Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1371063 > unrolled thread
| Started by | ebiederm@xmission.com (Eric W. Biederman) |
|---|---|
| First post | 2016-04-05 02:20 +0200 |
| Last post | 2016-04-11 22:20 +0200 |
| Articles | 10 on this page of 70 — 7 participants |
Back to article view | Back to linux.kernel
This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by
below is the oldest one visible, not the original post.
[PATCH 00/13] devpts: New instances for every mount ebiederm@xmission.com (Eric W. Biederman) - 2016-04-05 02:20 +0200
[PATCH 04/13] devpts: Stop rolling devpts_remount by hand in devpts_mount "Eric W. Biederman" <ebiederm@xmission.com> - 2016-04-05 03:50 +0200
[PATCH 05/13] devpts: Fail early (if appropriate) on overmount "Eric W. Biederman" <ebiederm@xmission.com> - 2016-04-05 03:50 +0200
[PATCH 08/13] devpts: Make devpts_kill_sb safe if fsi is NULL "Eric W. Biederman" <ebiederm@xmission.com> - 2016-04-05 03:50 +0200
[PATCH 03/13] devpts: Cleanup newinstance parsing "Eric W. Biederman" <ebiederm@xmission.com> - 2016-04-05 03:50 +0200
[PATCH 06/13] devpts: Use the same default mode for both /dev/ptmx and dev/pts/ptmx "Eric W. Biederman" <ebiederm@xmission.com> - 2016-04-05 03:50 +0200
[PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup "Eric W. Biederman" <ebiederm@xmission.com> - 2016-04-05 03:50 +0200
[PATCH 09/13] devpts: Move the creation of /dev/pts/ptmx into fill_super "Eric W. Biederman" <ebiederm@xmission.com> - 2016-04-05 03:50 +0200
[PATCH 02/13] devpts: More obvious check for the system devpts in pty allocation "Eric W. Biederman" <ebiederm@xmission.com> - 2016-04-05 03:50 +0200
[PATCH 13/13] devpts: Kill the DEVPTS_MULTIPLE_INSTANCE config option "Eric W. Biederman" <ebiederm@xmission.com> - 2016-04-05 03:50 +0200
[PATCH 07/13] devpts: Move parse_mount_options into fill_super "Eric W. Biederman" <ebiederm@xmission.com> - 2016-04-05 03:50 +0200
[PATCH 12/13] devpts: Always return a distinct instance when mounting "Eric W. Biederman" <ebiederm@xmission.com> - 2016-04-05 04:00 +0200
[PATCH 11/13] vfs: Implement mount_super_once "Eric W. Biederman" <ebiederm@xmission.com> - 2016-04-05 04:00 +0200
[PATCH 10/13] devpts: Simplify devpts_mount by using mount_nodev "Eric W. Biederman" <ebiederm@xmission.com> - 2016-04-05 04:00 +0200
Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup Al Viro <viro@ZenIV.linux.org.uk> - 2016-04-05 05:00 +0200
Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup Al Viro <viro@ZenIV.linux.org.uk> - 2016-04-05 05:10 +0200
Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup ebiederm@xmission.com (Eric W. Biederman) - 2016-04-08 21:10 +0200
Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup Linus Torvalds <torvalds@linux-foundation.org> - 2016-04-07 18:10 +0200
Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup ebiederm@xmission.com (Eric W. Biederman) - 2016-04-08 21:10 +0200
Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup Linus Torvalds <torvalds@linux-foundation.org> - 2016-04-08 21:10 +0200
Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup ebiederm@xmission.com (Eric W. Biederman) - 2016-04-08 22:20 +0200
Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup Andy Lutomirski <luto@amacapital.net> - 2016-04-08 22:50 +0200
Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup ebiederm@xmission.com (Eric W. Biederman) - 2016-04-08 23:50 +0200
Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup Andy Lutomirski <luto@amacapital.net> - 2016-04-09 00:00 +0200
Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup Linus Torvalds <torvalds@linux-foundation.org> - 2016-04-09 00:00 +0200
Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup ebiederm@xmission.com (Eric W. Biederman) - 2016-04-09 01:20 +0200
Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup One Thousand Gnomes <gnomes@lxorguk.ukuu.org.uk> - 2016-04-09 15:20 +0200
Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup "H. Peter Anvin" <hpa@zytor.com> - 2016-04-09 16:20 +0200
Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup ebiederm@xmission.com (Eric W. Biederman) - 2016-04-09 17:00 +0200
Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup "H. Peter Anvin" <hpa@zytor.com> - 2016-04-10 00:50 +0200
Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup Linus Torvalds <torvalds@linux-foundation.org> - 2016-04-10 02:10 +0200
Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup "H. Peter Anvin" <hpa@zytor.com> - 2016-04-10 02:20 +0200
Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup Linus Torvalds <torvalds@linux-foundation.org> - 2016-04-10 02:20 +0200
Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup Andy Lutomirski <luto@amacapital.net> - 2016-04-10 02:50 +0200
Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup "H. Peter Anvin" <hpa@zytor.com> - 2016-04-11 17:10 +0200
Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup Al Viro <viro@ZenIV.linux.org.uk> - 2016-04-12 03:40 +0200
Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup Andy Lutomirski <luto@amacapital.net> - 2016-04-11 22:20 +0200
Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup "H. Peter Anvin" <hpa@zytor.com> - 2016-04-11 22:30 +0200
Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup ebiederm@xmission.com (Eric W. Biederman) - 2016-04-12 01:50 +0200
Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup Linus Torvalds <torvalds@linux-foundation.org> - 2016-04-12 02:10 +0200
Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup ebiederm@xmission.com (Eric W. Biederman) - 2016-04-12 02:30 +0200
Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup Linus Torvalds <torvalds@linux-foundation.org> - 2016-04-12 03:20 +0200
Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup "H. Peter Anvin" <hpa@zytor.com> - 2016-04-12 03:20 +0200
Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup ebiederm@xmission.com (Eric W. Biederman) - 2016-04-12 03:40 +0200
Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup Al Viro <viro@ZenIV.linux.org.uk> - 2016-04-12 03:50 +0200
Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup Al Viro <viro@ZenIV.linux.org.uk> - 2016-04-12 03:40 +0200
Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup ebiederm@xmission.com (Eric W. Biederman) - 2016-04-12 04:30 +0200
Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup ebiederm@xmission.com (Eric W. Biederman) - 2016-04-11 22:30 +0200
Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup Andy Lutomirski <luto@amacapital.net> - 2016-04-12 19:50 +0200
Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup Linus Torvalds <torvalds@linux-foundation.org> - 2016-04-12 20:20 +0200
Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup "H. Peter Anvin" <hpa@zytor.com> - 2016-04-12 21:20 +0200
[PATCH 01/16] devpts: Attempting to get it right ebiederm@xmission.com (Eric W. Biederman) - 2016-04-15 17:50 +0200
[PATCH 08/16] devpts: Stop rolling devpts_remount by hand in devpts_mount "Eric W. Biederman" <ebiederm@xmission.com> - 2016-04-15 17:50 +0200
[PATCH 05/16] vfs: Allow unlink, and rename on expirable file mounts "Eric W. Biederman" <ebiederm@xmission.com> - 2016-04-15 17:50 +0200
[PATCH 04/16] devpts: Teach /dev/ptmx to automount the appropriate devpts via path lookup "Eric W. Biederman" <ebiederm@xmission.com> - 2016-04-15 17:50 +0200
[PATCH 09/16] devpts: Fail early (if appropriate) on overmount "Eric W. Biederman" <ebiederm@xmission.com> - 2016-04-15 17:50 +0200
[PATCH 10/16] devpts: Move parse_mount_options into fill_super "Eric W. Biederman" <ebiederm@xmission.com> - 2016-04-15 17:50 +0200
[PATCH 06/16] devpts: More obvious check for the system devpts in pty allocation "Eric W. Biederman" <ebiederm@xmission.com> - 2016-04-15 17:50 +0200
[PATCH 01/16] devpts: Use the same default mode for both /dev/ptmx and dev/pts/ptmx "Eric W. Biederman" <ebiederm@xmission.com> - 2016-04-15 17:50 +0200
[PATCH 12/16] devpts: Move the creation of /dev/pts/ptmx into fill_super "Eric W. Biederman" <ebiederm@xmission.com> - 2016-04-15 18:00 +0200
[PATCH 11/16] devpts: Make devpts_kill_sb safe if fsi is NULL "Eric W. Biederman" <ebiederm@xmission.com> - 2016-04-15 18:00 +0200
[PATCH 16/16] devpts: Kill the DEVPTS_MULTIPLE_INSTANCE config option "Eric W. Biederman" <ebiederm@xmission.com> - 2016-04-15 18:00 +0200
[PATCH 15/16] devpts: Always return a distinct instance when mounting "Eric W. Biederman" <ebiederm@xmission.com> - 2016-04-15 18:00 +0200
[PATCH 13/16] devpts: Simplify devpts_mount by using mount_nodev "Eric W. Biederman" <ebiederm@xmission.com> - 2016-04-15 18:00 +0200
[PATCH 14/16] vfs: Implement mount_super_once "Eric W. Biederman" <ebiederm@xmission.com> - 2016-04-15 18:00 +0200
Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup ebiederm@xmission.com (Eric W. Biederman) - 2016-04-12 02:10 +0200
Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup Linus Torvalds <torvalds@linux-foundation.org> - 2016-04-12 02:10 +0200
Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup ebiederm@xmission.com (Eric W. Biederman) - 2016-04-12 02:40 +0200
Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup Linus Torvalds <torvalds@linux-foundation.org> - 2016-04-12 03:00 +0200
Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup ebiederm@xmission.com (Eric W. Biederman) - 2016-04-11 22:20 +0200
Page 4 of 4 — ← Prev page 1 2 3 [4]
| From | "Eric W. Biederman" <ebiederm@xmission.com> |
|---|---|
| Date | 2016-04-15 18:00 +0200 |
| Subject | [PATCH 11/16] devpts: Make devpts_kill_sb safe if fsi is NULL |
| Message-ID | <roek2-5nF-13@gated-at.bofh.it> |
| In reply to | #1379943 |
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
---
fs/devpts/inode.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/fs/devpts/inode.c b/fs/devpts/inode.c
index 2f2760142ed2..f33744debb59 100644
--- a/fs/devpts/inode.c
+++ b/fs/devpts/inode.c
@@ -514,7 +514,8 @@ static void devpts_kill_sb(struct super_block *sb)
{
struct pts_fs_info *fsi = DEVPTS_SB(sb);
- ida_destroy(&fsi->allocated_ptys);
+ if (fsi)
+ ida_destroy(&fsi->allocated_ptys);
kfree(fsi);
kill_litter_super(sb);
}
--
2.8.1
[toc] | [prev] | [next] | [standalone]
| From | "Eric W. Biederman" <ebiederm@xmission.com> |
|---|---|
| Date | 2016-04-15 18:00 +0200 |
| Subject | [PATCH 16/16] devpts: Kill the DEVPTS_MULTIPLE_INSTANCE config option |
| Message-ID | <roek2-5nF-9@gated-at.bofh.it> |
| In reply to | #1379943 |
Retain the code that was previously enabled with
DEVPTS_MULTIPLE_INSTANCES and remove the config option, and kill the
little bit of code that existed only when DEVPTS_MULTIPLE_INSTANCES
was not selected. With the recently updated semantics userspace
actively depends on having multiple instances of devpts for correct
operation.
