What's the status of 87b47932 patch - mnt: Implicitly add MNT_NODEV on remount as we do on mount
A message that is not in the archive (sent off-list or not yet received): [email protected]
A message that is not in the archive (sent off-list or not yet received): [email protected]
Quoted 11 lines · joeyli
Hi Eric,
Sorry for bother you. I saw your patch:
mnt: Implicitly addMNT_NODEVon remount as we do on mountAlready commited in linux-next:
https://git.kernel.org/cgit/linux/kernel/git/next/linux-next.git/commit/fs/namespace.c?id=87b47932f40a11280584bce260cbdb3b5f9e8b7dBut, I didn't see this patch show in v3.18-rc kernel in Linus's git tree. What's the status of
87b47932patch? Does there have regression cases it could not be merged to v3.18 kernel?
The patch actually breaks remounting filesystems that did not have MNT_NODEV set when theny were mounted.
The primary issue is that the bug hit at a very inopportune time in my life (just before kernel summit) after which I had a vacation planned and after that I had some serious job hunting and moving to do.
Now I am busily trying to catch up on my queue and these long delayed bug fixes are the next issue.
If folks can review/test the current version of the patch (to follow in a moment) I would appreciate it. Based on previous testing unless I have a typo what I expect to see is:
lxc - b0rked. The old versions of lxc must be broken to fix the
security issue.
libvirt-lxc - fixed.
Andy's thing - fixed.
Any comments on the next user namespace breaking security fix that is being finalized would also be appreciated.
Eric
A message that is not in the archive (sent off-list or not yet received): [email protected]
PATCH 1/1 mnt: Implicitly add MNT_NODEV on remount when it was implicitly added by mount
Now that remount is properly enforcing the rule that you can't remove nodev at least sandstorm.io is breaking when performing a remount.
It turns out that there is an easy intuitive solution implicitly add nodev on remount when nodev was implicitly added on mount.
--- fs/namespace.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
fs/namespace.c +7 -1
@@ -2098,7 +2098,13 @@ static int do_remount(struct path *path, int flags, int mnt_flags, }if ((mnt->mnt.mnt_flags &MNT_LOCK_NODEV ) && !(mnt_flags &MNT_NODEV )) { -return -EPERM ; +/* Was the nodev implicitly added in mount? */ +if ((mnt->mnt_ns->user_ns != &init_user_ns) && + !(sb->s_type->fs_flags &FS_USERNS_DEV_MOUNT )) { + mnt_flags |=MNT_NODEV ; + }else { +return -EPERM ; + } }if ((mnt->mnt.mnt_flags &MNT_LOCK_NOSUID ) && !(mnt_flags &MNT_NOSUID )) {
Signature · 1 line
1.9.1
A message that is not in the archive (sent off-list or not yet received): 87egsllia3.fsf_-_-JOvCrm2gF+uungPnsOpG7nhyD016LWXt@public.gmane.org
Re: [CFT][PATCH] mnt: Implicitly add MNT_NODEV on remount when it was implicitly added by mount
Quoted 7 lines · Eric W. Biederman
Now that remount is properly enforcing the rule that you can't remove nodev at leastsandstorm.iois breaking when performing a remount.
It turns out that there is an easy intuitive solution implicitly add nodev on remount when nodev was implicitly added on mount.
Is this intended to be a permanent fix or are you planning on replacing it with something closer to my version for 3.19?
I still think that the implicit nodev behavior is a bad idea in general.
