From: Seth Forshee <seth.forshee@canonical.com>
To: Miklos Szeredi <miklos@szeredi.hu>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>,
alexey@kurnosov.spb.ru, Andy Lutomirski <luto@amacapital.net>,
Serge Hallyn <serge.hallyn@ubuntu.com>,
fuse-devel <fuse-devel@lists.sourceforge.net>,
Linux-Fsdevel <linux-fsdevel@vger.kernel.org>,
Kernel Mailing List <linux-kernel@vger.kernel.org>
Subject: Re: [fuse-devel] fuse_get_context() and namespaces
Date: Tue, 26 May 2015 11:14:51 -0500 [thread overview]
Message-ID: <20150526161451.GB10248@ubuntu-hedt> (raw)
In-Reply-To: <20150526152138.GB4531@tucsk.suse.de>
On Tue, May 26, 2015 at 05:21:38PM +0200, Miklos Szeredi wrote:
> On Fri, May 22, 2015 at 01:59:32PM -0500, Seth Forshee wrote:
> > On Fri, May 22, 2015 at 12:44:35PM -0500, Eric W. Biederman wrote:
> > > Seth Forshee <seth.forshee@canonical.com> writes:
> > >
> > > > On Fri, May 22, 2015 at 04:23:55PM +0200, Miklos Szeredi wrote:
> > > >> On Sat, May 2, 2015 at 5:56 PM, <alexey@kurnosov.spb.ru> wrote:
> > > >> >
> > > >> > 3.10.0-229 form Scientific Linux and native 4.0.1-1 (from elrepo).
> > > >> > SL 7.1 on the host and SL 6.6 on the LXC guest. At least in 3.10
> > > >> > the 499dcf2024092e5cce41d05599a5b51d1f92031a is present.
> > > >> > Steps to reproduce:
> > > >> >
> > > >> > On first console:
> > > >> > [root@sl7test ~]# lxc-start -n test-2 /bin/su -
> > > >> > [root@test-2 ~]# diff -u hello.py /usr/share/doc/fuse-python-0.2.1/example/hello.py
> > > >> > --- hello.py 2015-05-02 11:12:13.963093580 -0400
> > > >> > +++ /usr/share/doc/fuse-python-0.2.1/example/hello.py 2010-04-14 18:29:21.000000000 -0400
> > > >> > @@ -41,8 +41,6 @@
> > > >> > class HelloFS(Fuse):
> > > >> >
> > > >> > def getattr(self, path):
> > > >> > - dic = Fuse.GetContext(self)
> > > >> > - print dic
> > > >> > st = MyStat()
> > > >> > if path == '/':
> > > >> > st.st_mode = stat.S_IFDIR | 0755
> > > >> > [root@test-2 ~]# python hello.py -f /mnt/
> > > >> >
> > > >> > On second console:
> > > >> > [root@test-2 ~]# echo $$
> > > >> > 41
> > > >> > [root@test-2 ~]# ls /mnt/
> > > >> > hello
> > > >> >
> > > >> > Output of first console:
> > > >> > {'gid': 0, 'pid': 12083, 'uid': 0}
> > > >>
> > > >> Thanks.
> > > >>
> > > >> Digging in mailbox... There was a thread last year about adding
> > > >> support for running fuse daemon in a container:
> > > >>
> > > >> http://thread.gmane.org/gmane.linux.kernel/1811658
> > > >>
> > > >> Not sure what happened, but no updated patches have been posted or
> > > >> maybe I just missed them.
> > > >
> > > > I haven't sent updated patches in a while. I still intend to, but I
> > > > shifted focus to first getting general support for mounts from user
> > > > namespaces into the vfs (which will give a clearer direction for some of
> > > > the concerns raised about the fuse patches).
> > > >
> > > > All of this code is available in the userns-mounts branch of
> > > > git://kernel.ubuntu.com/sforshee/linux.git, and I don't think the fuse
> > > > patches actually depend on any of the stuff that precedes them. I'm
> > > > planning to start submitting some of the earlier patches from that
> > > > branch soon, and eventually get back to resubmitting the fuse patches.