Having each mount of devpts return a distinct instance ensures that
user space will not accidentally stomp gid or mode devpts options, of
the primary system devpts, by mounting devpts in a chroot environment.
A guarantee that userspace will not stomp attributes of system devpts
removes the need for a setuid root pt_chown executable.
Running a userspace without DEVPTS_MULTIPLE_INSTANCES that has depends
on the current behavior and has removed a setuid root pt_chown
exectuable will allow the system devpts gid and mode options to be
stomped breaking userspace. Which makes the ability to disable the
code previously selected by DEVPTS_MULTIPLE_INSTANCES actively wrong.
The size increase by always using the DEVPTS_MULTIPLE_INSTANCE
path is minimal, and the code is much easier to maintain and
use without having two different code paths to worry about.
The documentation has been updated to relfect this change.
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
---
Documentation/filesystems/devpts.txt | 122 ++++++++++++++---------------------
drivers/tty/Kconfig | 11 ----
fs/devpts/inode.c | 34 ----------
3 files changed, 47 insertions(+), 120 deletions(-)
diff --git a/Documentation/filesystems/devpts.txt b/Documentation/filesystems/devpts.txt
index 30d2fcb32f72..984b645ac341 100644
--- a/Documentation/filesystems/devpts.txt
+++ b/Documentation/filesystems/devpts.txt
@@ -1,38 +1,32 @@
-To support containers, we now allow multiple instances of devpts filesystem,
-such that indices of ptys allocated in one instance are independent of indices
-allocated in other instances of devpts.
-
-To preserve backward compatibility, this support for multiple instances is
-enabled only if:
-
- - CONFIG_DEVPTS_MULTIPLE_INSTANCES=y, and
- - '-o newinstance' mount option is specified while mounting devpts
-
-IOW, devpts now supports both single-instance and multi-instance semantics.
-
-If CONFIG_DEVPTS_MULTIPLE_INSTANCES=n, there is no change in behavior and
-this referred to as the "legacy" mode. In this mode, the new mount options
-(-o newinstance and -o ptmxmode) will be ignored with a 'bogus option' message
-on console.
-
-If CONFIG_DEVPTS_MULTIPLE_INSTANCES=y and devpts is mounted without the
-'newinstance' option (as in current start-up scripts) the new mount binds
-to the initial kernel mount of devpts. This mode is referred to as the
-'single-instance' mode and the current, single-instance semantics are
-preserved, i.e PTYs are common across the system.
-
-The only difference between this single-instance mode and the legacy mode
-is the presence of new, '/dev/pts/ptmx' node with permissions 0000, which
-can safely be ignored.
-
-If CONFIG_DEVPTS_MULTIPLE_INSTANCES=y and 'newinstance' option is specified,
-the mount is considered to be in the multi-instance mode and a new instance
-of the devpts fs is created. Any ptys created in this instance are independent
-of ptys in other instances of devpts. Like in the single-instance mode, the
-/dev/pts/ptmx node is present. To effectively use the multi-instance mode,
-open of /dev/ptmx must be a redirected to '/dev/pts/ptmx' using a symlink or
-bind-mount.
+Each mount of the devpts filesystem is now a distinct instance from
+all other mounts of devpts. Mount options and indicies of ptys
+allocated in one instance are independent of indices allocated in
+other instances of devpts.
+
+If devpts is mounted without the 'newinstance' option (as in current
+start-up scripts) and if the initial kernel mount of devpts has not
+been exported to userspace the new mount binds to the initial kernel
+mount of devpts.
+
+If devpts is mounted with the 'newinstance' option or the initial
+internal mount of devpts has already been mounted a new instance of
+the devpts filesystem is created. Any ptys created in this instance
+are independent of the ptys created in other instances of devpts, and
+the initial permissions of those ptys are independent from the initial
+permissions from any other instance of the devpts filesystem.
+
+Ideally people will make use of the /dev/pts/ptmx device node to
+create ptys on the devpts filesystem. This can be done by updating
+userspace, bind mounting /dev/pts/ptmx onto /dev/ptmx or making
+/dev/ptmx a symlink to /dev/pts/ptmx.
+
+To be seemlessly backwards compatible an open of /dev/ptmx will look
+to see if the name pts in the same directory is the root directory of
+a devpts filesystem. If that is the case and it is not the initial
+instance of devpts /dev/pts/ptmx is opened. Otherwise the initial
+instance of devpts is opened. In older kernels /dev/ptmx did not
+perform this redirection.