--Andy
Quoted 29 lines
--- fs/namespace.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)fs/namespace.c +7
-2@@ -2098,7 +2098,13 @@ static int do_remount(struct path *path, int flags, int mnt_flags, }if ((mnt->mnt.mnt_flags &MNT_LOCK_NODEV ) && !(mnt_flags &MNT_NODEV )) { -return -EPERM ; +/* Was the nodev implicitly added in mount? */ +if ((mnt->mnt_ns->user_ns != &init_user_ns) && + !(sb->s_type->fs_flags &FS_USERNS_DEV_MOUNT )) { + mnt_flags |=MNT_NODEV ; + }else { +return -EPERM ; + } }if ((mnt->mnt.mnt_flags &MNT_LOCK_NOSUID ) && !(mnt_flags &MNT_NOSUID )) { --1.9.1
A message that is not in the archive (sent off-list or not yet received): CALCETrX=B+0PVe8fhvCEyqBGD-D1wLJPd6CrqPn6LCGYgzxPMg-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org
Re: [CFT][PATCH] mnt: Implicitly add MNT_NODEV on remount when it was implicitly added by mount
Quoted 9 lines · Andy Lutomirski
Quoted 7 lines · Eric W. Biederman
Now that remount is properly enforcing the rule that you can't remove nodev at leastsandstorm.iois breaking when performing a remount.
It turns out that there is an easy intuitive solution implicitly add nodev on remount when nodev was implicitly added on mount.
Quoted 7 lines
Is this intended to be a permanent fix or are you planning on replacing it with something closer to my version for 3.19?
I still think that the implicit nodev behavior is a bad idea in general.
I want to consider your change as part of the larger discussion about how we take the final step towards allowing fuse and other filesystems with backing store to be merged in the kernel.
There are actually some other possibilities with s_user_ns in the mix.
The cleanest solution is probably to declare dev_t as well as security labels values that are interpreted with respect to user namespaces. Then seeting s_user_ns != &init_user_ns will yield device nodes that simply don't have a meaning in the kernel. Which winds up being effectively the same as an implicit nodev, but without the compatibility hassle.
But all of that is or should be development. And what my patch is, is about getting a simple bug fix that works.
Eric
Re: [CFT][PATCH] mnt: Implicitly add MNT_NODEV on remount when it was implicitly added by mount
In reply to a message not in the archiveEric,
Am 30.11.2014 um 00:05 schrieb Eric W. Biederman:
Quoted 6 lines
Now that remount is properly enforcing the rule that you can't remove nodev at least sandstorm.io is breaking when performing a remount.
It turns out that there is an easy intuitive solution implicitly add nodev on remount when nodev was implicitly added on mount.
Is this patch supposed to unbreak libvirt-lxc?
At least 1.2.9 is still broken.
Thanks,
//richard
A message that is not in the archive (sent off-list or not yet received): 547B309E.9020706-/[email protected]
Re: [CFT][PATCH] mnt: Implicitly add MNT_NODEV on remount when it was implicitly added by mount
Quoted 4 lines · Richard Weinberger
Eric,
Am 30.11.2014 um 00:05 schrieb Eric W. Biederman:
Quoted 1 line
Quoted 9 lines
Quoted 5 lines
Now that remount is properly enforcing the rule that you can't remove nodev at least sandstorm.io is breaking when performing a remount.
It turns out that there is an easy intuitive solution implicitly add nodev on remount when nodev was implicitly added on mount.
Is this patch supposed to unbreak libvirt-lxc?
At least 1.2.9 is still broken.
Either this patch or my variant of it fixes the libvirt-lxc breakage that I understand, but IIRC there was some other issue that none of us figured out at K-S.
--Andy
Quoted 2 lines
Thanks,
//richard
Signature · 2 lines
Andy Lutomirski AMA Capital Management, LLC
A message that is not in the archive (sent off-list or not yet received): CALCETrUZRi=Y=CDTpq5oO-tPOvMsZ+osKiydkCk-P0dn4DKJkA-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org
Re: [CFT][PATCH] mnt: Implicitly add MNT_NODEV on remount when it was implicitly added by mount
Am 30.11.2014 um 16:00 schrieb Andy Lutomirski:
Quoted 11 lines · Richard Weinberger
Quoted 10 lines
Eric,
Am 30.11.2014 um 00:05 schrieb Eric W. Biederman:
Quoted 6 lines
Now that remount is properly enforcing the rule that you can't remove nodev at least sandstorm.io is breaking when performing a remount.
It turns out that there is an easy intuitive solution implicitly add nodev on remount when nodev was implicitly added on mount.
Quoted 7 lines
Quoted 3 lines
Is this patch supposed to unbreak libvirt-lxc?
