On Thu, 16 Sep 2010, Valerie Aurora wrote: > The device underlying the topmost read-write layer of a file system > cannot be mounted anywhere else on the system. We keep a pointer to > the union stack in the dentry of the topmost directory, so that dentry > can't be part of a different mount, since dentries are shared between > different mounts of the same device. > > Signed-off-by: Valerie Aurora <vaurora@xxxxxxxxxx> > --- > fs/namespace.c | 5 +++++ > 1 files changed, 5 insertions(+), 0 deletions(-) > > diff --git a/fs/namespace.c b/fs/namespace.c > index 61256e6..26efaf3 100644 > --- a/fs/namespace.c > +++ b/fs/namespace.c > @@ -1998,6 +1998,11 @@ int do_add_mount(struct vfsmount *newmnt, struct path *path, > if (S_ISLNK(newmnt->mnt_root->d_inode->i_mode)) > goto unlock; > > + /* Top layers of union mounts can't be mounted elsewhere */ > + err = -EBUSY; > + if (newmnt->mnt_sb->s_union_lower_mnts) > + goto unlock; > + This is insufficient: the super block may be mounted elsewhere later. And no, preventing bind mounts is not enough. BTW, what about CLONE_NEWNS? I think it's a rather big limitation if that doesn't work... Thanks, Miklos -- To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