Eg: A container startup script could do the following:
@@ -60,44 +54,34 @@ Per-instance limit could be set by adding mount option "max=<count>".
This feature was added in kernel 3.4 together with sysctl kernel.pty.reserve.
In kernels older than 3.4 sysctl kernel.pty.max works as per-instance limit.
-User-space changes
-------------------
+What user-space needs to do
+----------------------------
-In multi-instance mode (i.e '-o newinstance' mount option is specified at least
-once), following user-space issues should be noted.
+1. If the devpts filesystem is only mounted once /dev/pts/ptmx can be
+ ignored and no change is needed to system-startup scripts.
-1. If -o newinstance mount option is never used, /dev/pts/ptmx can be ignored
- and no change is needed to system-startup scripts.
+2. For best results userspace libraries and applications should be updated
+ to try opening /dev/pts/ptmx before /dev/ptmx, as /dev/pts/ptmx is less
+ ambiguous and higher performance.
-2. To effectively use multi-instance mode (i.e -o newinstance is specified)
- administrators or startup scripts should "redirect" open of /dev/ptmx to
- /dev/pts/ptmx using either a bind mount or symlink.
+3. To effectively use a new instance of devpts open of /dev/ptmx should
+ be redirected to /dev/pts/ptmx using either a bind mount or symlink.
$ mount -t devpts -o newinstance devpts /dev/pts
followed by either
- $ rm /dev/ptmx
$ ln -s pts/ptmx /dev/ptmx
$ chmod 666 /dev/pts/ptmx
or
$ mount -o bind /dev/pts/ptmx /dev/ptmx
-3. The '/dev/ptmx -> pts/ptmx' symlink is the preferred method since it
- enables better error-reporting and treats both single-instance and
- multi-instance mounts similarly.
-
- But this method requires that system-startup scripts set the mode of
- /dev/pts/ptmx correctly (default mode is 0000). The scripts can set the
- mode by, either
+4. The '/dev/ptmx -> pts/ptmx' symlink is the preferred method since it
+ enables better error-reporting and treats all cases the same.
- - adding ptmxmode mount option to devpts entry in /etc/fstab, or
- - using 'chmod 0666 /dev/pts/ptmx'
-
-4. If multi-instance mode mount is needed for containers, but the system
- startup scripts have not yet been updated, container-startup scripts
- should bind mount /dev/ptmx to /dev/pts/ptmx to avoid breaking single-
- instance mounts.
+5. If the system startup scripts do not create /dev/ptmx as a symlink,
+ container-startup scripts should bind mount /dev/ptmx to /dev/pts/ptmx
+ to avoid breaking the rest of the system.
Or, in general, container-startup scripts should use:
@@ -106,11 +90,9 @@ once), following user-space issues should be noted.
mount -o bind /dev/pts/ptmx /dev/ptmx
fi
- When all devpts mounts are multi-instance, /dev/ptmx can permanently be
- a symlink to pts/ptmx and the bind mount can be ignored.
-
-5. A multi-instance mount that is not accompanied by the /dev/ptmx to
- /dev/pts/ptmx redirection would result in an unusable/unreachable pty.
+6. A mount of devpts that is not accompanied by the /dev/ptmx to
+ /dev/pts/ptmx redirection will result in an unusable/unreachable pty,
+ on older kernels.
mount -t devpts -o newinstance lxcpts /dev/pts
@@ -121,21 +103,11 @@ once), following user-space issues should be noted.
would create a pty, say /dev/pts/7, in the initial kernel mount.
But /dev/pts/7 would be invisible in the new mount.
-6. The permissions for /dev/pts/ptmx node should be specified when mounting
- /dev/pts, using the '-o ptmxmode=%o' mount option (default is 0000).
+7. The permissions for /dev/pts/ptmx node should be specified when mounting
+ /dev/pts, using the '-o ptmxmode=%o' mount option (default is 0666 was 0000).
mount -t devpts -o newinstance -o ptmxmode=0644 devpts /dev/pts
The permissions can be later be changed as usual with 'chmod'.
chmod 666 /dev/pts/ptmx
-
-7. A mount of devpts without the 'newinstance' option results in binding to
- initial kernel mount. This behavior while preserving legacy semantics,
- does not provide strict isolation in a container environment. i.e by
- mounting devpts without the 'newinstance' option, a container could
- get visibility into the 'host' or root container's devpts.
-
- To workaround this and have strict isolation, all mounts of devpts,
- including the mount in the root container, should use the newinstance
- option.
diff --git a/drivers/tty/Kconfig b/drivers/tty/Kconfig
index 82c4d2e45319..95103054c0e4 100644
--- a/drivers/tty/Kconfig
+++ b/drivers/tty/Kconfig
@@ -120,17 +120,6 @@ config UNIX98_PTYS
All modern Linux systems use the Unix98 ptys. Say Y unless
you're on an embedded system and want to conserve memory.
-config DEVPTS_MULTIPLE_INSTANCES
- bool "Support multiple instances of devpts"
- depends on UNIX98_PTYS
- default n
- ---help---
- Enable support for multiple instances of devpts filesystem.
- If you want to have isolated PTY namespaces (eg: in containers),
- say Y here. Otherwise, say N. If enabled, each mount of devpts
- filesystem with the '-o newinstance' option will create an
- independent PTY namespace.