At least 1.2.9 is still broken.Either this patch or my variant of it fixes the libvirt-lxc breakage that I understand, but IIRC there was some other issue that none of us figured out at K-S.
Currently it fails here:
2014-11-25 22:36:45.295+0000: 1: debug : virFileMakePathHelper:2436 : path=/proc mode=0777 2014-11-25 22:36:45.295+0000: 1: debug : lxcContainerMountBasicFS:918 : Mount proc on /proc type=proc flags=e 2014-11-25 22:36:45.296+0000: 1: debug : lxcContainerMountBasicFS:873 : Processing /proc/sys -> /proc/sys 2014-11-25 22:36:45.296+0000: 1: debug : virFileMakePathHelper:2436 : path=/proc/sys mode=0777 2014-11-25 22:36:45.296+0000: 1: debug : lxcContainerMountBasicFS:918 : Mount /proc/sys on /proc/sys type=(null) flags=1000 2014-11-25 22:36:45.296+0000: 1: error : lxcContainerMountBasicFS:933 : Failed to re-mount /proc/sys on /proc/sys flags=1021: Operation not permitted
Thanks,
//richard
A message that is not in the archive (sent off-list or not yet received): 547B34C6.6030709-/[email protected]
Re: [CFT][PATCH] mnt: Implicitly add MNT_NODEV on remount when it was implicitly added by mount
Quoted 20 lines · Richard Weinberger
Am 30.11.2014 um 16:00 schrieb Andy Lutomirski:
Quoted 11 lines · Richard Weinberger
Quoted 10 lines
Eric,
Am 30.11.2014 um 00:05 schrieb Eric W. Biederman:
Quoted 6 lines
Now that remount is properly enforcing the rule that you can't remove nodev at least sandstorm.io is breaking when performing a remount.
It turns out that there is an easy intuitive solution implicitly add nodev on remount when nodev was implicitly added on mount.
Quoted 7 lines
Quoted 3 lines
Is this patch supposed to unbreak libvirt-lxc?
At least 1.2.9 is still broken.Either this patch or my variant of it fixes the libvirt-lxc breakage that I understand, but IIRC there was some other issue that none of us figured out at K-S.
Quoted 7 lines
Currently it fails here:
2014-11-25 22:36:45.295+0000: 1: debug : virFileMakePathHelper:2436 : path=/proc mode=0777 2014-11-25 22:36:45.295+0000: 1: debug : lxcContainerMountBasicFS:918 : Mount proc on /proc type=proc flags=e 2014-11-25 22:36:45.296+0000: 1: debug : lxcContainerMountBasicFS:873 : Processing /proc/sys -> /proc/sys 2014-11-25 22:36:45.296+0000: 1: debug : virFileMakePathHelper:2436 : path=/proc/sys mode=0777 2014-11-25 22:36:45.296+0000: 1: debug : lxcContainerMountBasicFS:918 : Mount /proc/sys on /proc/sys type=(null) flags=1000 2014-11-25 22:36:45.296+0000: 1: error : lxcContainerMountBasicFS:933 : Failed to re-mount /proc/sys on /proc/sys flags=1021: Operation not permitted
Any chance you can test that with Eric's patch or mine [1] applied? If that doesn't work, can you try to catch the failure with strace?
--Andy
Quoted 3 lines
Thanks,
//richard
Signature · 2 lines
Andy Lutomirski AMA Capital Management, LLC
A message that is not in the archive (sent off-list or not yet received): CALCETrW6QRRB_DfHwYv+UVJ_8yF+8Db+UP+ezd4jG599b4dSiA-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org
Re: [CFT][PATCH] mnt: Implicitly add MNT_NODEV on remount when it was implicitly added by mount
Am 30.11.2014 um 16:37 schrieb Andy Lutomirski:
Quoted 29 lines · Richard Weinberger
Quoted 20 lines
Am 30.11.2014 um 16:00 schrieb Andy Lutomirski:
Quoted 11 lines · Richard Weinberger
Quoted 10 lines
Eric,
Am 30.11.2014 um 00:05 schrieb Eric W. Biederman:
Quoted 6 lines
Now that remount is properly enforcing the rule that you can't remove nodev at least sandstorm.io is breaking when performing a remount.
