Re: [PATCH] VFS autmounter support v2

Mike Waychison (michael.waychison@sun.com)
Thu, 19 Jun 2003 10:00:40 -0400


David Howells wrote:
>
> I think this can make use of my suggested change... If you make a trigger fs
> that has its root directory simply an automount point (though this leads me to
> think that perhaps (u)mount should follow the example of stat and use
> LOOKUP_NOAUTOMOUNT).
>
> Perhaps:
>
> [namespace X]
> mount /dev/hda8 /usr/include
> mount -t trap "mount-fs-B" /usr/include/foo1
> mount -t trap "mount-fs-C" /usr/include/foo2
>
> [namespace Y]
> mount /dev/hda8 /usr/local/include
> mount -t trap "mount-fs-D" /usr/local/include/foo1
>
> Then have a daemon that can take a request to mount and then reply with the
> mount parameters, allowing the trap fs to obtain a vfsmount via
> do_kern_mount(). I would make the trap fs supply the daemon with an fd
> attached to the trap rootdir to act as a token representing the request (and
> controlling its lifetime).
>

You would have to go this route. I think Al's opinion in this is that
your original proposal allows arbitrary dentry's in the tree to act as
traps. As such, there is no way for a derived namespace to manipulate
that trap at all. By implying that the trap is installed via mount says
you are now proposing that every trap is represented by its own superblock.

You're new proposal is exactly what I have been working on, autofs
direct mountpoints using the less intrusive follow_link magic Anvin has
mentioned on a previous thread both here and on autofs@vger.

The one problem with this solution is the following breaks:

# installtrap /foo host:/export/foo
<userspace daemon listens for requests to mount>
# newnssh
newnssh # cd /foo

Oops, the daemon started from the initial namespace doesn't have access
to the namespace in my second shell.

The most reasonable way I can see to cope with this is to allow
CAP_SYS_ADMIN processes the ability to change namespaces. Eg, the
daemon can be told which pid triggered the trap on /foo,
open(/proc/<pid>/mounts) and perform a ioctl(IOC_USENAMESPACE) on it.

What do you guys think?

Mike Waychison

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/