-
config LEGACY_PTYS
bool "Legacy (BSD) PTY support"
default y
diff --git a/fs/devpts/inode.c b/fs/devpts/inode.c
index e5e533fe824a..9ae15ef06475 100644
--- a/fs/devpts/inode.c
+++ b/fs/devpts/inode.c
@@ -109,11 +109,9 @@ static const match_table_t tokens = {
{Opt_uid, "uid=%u"},
{Opt_gid, "gid=%u"},
{Opt_mode, "mode=%o"},
-#ifdef CONFIG_DEVPTS_MULTIPLE_INSTANCES
{Opt_ptmxmode, "ptmxmode=%o"},
{Opt_newinstance, "newinstance"},
{Opt_max, "max=%d"},
-#endif
{Opt_err, NULL}
};
@@ -130,10 +128,8 @@ static inline struct pts_fs_info *DEVPTS_SB(struct super_block *sb)
static inline struct super_block *pts_sb_from_inode(struct inode *inode)
{
-#ifdef CONFIG_DEVPTS_MULTIPLE_INSTANCES
if (inode->i_sb->s_magic == DEVPTS_SUPER_MAGIC)
return inode->i_sb;
-#endif
if (!devpts_mnt)
return NULL;
return devpts_mnt->mnt_sb;
@@ -206,7 +202,6 @@ static int parse_mount_options(char *data, struct pts_mount_opts *opts)
return -EINVAL;
opts->mode = option & S_IALLUGO;
break;
-#ifdef CONFIG_DEVPTS_MULTIPLE_INSTANCES
case Opt_ptmxmode:
if (match_octal(&args[0], &option))
return -EINVAL;
@@ -220,7 +215,6 @@ static int parse_mount_options(char *data, struct pts_mount_opts *opts)
return -EINVAL;
opts->max = option;
break;
-#endif
default:
pr_err("called with bogus options\n");
return -EINVAL;
@@ -230,7 +224,6 @@ static int parse_mount_options(char *data, struct pts_mount_opts *opts)
return 0;
}
-#ifdef CONFIG_DEVPTS_MULTIPLE_INSTANCES
static int mknod_ptmx(struct super_block *sb)
{
int rc = -ENOMEM;
@@ -291,16 +284,6 @@ static void update_ptmx_mode(struct pts_fs_info *fsi)
inode->i_mode = S_IFCHR|fsi->mount_opts.ptmxmode;
}
}
-#else
-static inline void update_ptmx_mode(struct pts_fs_info *fsi)
-{
- return;
-}
-static inline int mknod_ptmx(struct super_block *sb)
-{
- return 0;
-}
-#endif
static int devpts_remount(struct super_block *sb, int *flags, char *data)
{
@@ -334,11 +317,9 @@ static int devpts_show_options(struct seq_file *seq, struct dentry *root)
seq_printf(seq, ",gid=%u",
from_kgid_munged(&init_user_ns, opts->gid));
seq_printf(seq, ",mode=%03o", opts->mode);
-#ifdef CONFIG_DEVPTS_MULTIPLE_INSTANCES
seq_printf(seq, ",ptmxmode=%03o", opts->ptmxmode);
if (opts->max < NR_UNIX98_PTY_MAX)
seq_printf(seq, ",max=%d", opts->max);
-#endif
return 0;
}
@@ -429,7 +410,6 @@ fail:
return error;
}
-#ifdef CONFIG_DEVPTS_MULTIPLE_INSTANCES
/*
* devpts_mount()
*
@@ -482,18 +462,6 @@ static struct dentry *devpts_mount(struct file_system_type *fs_type,
return root;
}
-#else
-/*
- * This supports only the legacy single-instance semantics (no
- * multiple-instance semantics)
- */
-static struct dentry *devpts_mount(struct file_system_type *fs_type, int flags,
- const char *dev_name, void *data)
-{
- return mount_single(fs_type, flags, data, devpts_fill_super);
-}
-#endif
-
static void devpts_kill_sb(struct super_block *sb)
{
struct pts_fs_info *fsi = DEVPTS_SB(sb);
@@ -508,9 +476,7 @@ static struct file_system_type devpts_fs_type = {
.name = "devpts",
.mount = devpts_mount,
.kill_sb = devpts_kill_sb,
-#ifdef CONFIG_DEVPTS_MULTIPLE_INSTANCES
.fs_flags = FS_USERNS_MOUNT | FS_USERNS_DEV_MOUNT,
-#endif
};
/*
--
2.8.1
[toc] | [prev] | [next] | [standalone]
| From | "Eric W. Biederman" <ebiederm@xmission.com> |
|---|---|
| Date | 2016-04-15 18:00 +0200 |
| Subject | [PATCH 15/16] devpts: Always return a distinct instance when mounting |
| Message-ID | <roek3-5nF-25@gated-at.bofh.it> |
| In reply to | #1379943 |
When devpts is mounted and the newinstance flag is not passed the code
first checks to see if the system devpts instance has been exported to
userspace. If it has not the system devpts instance is returned
otherwise a fresh instance of devpts is allocated and returned.
If newinstance is passed a fresh devpts instance is always returned.
Combined with the earlier work to cause mounts of devpts to fail
if devpts is mounted over itself, this ensures that the system devpts
is mounted on /dev/pts on all of the systems I have tested.
