From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754629AbdBVL5C (ORCPT ); Wed, 22 Feb 2017 06:57:02 -0500 Received: from mozilla-myt-1.haze.yandex.net ([77.88.23.115]:58574 "EHLO mail.unsafe.ru" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752397AbdBVL4z (ORCPT ); Wed, 22 Feb 2017 06:56:55 -0500 Date: Wed, 22 Feb 2017 13:04:30 +0100 From: Alexey Gladkov To: Pavel Emelyanov Cc: Oleg Nesterov , Linux Kernel Mailing List , "Kirill A. Shutemov" , Vasiliy Kulikov , Al Viro , "Eric W. Biederman" , "Dmitry V. Levin" Subject: Re: [PATCH] Add pidfs filesystem Message-ID: <20170222120430.GF3279@comp-core-i7-2640m-0182e6.fortress> References: <20170218225307.GA10345@comp-core-i7-2640m-0182e6.fortress> <20170221145746.GA31914@redhat.com> <58AD4081.9050609@virtuozzo.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <58AD4081.9050609@virtuozzo.com> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Wed, Feb 22, 2017 at 10:40:49AM +0300, Pavel Emelyanov wrote: > On 02/21/2017 05:57 PM, Oleg Nesterov wrote: > > On 02/18, Alexey Gladkov wrote: > >> > >> This patch allows to mount only the part of /proc related to pids > >> without rest objects. Since this is an addon to /proc, flags applied to > >> /proc have an effect on this pidfs filesystem. > > > > I leave this to you and Eric, but imo it would be nice to avoid another > > filesystem. > > > >> Why not implement it as another flag to /proc ? > >> > >> The /proc flags is stored in the pid_namespace and are global for > >> namespace. It means that if you add a flag to hide all except the pids, > >> then it will act on all mounted instances of /proc. > > > > But perhaps we can use mnt_flags? For example, lets abuse MNT_NODEV, see > > the simple patch below. Not sure it is correct/complete, just to illustrate > > the idea. > > > > With this patch you can mount proc with -onodev and it will only show > > pids/self/thread_self: > > > > # mkdir /tmp/D > > # mount -t proc -o nodev none /tmp/D > > # ls /tmp/D > > 1 11 13 15 17 19 20 22 24 28 3 31 33 4 56 7 9 thread-self > > 10 12 14 16 18 2 21 23 27 29 30 32 34 5 6 8 self > > # cat /tmp/D/meminfo > > cat: /tmp/D/meminfo: No such file or directory > > # ls /tmp/D/irq > > ls: cannot open directory /tmp/D/irq: No such file or directory > > > > No? > > Yes!!! If this whole effort with pidfs and overlayfs will move forward, I would > prefer seeing the nodev procfs version, rather than another fs. But this is not procfs anymore. If someone will wait for procfs here it will be disappointed :) > As far as the overlayfs part is concerned, having an overlayfs mounted on /proc > inside container may result in problems as applications sometimes check for /proc > containing procfs (by checking statfs.f_type == PROC_SUPER_MAGIC or by reading > the /proc/mounts). It is not a replacement for procfs. It's a subset of procfs. If someone wants the procfs in the code we should not deceive him. No? > -- Pavel > > > Oleg. > > > > > > --- a/fs/proc/generic.c > > +++ b/fs/proc/generic.c > > @@ -305,11 +305,22 @@ int proc_readdir_de(struct proc_dir_entry *de, struct file *file, > > > > int proc_readdir(struct file *file, struct dir_context *ctx) > > { > > + int mnt_flags = file->f_path.mnt->mnt_flags; > > struct inode *inode = file_inode(file); > > > > + if (mnt_flags & MNT_NODEV) > > + return 1; > > + > > return proc_readdir_de(PDE(inode), file, ctx); > > } > > > > +static int proc_dir_open(struct inode *inode, struct file *file) > > +{ > > + if (file->f_path.mnt->mnt_flags & MNT_NODEV) > > + return -ENOENT; > > + return 0; > > +} > > + > > /* > > * These are the generic /proc directory operations. They > > * use the in-memory "struct proc_dir_entry" tree to parse > > @@ -319,6 +330,7 @@ static const struct file_operations proc_dir_operations = { > > .llseek = generic_file_llseek, > > .read = generic_read_dir, > > .iterate_shared = proc_readdir, > > + .open = proc_dir_open, > > }; > > > > /* > > --- a/fs/proc/inode.c > > +++ b/fs/proc/inode.c > > @@ -318,12 +318,16 @@ proc_reg_get_unmapped_area(struct file *file, unsigned long orig_addr, > > > > static int proc_reg_open(struct inode *inode, struct file *file) > > { > > + int mnt_flags = file->f_path.mnt->mnt_flags; > > struct proc_dir_entry *pde = PDE(inode); > > int rv = 0; > > int (*open)(struct inode *, struct file *); > > int (*release)(struct inode *, struct file *); > > struct pde_opener *pdeo; > > > > + if (mnt_flags & MNT_NODEV) > > + return -ENOENT; > > + > > /* > > * Ensure that > > * 1) PDE's ->release hook will be called no matter what > > > > . > > -- Rgrds, legion