On Tue, Oct 8, 2024 at 8:37 PM Jeff Layton <jlayton@xxxxxxxxxx> wrote:
>
> On Tue, 2024-10-08 at 17:21 +0200, Amir Goldstein wrote:
> > Teach open_by_handle_at(2) about the type format of "explicit connectable"
> > file handles that were created using the AT_HANDLE_CONNECTABLE flag to
> > name_to_handle_at(2).
> >
> > When decoding an "explicit connectable" file handles, name_to_handle_at(2)
> > should fail if it cannot open a "connected" fd with known path, which is
> > accessible (to capable user) from mount fd path.
> >
> > Note that this does not check if the path is accessible to the calling
> > user, just that it is accessible wrt the mount namesapce, so if there
> > is no "connected" alias, or if parts of the path are hidden in the
> > mount namespace, open_by_handle_at(2) will return -ESTALE.
> >
> > Signed-off-by: Amir Goldstein <amir73il@xxxxxxxxx>
> > ---
> > fs/fhandle.c | 20 +++++++++++++++++++-
> > include/linux/exportfs.h | 2 +-
> > 2 files changed, 20 insertions(+), 2 deletions(-)
> >
> > diff --git a/fs/fhandle.c b/fs/fhandle.c
> > index 7b4c8945efcb..6a5458c3c6c9 100644
> > --- a/fs/fhandle.c
> > +++ b/fs/fhandle.c
> > @@ -246,7 +246,13 @@ static int vfs_dentry_acceptable(void *context, struct dentry *dentry)
> >
> > if (!(ctx->flags & HANDLE_CHECK_SUBTREE) || d == root)
> > retval = 1;
> > - WARN_ON_ONCE(d != root && d != root->d_sb->s_root);
> > + /*
> > + * exportfs_decode_fh_raw() does not call acceptable() callback with
> > + * a disconnected directory dentry, so we should have reached either
> > + * mount fd directory or sb root.
> > + */
> > + if (ctx->fh_flags & EXPORT_FH_DIR_ONLY)
> > + WARN_ON_ONCE(d != root && d != root->d_sb->s_root);
>
> I don't quite get the test for EXPORT_FH_DIR_ONLY here. Why does this
> change require that instead of just continuing to WARN unconditionally?
>
The reason is at the end of may_decode_fh(), you have:
ctx->fh_flags = EXPORT_FH_DIR_ONLY;
return true;
So until THIS patch, vfs_dentry_acceptable() was always called
with EXPORT_FH_DIR_ONLY.
THIS patch adds another use case where HANDLE_CHECK_SUBTREE
is being requested, but this time EXPORT_FH_DIR_ONLY is optional.
The comment above "exportfs_decode_fh_raw() does not call acceptable()..."
explains why the assertion is only true for directories.
Thanks,
Amir.