This has been verified to work properly on openwrt-15.05, centos5,
centos6, centos7, debian-6.0.2, debian-7.9, debian-8.2, ubuntu-14.04.3,
ubuntu-15.10, fedora23, magia-5, mint-17.3, opensuse-42.1, slackware-14.1,
gentoo-20151225 (13.0?), archlinux-2015-12-01
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
---
fs/devpts/inode.c | 33 ++++++++++++---------------------
1 file changed, 12 insertions(+), 21 deletions(-)
diff --git a/fs/devpts/inode.c b/fs/devpts/inode.c
index c1c346190f35..e5e533fe824a 100644
--- a/fs/devpts/inode.c
+++ b/fs/devpts/inode.c
@@ -430,13 +430,6 @@ fail:
}
#ifdef CONFIG_DEVPTS_MULTIPLE_INSTANCES
-static int compare_init_pts_sb(struct super_block *s, void *p)
-{
- if (devpts_mnt)
- return devpts_mnt->mnt_sb == s;
- return 0;
-}
-
/*
* devpts_mount()
*
@@ -467,28 +460,26 @@ static int compare_init_pts_sb(struct super_block *s, void *p)
static struct dentry *devpts_mount(struct file_system_type *fs_type,
int flags, const char *dev_name, void *data)
{
- struct super_block *s;
+ struct dentry *root;
bool newinstance;
newinstance = parse_newinstance(data);
+ if (flags & MS_KERNMOUNT)
+ newinstance = true;
- /* Require newinstance for all user namespace mounts to ensure
+ /* Force newinstance for all user namespace mounts to ensure
* the mount options are not changed.
*/
- if ((current_user_ns() != &init_user_ns) && !newinstance)
- return ERR_PTR(-EINVAL);
-
- if (newinstance)
- return mount_nodev(fs_type, flags, data, devpts_fill_super);
-
- s = sget(fs_type, compare_init_pts_sb, set_anon_super, flags, NULL);
- if (IS_ERR(s))
- return ERR_CAST(s);
+ if (current_user_ns() != &init_user_ns)
+ newinstance = true;
- /* Match mount_single ignore errors on remount */
- devpts_remount(s, &flags, data);
+ root = NULL;
+ if (!newinstance)
+ root = mount_super_once(devpts_mnt->mnt_sb, flags, data);
+ if (IS_ERR_OR_NULL(root))
+ root = mount_nodev(fs_type, flags, data, devpts_fill_super);
- return dget(s->s_root);
+ return root;
}
#else
--
2.8.1
[toc] | [prev] | [next] | [standalone]
| From | "Eric W. Biederman" <ebiederm@xmission.com> |
|---|---|
| Date | 2016-04-15 18:00 +0200 |
| Subject | [PATCH 13/16] devpts: Simplify devpts_mount by using mount_nodev |
| Message-ID | <roek3-5nF-23@gated-at.bofh.it> |
| In reply to | #1379943 |
Now that all of the work of setting up a superblock has been moved to
devpts_fill_super simplify devpts_mount by calling mount_nodev instead
of rolling mount_nodev by hand.
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
---
fs/devpts/inode.c | 23 ++++-------------------
1 file changed, 4 insertions(+), 19 deletions(-)
diff --git a/fs/devpts/inode.c b/fs/devpts/inode.c
index 3aa223803a08..c1c346190f35 100644
--- a/fs/devpts/inode.c
+++ b/fs/devpts/inode.c
@@ -467,7 +467,6 @@ static int compare_init_pts_sb(struct super_block *s, void *p)
static struct dentry *devpts_mount(struct file_system_type *fs_type,
int flags, const char *dev_name, void *data)
{
- int error;
struct super_block *s;
bool newinstance;
@@ -480,30 +479,16 @@ static struct dentry *devpts_mount(struct file_system_type *fs_type,
return ERR_PTR(-EINVAL);
if (newinstance)
- s = sget(fs_type, NULL, set_anon_super, flags, NULL);
- else
- s = sget(fs_type, compare_init_pts_sb, set_anon_super, flags,
- NULL);
+ return mount_nodev(fs_type, flags, data, devpts_fill_super);
+ s = sget(fs_type, compare_init_pts_sb, set_anon_super, flags, NULL);
if (IS_ERR(s))
return ERR_CAST(s);
- if (!s->s_root) {
- error = devpts_fill_super(s, data, flags & MS_SILENT ? 1 : 0);
- if (error)
- goto out_undo_sget;
-
- s->s_flags |= MS_ACTIVE;
- } else {
- /* Match mount_single ignore errors on remount */
- devpts_remount(s, &flags, data);
- }
+ /* Match mount_single ignore errors on remount */
+ devpts_remount(s, &flags, data);
return dget(s->s_root);
-
-out_undo_sget:
- deactivate_locked_super(s);
- return ERR_PTR(error);
}
#else
--
2.8.1
[toc] | [prev] | [next] | [standalone]
| From | "Eric W. Biederman" <ebiederm@xmission.com> |
|---|---|
| Date | 2016-04-15 18:00 +0200 |
| Subject | [PATCH 14/16] vfs: Implement mount_super_once |
| Message-ID | <roek3-5nF-29@gated-at.bofh.it> |
| In reply to | #1379943 |
The devpts filesystem has a notion of a system or primary instance of
devpts. To retain the notion of a primary system instance of devpts
the code needs a way to allow userspace to mount the internally
mounted instance of devpts when it is not currently mounted by
userspace. The new helper mount_super_once allows that.
