Miklos Szeredi <miklos@xxxxxxxxxx> writes: > On Tue, Oct 08, 2013 at 09:06:29AM -0700, Andy Lutomirski wrote: > >> > I think the risks of changing behavior outweigh the benefits. How many >> > times did you have to remove or rename a mounted file or directory? It's >> > very rarely needed. >> >> I do this every time I reinstall a system while running that system. >> Admittedly, mount --move works, but that's a really unpleasant >> interface. >> >> When rename2 gets added, there could be a flag RENAME_MOVE_MOUNT to opt in. > > Good point. Opting in would be the safest for both unlinkat() and > renameat2(). Opting in to allowing mounts to be unlinked and renamed? Or opting in to not renaming/unlinking a mount point? I can see opting in to denying the rename/unlink if that is someting someone wants for some reason. With an opt in we can even use the previous d_mountpoint check and not stomp someone's else's weird set of mounts in some other mount namespace if they are on the local machine and that is desired. The rmdir non-empty dir semantics justify blocking rmdir. If we are going to fix the VFS deficiency we have to let these changes happen in other mount namespaces. To make that safe it has to be sufficient to rely on the directory permissions and the conditions that ensure that the directory permissions are sufficient. So I find it far safer to allow as much as possible even in the local mount namespace so we can actually see if there are problems with relying on the directory permissions. Eric -- To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