It turns out that there is an easy intuitive solution implicitly add nodev on remount when nodev was implicitly added on mount.
Quoted 7 lines
Quoted 3 lines
Is this patch supposed to unbreak libvirt-lxc?
At least 1.2.9 is still broken.Either this patch or my variant of it fixes the libvirt-lxc breakage that I understand, but IIRC there was some other issue that none of us figured out at K-S.
Quoted 7 lines
Currently it fails here:
2014-11-25 22:36:45.295+0000: 1: debug : virFileMakePathHelper:2436 : path=/proc mode=0777 2014-11-25 22:36:45.295+0000: 1: debug : lxcContainerMountBasicFS:918 : Mount proc on /proc type=proc flags=e 2014-11-25 22:36:45.296+0000: 1: debug : lxcContainerMountBasicFS:873 : Processing /proc/sys -> /proc/sys 2014-11-25 22:36:45.296+0000: 1: debug : virFileMakePathHelper:2436 : path=/proc/sys mode=0777 2014-11-25 22:36:45.296+0000: 1: debug : lxcContainerMountBasicFS:918 : Mount /proc/sys on /proc/sys type=(null) flags=1000 2014-11-25 22:36:45.296+0000: 1: error : lxcContainerMountBasicFS:933 : Failed to re-mount /proc/sys on /proc/sys flags=1021: Operation not permitted
Quoted 2 lines
Any chance you can test that with Eric's patch or mine [1] applied? If that doesn't work, can you try to catch the failure with strace?
With your patch applied on top of Linus's tree as of today libvirt-lxc works fine again. :)
Thanks,
//richard
A message that is not in the archive (sent off-list or not yet received): 547B5066.4020509-/[email protected]
Re: [CFT][PATCH] mnt: Implicitly add MNT_NODEV on remount when it was implicitly added by mount
Quoted 30 lines · Richard Weinberger
Am 30.11.2014 um 16:37 schrieb Andy Lutomirski:
Quoted 29 lines · Richard Weinberger
Quoted 27 lines
Am 30.11.2014 um 16:00 schrieb Andy Lutomirski:
Quoted 11 lines · Richard Weinberger
Quoted 10 lines
Eric,
Am 30.11.2014 um 00:05 schrieb Eric W. Biederman:
Quoted 6 lines
Now that remount is properly enforcing the rule that you can't remove nodev at least sandstorm.io is breaking when performing a remount.
It turns out that there is an easy intuitive solution implicitly add nodev on remount when nodev was implicitly added on mount.
Quoted 7 lines
Quoted 3 lines
Is this patch supposed to unbreak libvirt-lxc?
At least 1.2.9 is still broken.Either this patch or my variant of it fixes the libvirt-lxc breakage that I understand, but IIRC there was some other issue that none of us figured out at K-S.
Currently it fails here:
2014-11-25 22:36:45.295+0000: 1: debug : virFileMakePathHelper:2436 : path=/proc mode=0777 2014-11-25 22:36:45.295+0000: 1: debug : lxcContainerMountBasicFS:918 : Mount proc on /proc type=proc flags=e 2014-11-25 22:36:45.296+0000: 1: debug : lxcContainerMountBasicFS:873 : Processing /proc/sys -> /proc/sys 2014-11-25 22:36:45.296+0000: 1: debug : virFileMakePathHelper:2436 : path=/proc/sys mode=0777 2014-11-25 22:36:45.296+0000: 1: debug : lxcContainerMountBasicFS:918 : Mount /proc/sys on /proc/sys type=(null) flags=1000 2014-11-25 22:36:45.296+0000: 1: error : lxcContainerMountBasicFS:933 : Failed to re-mount /proc/sys on /proc/sys flags=1021: Operation not permitted
Quoted 4 lines
Quoted 2 lines
Any chance you can test that with Eric's patch or mine [1] applied? If that doesn't work, can you try to catch the failure with strace?