The function mount_super_once ignores vfsmounts that are in use but
are not mounted in userspace. The set of ignored mounts includes
internal mounts, lazily unmounted instances of mounts, and
loopback/bind mounts show root directory is not a filesystems root
directory.
Furthermore mount_super_once only allows exporting a mount to
userspace if it can account for every reference in s_active
on the superblock. Ensuring races do not allow two simultaneous
mount requestions export the same filesystem to userspace.
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
---
fs/super.c | 34 ++++++++++++++++++++++++++++++++++
include/linux/fs.h | 2 ++
2 files changed, 36 insertions(+)
diff --git a/fs/super.c b/fs/super.c
index 74914b1bae70..4a6552395fad 100644
--- a/fs/super.c
+++ b/fs/super.c
@@ -33,6 +33,7 @@
#include <linux/cleancache.h>
#include <linux/fsnotify.h>
#include <linux/lockdep.h>
+#include "mount.h"
#include "internal.h"
@@ -1101,6 +1102,39 @@ struct dentry *mount_single(struct file_system_type *fs_type,
}
EXPORT_SYMBOL(mount_single);
+struct dentry *mount_super_once(struct super_block *sb, int flags, void *data)
+{
+ /* Allow mounting the specified superblock by userspace if there
+ * are not any existing userspace mounts of it.
+ */
+ struct mount *mnt;
+ int count = 0;
+
+ /* Walk through the existing mounts of this superblock. Fail
+ * if any of those mounts are exported to userspace. Otherwise
+ * increment s_active if the superblock s_active count matches
+ * the number of mounts in the list. This ensures that multiple
+ * simultaneous calls to mount_super_once do not race and result
+ * in the filesystem exported to userspace multiple times.
+ */
+ lock_mount_hash();
+ list_for_each_entry(mnt, &sb->s_mounts, mnt_instance) {
+ if (is_mounted(&mnt->mnt) && (mnt->mnt.mnt_root == sb->s_root)) {
+ unlock_mount_hash();
+ return ERR_PTR(-EBUSY);
+ }
+ count++;
+ }
+ if (atomic_cmpxchg(&sb->s_active, count, count + 1) != count) {
+ unlock_mount_hash();
+ return ERR_PTR(-EBUSY);
+ }
+ unlock_mount_hash();
+ down_write(&sb->s_umount);
+ do_remount_sb(sb, flags, data, 0);
+ return dget(sb->s_root);
+}
+
struct dentry *
mount_fs(struct file_system_type *type, int flags, const char *name, void *data)
{
diff --git a/include/linux/fs.h b/include/linux/fs.h
index aade033bed49..465c1155bf72 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -2002,6 +2002,8 @@ extern struct dentry *mount_single(struct file_system_type *fs_type,
extern struct dentry *mount_nodev(struct file_system_type *fs_type,
int flags, void *data,
int (*fill_super)(struct super_block *, void *, int));
+extern struct dentry *mount_super_once(struct super_block *sb,
+ int flags, void *data);
extern struct dentry *mount_subtree(struct vfsmount *mnt, const char *path);
void generic_shutdown_super(struct super_block *sb);
void kill_block_super(struct super_block *sb);
--
2.8.1
[toc] | [prev] | [next] | [standalone]
| From | ebiederm@xmission.com (Eric W. Biederman) |
|---|---|
| Date | 2016-04-12 02:10 +0200 |
| Subject | Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup |
| Message-ID | <rmU41-6dm-1@gated-at.bofh.it> |
| In reply to | #1374690 |
Linus Torvalds <torvalds@linux-foundation.org> writes: > On Apr 9, 2016 5:45 PM, "Andy Lutomirski" <luto@amacapital.net> wrote: >> >> >> What we *do* want to do, though, is to prevent the following: > > I don't see the point. Why do you bring up this insane scenario that > nobody can possibly care about? > > So you actually have any reason to believe somebody does that? > > I already asked about that earlier, and the silence was deafening. I replied earlier. Did you not see my reply? Eric
[toc] | [prev] | [next] | [standalone]
| From | Linus Torvalds <torvalds@linux-foundation.org> |
|---|---|
| Date | 2016-04-12 02:10 +0200 |
| Subject | Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup |
| Message-ID | <rmU41-6dm-3@gated-at.bofh.it> |
| In reply to | #1376353 |
On Mon, Apr 11, 2016 at 4:49 PM, Eric W. Biederman
<ebiederm@xmission.com> wrote:
>
> I replied earlier. Did you not see my reply?
Are you talking about the one where you agreed that the scenario was
made up and insane? The one where you said that you're worried about
breaking out "extension" where ptmx is non-0666?
That was never an extension. It was a simple situation of people (a)
not knowing what the tty group should be in the kernel and (b) then
thinking that using a permission model of "no permission" somehow made
it saner.
What it actually resulted in was that most distros just ignore it
entirely, and just use /dev/ptmx.
Yes, you *can* then chmod it in user space and use a symlink, but so
what? Nobody who actually uses that node uses anythinig but 0666.
Because that would break pretty much everything that uses pty's.
So the whole "we need to worry about permission 0000" is complete and
uttter garbage. We really don't. The situation doesn't come up, and
it's not relevant. The standard part to access ptmx is /dev/ptmx, and
no amount of wishing it were otherwise will make it any different.
