On Thu, Nov 14, 2024 at 09:51:42AM -0500, Jeff Layton wrote:
> On Thu, 2024-11-14 at 15:48 +0100, Christian Brauner wrote:
> > On Thu, Nov 14, 2024 at 02:16:05PM +0100, Miklos Szeredi wrote:
> > > On Thu, 14 Nov 2024 at 13:29, Jeff Layton <jlayton@xxxxxxxxxx> wrote:
> > >
> > > > Ordinarily, I might agree, but we're now growing a new mount option
> > > > field that has them separated by NULs. Will we need two extra fields
> > > > for this? One comma-separated, and one NUL separated?
> > > >
> > > > /proc/#/mountinfo and mounts prepend these to the output of
> > > > ->show_options, so the simple solution would be to just prepend those
> > > > there instead of adding a new field. FWIW, only SELinux has any extra
> > > > mount options to show here.
> > >
> > > Compromise: tack them onto the end of the comma separated list, but
> > > add a new field for the nul separated security options.
> > >
> > > I think this would be logical, since the comma separated list is more
> > > useful for having a /proc/$$/mountinfo compatible string than for
> > > actually interpreting what's in there.
> >
> > Fair. Here's an incremental for the array of security options.
> >
> > diff --git a/fs/namespace.c b/fs/namespace.c
> > index 4f39c4aba85d..a9065a9ab971 100644
> > --- a/fs/namespace.c
> > +++ b/fs/namespace.c
> > @@ -5072,13 +5072,30 @@ static int statmount_mnt_opts(struct kstatmount *s, struct seq_file *seq)
> > return 0;
> > }
> >
> > +static inline int statmount_opt_unescape(struct seq_file *seq, char *buf_start)
> > +{
> > + char *buf_end, *opt_start, *opt_end;
> > + int count = 0;
> > +
> > + buf_end = seq->buf + seq->count;
> > + *buf_end = '\0';
> > + for (opt_start = buf_start + 1; opt_start < buf_end; opt_start = opt_end + 1) {
> > + opt_end = strchrnul(opt_start, ',');
> > + *opt_end = '\0';
> > + buf_start += string_unescape(opt_start, buf_start, 0, UNESCAPE_OCTAL) + 1;
> > + if (WARN_ON_ONCE(++count == INT_MAX))
> > + return -EOVERFLOW;
> > + }
> > + seq->count = buf_start - 1 - seq->buf;
> > + return count;
> > +}
> > +
> > static int statmount_opt_array(struct kstatmount *s, struct seq_file *seq)
> > {
> > struct vfsmount *mnt = s->mnt;
> > struct super_block *sb = mnt->mnt_sb;
> > size_t start = seq->count;
> > - char *buf_start, *buf_end, *opt_start, *opt_end;
> > - u32 count = 0;
> > + char *buf_start;
> > int err;
> >
> > if (!sb->s_op->show_options)
> > @@ -5095,17 +5112,39 @@ static int statmount_opt_array(struct kstatmount *s, struct seq_file *seq)
> > if (seq->count == start)
> > return 0;
> >
> > - buf_end = seq->buf + seq->count;
> > - *buf_end = '\0';
> > - for (opt_start = buf_start + 1; opt_start < buf_end; opt_start = opt_end + 1) {
> > - opt_end = strchrnul(opt_start, ',');
> > - *opt_end = '\0';
> > - buf_start += string_unescape(opt_start, buf_start, 0, UNESCAPE_OCTAL) + 1;
> > - if (WARN_ON_ONCE(++count == 0))
> > - return -EOVERFLOW;
> > - }
> > - seq->count = buf_start - 1 - seq->buf;
> > - s->sm.opt_num = count;
> > + err = statmount_opt_unescape(seq, buf_start);
> > + if (err < 0)
> > + return err;
> > +
> > + s->sm.opt_num = err;
> > + return 0;
> > +}
> > +