With your patch applied on top of Linus's tree as of today libvirt-lxc works fine again. :)
*Scratches head*
Did you really have my latest patch applied?
Andy's patch implies a change of policy that I really don't want to deploy as a bug fix.
Eric
A message that is not in the archive (sent off-list or not yet received): [email protected]
Re: [CFT][PATCH] mnt: Implicitly add MNT_NODEV on remount when it was implicitly added by mount
Am 30.11.2014 um 19:35 schrieb Eric W. Biederman:
Quoted 35 lines
Quoted 33 lines · Richard Weinberger
Am 30.11.2014 um 16:37 schrieb Andy Lutomirski:
Quoted 31 lines · Richard Weinberger
Quoted 20 lines
Am 30.11.2014 um 16:00 schrieb Andy Lutomirski:
Quoted 11 lines · Richard Weinberger
Quoted 10 lines
Eric,
Am 30.11.2014 um 00:05 schrieb Eric W. Biederman:
Quoted 6 lines
Now that remount is properly enforcing the rule that you can't remove nodev at least sandstorm.io is breaking when performing a remount.
It turns out that there is an easy intuitive solution implicitly add nodev on remount when nodev was implicitly added on mount.
Quoted 7 lines
Quoted 3 lines
Is this patch supposed to unbreak libvirt-lxc?
At least 1.2.9 is still broken.Either this patch or my variant of it fixes the libvirt-lxc breakage that I understand, but IIRC there was some other issue that none of us figured out at K-S.
Quoted 7 lines
Currently it fails here:
2014-11-25 22:36:45.295+0000: 1: debug : virFileMakePathHelper:2436 : path=/proc mode=0777 2014-11-25 22:36:45.295+0000: 1: debug : lxcContainerMountBasicFS:918 : Mount proc on /proc type=proc flags=e 2014-11-25 22:36:45.296+0000: 1: debug : lxcContainerMountBasicFS:873 : Processing /proc/sys -> /proc/sys 2014-11-25 22:36:45.296+0000: 1: debug : virFileMakePathHelper:2436 : path=/proc/sys mode=0777 2014-11-25 22:36:45.296+0000: 1: debug : lxcContainerMountBasicFS:918 : Mount /proc/sys on /proc/sys type=(null) flags=1000 2014-11-25 22:36:45.296+0000: 1: error : lxcContainerMountBasicFS:933 : Failed to re-mount /proc/sys on /proc/sys flags=1021: Operation not permittedAny chance you can test that with Eric's patch or mine [1] applied? If that doesn't work, can you try to catch the failure with strace?
Quoted 8 lines
Quoted 1 line
With your patch applied on top of Linus's tree as of today libvirt-lxc works fine again. :)
*Scratches head*
Did you really have my latest patch applied?
Andy's patch implies a change of policy that I really don't want to deploy as a bug fix.
Hmm, let me double check this tomorrow with a fresh brain. Maybe I got hit by another issue while testing your patch. Currently I'm fighting against three libvirt-lxc issues in parallel. :-\
Thanks,
//richard
A message that is not in the archive (sent off-list or not yet received): 547B6531.40504-/[email protected]
Re: [CFT][PATCH] mnt: Implicitly add MNT_NODEV on remount when it was implicitly added by mount
Quoted 40 lines · Richard Weinberger
Am 30.11.2014 um 19:35 schrieb Eric W. Biederman:
Quoted 39 lines
Quoted 30 lines · Richard Weinberger
Am 30.11.2014 um 16:37 schrieb Andy Lutomirski:
Quoted 29 lines · Richard Weinberger
Quoted 27 lines
Am 30.11.2014 um 16:00 schrieb Andy Lutomirski:
Quoted 11 lines · Richard Weinberger
Quoted 10 lines
Eric,
Am 30.11.2014 um 00:05 schrieb Eric W. Biederman:
Quoted 6 lines
Now that remount is properly enforcing the rule that you can't remove nodev at least sandstorm.io is breaking when performing a remount.
It turns out that there is an easy intuitive solution implicitly add nodev on remount when nodev was implicitly added on mount.
