On Mon, Jul 01, 2019 at 07:22:39PM +0100, Al Viro wrote: > FWIW, it's not just move_mount(2) - I'd expect > > int fds[2]; > char s[80]; > > pipe(fds); > sprintf(s, "/dev/fd/%d", fds[0]); > mount(s, "/dev/null", NULL, MS_MOVE, 0); > > to step into exactly the same thing. mount(2) does follow symlinks - > always had... The same goes for e.g. #define _GNU_SOURCE #include <sched.h> #include <sys/mount.h> #include <stdio.h> #include <sys/epoll.h> main() { char s[80]; unshare(CLONE_NEWNS); // so nobody else gets confused sprintf(s, "/dev/fd/%d", epoll_create1(0)); mount(s, "/dev/null", NULL, MS_MOVE, 0); // see if it oopses } modulo error-checking, etc.