> > +static int statmount_opt_sec_array(struct kstatmount *s, struct seq_file *seq)
> > +{
> > + struct vfsmount *mnt = s->mnt;
> > + struct super_block *sb = mnt->mnt_sb;
> > + size_t start = seq->count;
> > + char *buf_start;
> > + int err;
> > +
> > + buf_start = seq->buf + start;
> > +
> > + err = security_sb_show_options(seq, sb);
> > + if (!err)
> > + return err;
> > +
> > + if (unlikely(seq_has_overflowed(seq)))
> > + return -EAGAIN;
> > +
> > + if (seq->count == start)
> > + return 0;
> > +
> > + err = statmount_opt_unescape(seq, buf_start);
> > + if (err < 0)
> > + return err;
> > +
> > + s->sm.opt_sec_num = err;
> > return 0;
> > }
> >
> > @@ -5138,6 +5177,10 @@ static int statmount_string(struct kstatmount *s, u64 flag)
> > sm->opt_array = start;
> > ret = statmount_opt_array(s, seq);
> > break;
> > + case STATMOUNT_OPT_SEC_ARRAY:
> > + sm->opt_sec_array = start;
> > + ret = statmount_opt_sec_array(s, seq);
> > + break;
> > case STATMOUNT_FS_SUBTYPE:
> > sm->fs_subtype = start;
> > statmount_fs_subtype(s, seq);
> > @@ -5294,6 +5337,9 @@ static int do_statmount(struct kstatmount *s, u64 mnt_id, u64 mnt_ns_id,
> > if (!err && s->mask & STATMOUNT_OPT_ARRAY)
> > err = statmount_string(s, STATMOUNT_OPT_ARRAY);
> >
> > + if (!err && s->mask & STATMOUNT_OPT_SEC_ARRAY)
> > + err = statmount_string(s, STATMOUNT_OPT_SEC_ARRAY);
> > +
> > if (!err && s->mask & STATMOUNT_FS_SUBTYPE)
> > err = statmount_string(s, STATMOUNT_FS_SUBTYPE);
> >
> > @@ -5323,7 +5369,7 @@ static inline bool retry_statmount(const long ret, size_t *seq_size)
> > #define STATMOUNT_STRING_REQ (STATMOUNT_MNT_ROOT | STATMOUNT_MNT_POINT | \
> > STATMOUNT_FS_TYPE | STATMOUNT_MNT_OPTS | \
> > STATMOUNT_FS_SUBTYPE | STATMOUNT_SB_SOURCE | \
> > - STATMOUNT_OPT_ARRAY)
> > + STATMOUNT_OPT_ARRAY | STATMOUNT_OPT_SEC_ARRAY)
> >
> > static int prepare_kstatmount(struct kstatmount *ks, struct mnt_id_req *kreq,
> > struct statmount __user *buf, size_t bufsize,
> > diff --git a/include/uapi/linux/mount.h b/include/uapi/linux/mount.h
> > index c0fda4604187..569d938a5757 100644
> > --- a/include/uapi/linux/mount.h
> > +++ b/include/uapi/linux/mount.h
> > @@ -177,7 +177,9 @@ struct statmount {
> > __u32 sb_source; /* [str] Source string of the mount */
> > __u32 opt_num; /* Number of fs options */
> > __u32 opt_array; /* [str] Array of nul terminated fs options */
> > - __u64 __spare2[47];
> > + __u32 opt_sec_num; /* Number of security options */
> > + __u32 opt_sec_array; /* [str] Array of nul terminated security options */
> > + __u64 __spare2[45];
>
> shouldn't that be 46 ?
Yes, apparently I can't count. Thanks for noticing!
>
> > char str[]; /* Variable size part containing strings */
> > };
> >
> > @@ -214,6 +216,7 @@ struct mnt_id_req {
> > #define STATMOUNT_FS_SUBTYPE 0x00000100U /* Want/got fs_subtype */
> > #define STATMOUNT_SB_SOURCE 0x00000200U /* Want/got sb_source */
> > #define STATMOUNT_OPT_ARRAY 0x00000400U /* Want/got opt_... */
> > +#define STATMOUNT_OPT_SEC_ARRAY 0x00000800U /* Want/got opt_sec... */
> >
> > /*
> > * Special @mnt_id values that can be passed to listmount
>
> The rest looks good to me though!
> --
> Jeff Layton <jlayton@xxxxxxxxxx>