Quoted 7 lines
Quoted 3 lines
Is this patch supposed to unbreak libvirt-lxc?
At least 1.2.9 is still broken.Either this patch or my variant of it fixes the libvirt-lxc breakage that I understand, but IIRC there was some other issue that none of us figured out at K-S.
Currently it fails here:
2014-11-25 22:36:45.295+0000: 1: debug : virFileMakePathHelper:2436 : path=/proc mode=0777 2014-11-25 22:36:45.295+0000: 1: debug : lxcContainerMountBasicFS:918 : Mount proc on /proc type=proc flags=e 2014-11-25 22:36:45.296+0000: 1: debug : lxcContainerMountBasicFS:873 : Processing /proc/sys -> /proc/sys 2014-11-25 22:36:45.296+0000: 1: debug : virFileMakePathHelper:2436 : path=/proc/sys mode=0777 2014-11-25 22:36:45.296+0000: 1: debug : lxcContainerMountBasicFS:918 : Mount /proc/sys on /proc/sys type=(null) flags=1000 2014-11-25 22:36:45.296+0000: 1: error : lxcContainerMountBasicFS:933 : Failed to re-mount /proc/sys on /proc/sys flags=1021: Operation not permittedQuoted 4 lines
Quoted 2 lines
Any chance you can test that with Eric's patch or mine [1] applied? If that doesn't work, can you try to catch the failure with strace?
With your patch applied on top of Linus's tree as of today libvirt-lxc works fine again. :)
*Scratches head*
Quoted 8 lines
Quoted 4 lines
Did you really have my latest patch applied?
Andy's patch implies a change of policy that I really don't want to deploy as a bug fix.
Hmm, let me double check this tomorrow with a fresh brain. Maybe I got hit by another issue while testing your patch. Currently I'm fighting against three libvirt-lxc issues in parallel. :-\
Please do. I just reran through my regression tests that explore this issue rather throughly and all of my remount test cases are passing. So if things are truly failing I want to understand what is going on, and add to my regression tests.
I should have done that sooner of course but I am still paging back in after being distracted with the other things in life.
Eric
A message that is not in the archive (sent off-list or not yet received): [email protected]
Re: [CFT][PATCH] mnt: Implicitly add MNT_NODEV on remount when it was implicitly added by mount
Am 01.12.2014 um 02:29 schrieb Eric W. Biederman:
Quoted 16 lines
Quoted 7 lines
Quoted 7 lines
Quoted 4 lines
Quoted 2 lines
Any chance you can test that with Eric's patch or mine [1] applied? If that doesn't work, can you try to catch the failure with strace?
With your patch applied on top of Linus's tree as of today libvirt-lxc works fine again. :)
*Scratches head*
Quoted 8 lines
Quoted 4 lines
Did you really have my latest patch applied?
Andy's patch implies a change of policy that I really don't want to deploy as a bug fix.
Hmm, let me double check this tomorrow with a fresh brain. Maybe I got hit by another issue while testing your patch. Currently I'm fighting against three libvirt-lxc issues in parallel. :-\
Quoted 7 lines
Please do. I just reran through my regression tests that explore this issue rather throughly and all of my remount test cases are passing. So if things are truly failing I want to understand what is going on, and add to my regression tests.
I should have done that sooner of course but I am still paging back in after being distracted with the other things in life.
I can confirm that your patch "mnt: Implicitly add MNT_NODEV on remount as we do on mount" unbreaks libvirt-lxc too. :-)
Sorry for the false negative.
Thanks,
//richard
A message that is not in the archive (sent off-list or not yet received): 547D77C8.7050100-/[email protected]
Re: [CFT][PATCH] mnt: Implicitly add MNT_NODEV on remount when it was implicitly added by mount
Quoted 22 lines · Richard Weinberger
Am 01.12.2014 um 02:29 schrieb Eric W. Biederman:
Quoted 21 lines
Quoted 7 lines
Quoted 7 lines
Quoted 4 lines
Quoted 2 lines
Any chance you can test that with Eric's patch or mine [1] applied? If that doesn't work, can you try to catch the failure with strace?
