthog.procyon.org.uk> (raw)
Here's a set of patches to add notifications for mount topology events,
such as mounting, unmounting, mount expiry, mount reconfiguration.
An LSM hook is included to an LSM to rule on whether or not a mount watch
may be set on a particular path.
Why do we want mount notifications? Whilst /proc/mounts can be polled, it
only tells you that something changed in your namespace. To find out, you
have to trawl /proc/mounts or similar to work out what changed in the mount
object attributes and mount topology. I'm told that the proc file holding
the namespace_sem is a point of contention, especially as the process of
generating the text descriptions of the mounts/superblocks can be quite
involved.
The notification generated here directly indicates the mounts involved in
any particular event and gives an idea of what the change was.
This is combined with a new fsinfo() system call that allows, amongst other
things, the ability to retrieve in one go an { id, change_counter } tuple
from all the children of a specified mount, allowing buffer overruns to be
dealt with quickly.
This is of use to systemd to improve efficiency:
https://lore.kernel.org/linux-fsdevel/20200227151421.3u74ijhqt6ekbiss@ws.net.home/
And it's not just Red Hat that's potentially interested in this:
https://lore.kernel.org/linux-fsdevel/293c9bd3-f530-d75e-c353-ddeabac27cf6@6wind.com/
The kernel patches can also be found here:
https://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs.git/log/?h=notifications-pipe-core
David
---
David Howells (4):
watch_queue: Make watch_sizeof() check record size
watch_queue: Add security hooks to rule on setting mount watches
watch_queue: Implement mount topology and attribute change notifications
watch_queue: sample: Display mount tree change notifications
Documentation/watch_queue.rst | 12 +-
arch/alpha/kernel/syscalls/syscall.tbl | 1 +
arch/arm/tools/syscall.tbl | 1 +
arch/arm64/include/asm/unistd32.h | 2 +
arch/ia64/kernel/syscalls/syscall.tbl | 1 +
arch/m68k/kernel/syscalls/syscall.tbl | 1 +
arch/microblaze/kernel/syscalls/syscall.tbl | 1 +
arch/mips/kernel/syscalls/syscall_n32.tbl | 1 +
arch/mips/kernel/syscalls/syscall_n64.tbl | 1 +
arch/mips/kernel/syscalls/syscall_o32.tbl | 1 +
arch/parisc/kernel/syscalls/syscall.tbl | 1 +
arch/powerpc/kernel/syscalls/syscall.tbl | 1 +
arch/s390/kernel/syscalls/syscall.tbl | 1 +
arch/sh/kernel/syscalls/syscall.tbl | 1 +
arch/sparc/kernel/syscalls/syscall.tbl | 1 +
arch/x86/entry/syscalls/syscall_32.tbl | 1 +
arch/x86/entry/syscalls/syscall_64.tbl | 1 +
arch/xtensa/kernel/syscalls/syscall.tbl | 1 +
fs/Kconfig | 9 +
fs/Makefile | 1 +
fs/mount.h | 21 ++
fs/mount_notify.c | 228 ++++++++++++++++++++
fs/namespace.c | 22 ++
include/linux/dcache.h | 1 +
include/linux/lsm_hook_defs.h | 3 +
include/linux/lsm_hooks.h | 6 +
include/linux/security.h | 8 +
include/linux/syscalls.h | 2 +
include/uapi/asm-generic/unistd.h | 4 +-
include/uapi/linux/watch_queue.h | 36 +++-
kernel/sys_ni.c | 3 +
samples/watch_queue/watch_test.c | 44 +++-
security/security.c | 7 +
33 files changed, 421 insertions(+), 4 deletions(-)
create mode 100644 fs/mount_notify.c
next reply other threads:[~2020-07-24 13:11 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-07-24 13:11 David Howells [this message]
2020-07-24 13:11 ` [PATCH 1/4] watch_queue: Make watch_sizeof() check record size David Howells
2020-07-24 13:11 ` [PATCH 2/4] watch_queue: Add security hooks to rule on setting mount watches David Howells
2020-07-24 13:11 ` [PATCH 3/4] watch_queue: Implement mount topology and attribute change notifications David Howells
2020-07-24 19:14 ` Linus Torvalds
2020-07-24 19:59 ` David Howells
2020-07-24 20:25 ` Linus Torvalds
2020-07-24 20:45 ` David Howells
2020-07-24 13:11 ` [PATCH 4/4] watch_queue: sample: Display mount tree " David Howells
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=159559628247.2141315.2107013106060144287.stgit@warthog.procyon.org.uk \
--to=dhowells@redhat.com \
--cc=casey@schaufler-ca.com \
--cc=christian@brauner.io \
--cc=jamorris@linux.microsoft.com \
--cc=jlayton@redhat.com \
--cc=kzak@redhat.com \
--cc=linux-api@vger.kernel.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=mszeredi@redhat.com \
--cc=nicolas.dichtel@6wind.com \
--cc=raven@themaw.net \
--cc=sds@tycho.nsa.gov \
--cc=torvalds@linux-foundation.org \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).