> > > >
> > > > This is about pid namespaces though, and the fuse pid namespace patch
> > > > from that series (see below) should be more or less independent of the
> > > > rest of the patches. Potentially that could be merged separately from
> > > > the user namespae stuff.
> > >
> > > [snip]
> > >
> > > > @@ -2076,7 +2077,15 @@ static int convert_fuse_file_lock(const struct fuse_file_lock *ffl,
> > > >
> > > > fl->fl_start = ffl->start;
> > > > fl->fl_end = ffl->end;
> > > > - fl->fl_pid = ffl->pid;
> > > > +
> > > > + /*
> > > > + * Convert pid into the connection's pid namespace. If the
> > > > + * pid does not map into the namespace fl_pid will get set
> > > > + * to 0.
> > > > + */
> > > > + rcu_read_lock();
> > > > + fl->fl_pid = pid_vnr(find_pid_ns(ffl->pid, fc->pid_ns));
> > > > + rcu_read_unlock();
> > >
> > > Scratches my head. This looks wrong.
> > >
> > > I would have expected pid_nr_ns. Am I missing something reading this
> > > patch quickly?
> >
> > Here we're in the context of a F_GETLK operation. We've requested the
> > lock information from the fuse process, and ffl->pid is the pid number
> > in that process's pid namespace so it needs to be translated into
> > current's namespace. First we have to look up the struct pid, then
> > pid_vnr is just a wrapper for pid_nr_ns in the current pid namespace:
> >
> > pid_t pid_vnr(struct pid *pid)
> > {
> > return pid_nr_ns(pid, task_active_pid_ns(current));
> > }
> >
> > Oh, but the comment is wrong, so maybe that's what confused you.
> > s/connection/caller/ there and it should make more sense.
>
> Attaching updated patch against fuse.git for-next. Check namespace in both
> device read and write. Check them at the start (doesn't matter if requests are
> stuck in the queue, if server isn't playing by the rules, then all is lost
> anyway).
>
> One thing: we return error if current tgid isn't valid in server's namespace.
> That's looks good. However we silently succeed and set in.h.pid to zero if
> current pid isn't representable in the server's namespace. That doesn't sound
> quite right.
>
> Again the question is, does it make sense to allow access by tasks whose pid
> isn't representable in the server. If not, then they should be rejected instead
> of succeeding with an invalid PID, right?
All of the fuse filesystems I looked at didn't pay any attention at all
to in.h.pid, and I don't see any reason to make them unusable by
processes outside the pid namespace. Filesystems which do care about
pids can reject requests when in.h.pid is 0 if they wish.
Of course it's a different matter if there are existing filesystems
which could be broken by in.h.pid == 0.
Seth
next prev parent reply other threads:[~2015-05-26 16:15 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20150331011423.GC13083@unsen.q53.spb.ru>
[not found] ` <20150401155515.GA2994@unsen.q53.spb.ru>
[not found] ` <CAJfpegvYrJBmnfqk0zO6EWbaiqxuN4anx6Fpw07_P5+s0P1RVw@mail.gmail.com>
[not found] ` <20150502155623.GD13083@unsen.q53.spb.ru>
2015-05-22 14:23 ` [fuse-devel] fuse_get_context() and namespaces Miklos Szeredi
2015-05-22 14:47 ` Seth Forshee
2015-05-22 17:44 ` Eric W. Biederman
2015-05-22 18:59 ` Seth Forshee
2015-05-26 15:21 ` Miklos Szeredi
2015-05-26 16:14 ` Seth Forshee [this message]
2015-05-27 3:31 ` Eric W. Biederman
2015-05-27 12:55 ` Seth Forshee
2015-06-01 13:07 ` Miklos Szeredi
2015-06-03 14:03 ` Seth Forshee
2015-05-22 17:32 ` Eric W. Biederman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20150526161451.GB10248@ubuntu-hedt \
--to=seth.forshee@canonical.com \
--cc=alexey@kurnosov.spb.ru \
--cc=ebiederm@xmission.com \
--cc=fuse-devel@lists.sourceforge.net \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=luto@amacapital.net \
--cc=miklos@szeredi.hu \
--cc=serge.hallyn@ubuntu.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).