With your patch applied on top of Linus's tree as of today libvirt-lxc works fine again. :)
*Scratches head*
Quoted 8 lines
Quoted 4 lines
Did you really have my latest patch applied?
Andy's patch implies a change of policy that I really don't want to deploy as a bug fix.
Hmm, let me double check this tomorrow with a fresh brain. Maybe I got hit by another issue while testing your patch. Currently I'm fighting against three libvirt-lxc issues in parallel. :-\
Please do. I just reran through my regression tests that explore this issue rather throughly and all of my remount test cases are passing. So if things are truly failing I want to understand what is going on, and add to my regression tests.
Quoted 6 lines
Quoted 2 lines
I should have done that sooner of course but I am still paging back in after being distracted with the other things in life.
I can confirm that your patch "mnt: Implicitly add
MNT_NODEVon remount as we do on mount" unbreaks libvirt-lxc too. :-)
Sorry for the false negative.
Thanks I will add your Tested-by.
Eric
A message that is not in the archive (sent off-list or not yet received): [email protected]
joeyli
Tested-by Cedric BosdonnatRe: [CFT][PATCH] mnt: Implicitly add MNT_NODEV on remount when it was implicitly added by mount
Hi Eric,
Quoted 27 lines · Eric W. Biederman
Quoted 25 lines · Richard Weinberger
Am 01.12.2014 um 02:29 schrieb Eric W. Biederman:
Quoted 23 lines
Quoted 7 lines
Quoted 7 lines
Quoted 4 lines
Quoted 2 lines
Any chance you can test that with Eric's patch or mine [1] applied? If that doesn't work, can you try to catch the failure with strace?
With your patch applied on top of Linus's tree as of today libvirt-lxc works fine again. :)
*Scratches head*
Quoted 8 lines
Quoted 4 lines
Did you really have my latest patch applied?
Andy's patch implies a change of policy that I really don't want to deploy as a bug fix.
Hmm, let me double check this tomorrow with a fresh brain. Maybe I got hit by another issue while testing your patch. Currently I'm fighting against three libvirt-lxc issues in parallel. :-\
Please do. I just reran through my regression tests that explore this issue rather throughly and all of my remount test cases are passing. So if things are truly failing I want to understand what is going on, and add to my regression tests.
I should have done that sooner of course but I am still paging back in after being distracted with the other things in life.
Quoted 7 lines
Quoted 3 lines
I can confirm that your patch "mnt: Implicitly add
MNT_NODEVon remount as we do on mount" unbreaks libvirt-lxc too. :-)
Sorry for the false negative.Thanks I will add your Tested-by.
Eric
Cedric help to test my kernel that included your patch. Please feel free to add:
Regards
Joey Lee
Hi Eric,
Quoted 32 lines · Eric W. Biederman
Quoted 11 lines · joeyli
Hi Eric,
Sorry for bother you. I saw your patch:
mnt: Implicitly addMNT_NODEVon remount as we do on mountAlready commited in linux-next:
https://git.kernel.org/cgit/linux/kernel/git/next/linux-next.git/commit/fs/namespace.c?id=87b47932f40a11280584bce260cbdb3b5f9e8b7dBut, I didn't see this patch show in v3.18-rc kernel in Linus's git tree. What's the status of
87b47932patch? Does there have regression cases it could not be merged to v3.18 kernel?The patch actually breaks remounting filesystems that did not have
MNT_NODEVset when theny were mounted.The primary issue is that the bug hit at a very inopportune time in my life (just before kernel summit) after which I had a vacation planned and after that I had some serious job hunting and moving to do.
Now I am busily trying to catch up on my queue and these long delayed bug fixes are the next issue.
If folks can review/test the current version of the patch (to follow in a moment) I would appreciate it. Based on previous testing unless I have a typo what I expect to see is:
lxc - b0rked. The old versions of lxc must be broken to fix the
security issue.
libvirt-lxc - fixed.
Andy's thing - fixed.
Quoted 4 lines
Any comments on the next user namespace breaking security fix that is being finalized would also be appreciated.
Eric
Thanks for your quick response and information about your patches.
Joey Lee