Seriously. Just look at the opengroup documentation. It talks about
/dev/ptmx. The whole /dev/pts/ptmx thing was a mistake. WE SHOULD NOT
EXTEND ON THAT MISTAKE.
We should just FIX the mistake. Ignore /dev/pts/ptmx, because that
node is non-standard SHIT.
Really. Really really.
Linus
[toc] | [prev] | [next] | [standalone]
| From | ebiederm@xmission.com (Eric W. Biederman) |
|---|---|
| Date | 2016-04-12 02:40 +0200 |
| Subject | Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup |
| Message-ID | <rmUx4-6uV-5@gated-at.bofh.it> |
| In reply to | #1376354 |
Linus Torvalds <torvalds@linux-foundation.org> writes: > On Mon, Apr 11, 2016 at 4:49 PM, Eric W. Biederman > <ebiederm@xmission.com> wrote: >> >> I replied earlier. Did you not see my reply? > > > Are you talking about the one where you agreed that the scenario was > made up and insane? The one where you said that you're worried about > breaking out "extension" where ptmx is non-0666? I meant the one where I conceded that the only think that it could possible protect against was a denial of service attack, from which we probably don't care. I just want to be certain that the emails are getting through. As the meaning certainly has not been. I do think I called a permision check in posix_open aka on /dev/ptmx a linux specific extension in that email. But seriously it was all about reducing the scope of the change. Reducing the size of the test matrix. I simply had not looked far enough to see if there was anything you could reasonable protect with those permissions. As I agreed with you that it was unnecessary I was just puzzled why you called what was essentially agreement with you deafening silence. Eric
[toc] | [prev] | [next] | [standalone]
| From | Linus Torvalds <torvalds@linux-foundation.org> |
|---|---|
| Date | 2016-04-12 03:00 +0200 |
| Subject | Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup |
| Message-ID | <rmUQr-6Fz-7@gated-at.bofh.it> |
| In reply to | #1376362 |
On Mon, Apr 11, 2016 at 5:22 PM, Eric W. Biederman
<ebiederm@xmission.com> wrote:
>
> I meant the one where I conceded that the only think that it could
> possible protect against was a denial of service attack, from which we
> probably don't care.
Yeah, that's the same email I was talking about, I was just quoting
another part.
> As I agreed with you that it was unnecessary I was just puzzled why you
> called what was essentially agreement with you deafening silence.
The "deafening silence" was about _why_ this all would be a problem,
and why the security checks would be needed.
Basically, I think that if /dev/pts/ is accessible, we should just say
"ok, you can open a pty on it".
The fact that you could open a pty by bind-mounting it somewhere else,
and then adding a "ptmx" node to the same directory is not a security
issue: it's simply how devpts works.
In no actual sane and relevant situation is that a problem, for the
simple fact that there will *already* be a ptmx node that is
world-accessible in the same directory that has that /dev/pts/ mount.
Anything else is insane and irrelevant. This is *literally* what POSIX
says. Sure, POSIX also has that whole language about "posix_openpt()",
but that's just BS and irrelevant. The very page that mentions
"posix_openpt()" also says
"On implementations supporting the /dev/ptmx clone device, opening
the master device of a pseudo-terminal is simply:
mfdp = open("/dev/ptmx", oflag );
if (mfdp < 0)
return -1;"
and Linux unquestionably falls in that "supports /dev/ptmx" camp.
So I claim that the _only_ sane use of devpts is to already have a
world-accessible ptmx node there, and nothing else makes sense.
And if you want to be private, you had better make the whole /dev/
subdirectory private (which also takes care of any bind mount issues)
Linus
[toc] | [prev] | [next] | [standalone]
| From | ebiederm@xmission.com (Eric W. Biederman) |
|---|---|
| Date | 2016-04-11 22:20 +0200 |
| Subject | Re: [PATCH 01/13] devpts: Teach /dev/ptmx to find the associated devpts via path lookup |
| Message-ID | <rmQts-3h1-1@gated-at.bofh.it> |
| In reply to | #1374685 |
Linus Torvalds <torvalds@linux-foundation.org> writes: > On Sat, Apr 9, 2016 at 3:37 PM, H. Peter Anvin <hpa@zytor.com> wrote: >> >> On the flipside, if we were to allow ourselves to break userspace, at this point I would suggest making /dev/pts/ptmx have a different device number and make the legacy /dev/ptmx print a warning message, after which it can at least eventually be deleted. > > You don't need a different device number. > > The /dev/pts/ptmx file may look like it's the same node as /dev/ptmx, > but it is trivial to recognize as the pts one: > > if (dentry->d_sb->s_magic == DEVPTS_SUPER_MAGIC) > > and you're done. We can actually do better and set f_ops in devpts and bypass the whole lookup by device number. In my pile of cleanups that are waiting for the mess to resolve I actually have a patch that does that for the slave ttys. > > But nobody actually uses /dev/pts/ptmx, because it has never had sane > permissions. Now that is an interesting misconception to see. There is actually a lot more software that uses /dev/pts/ptmx (with a symlink from /dev/ptmx or a bind mount to /dev/ptmx) than there is that actually needs the new compatibility behavior. Carefully written and maintained container software like lxc and docker do use "-o newinstance". Fixing the permissions and redirecting the /dev/ptmx path to /dev/pts/ptmx are not a problem when you know you are setting up a special environment. It is the one off sloppily created automation scripts like xen-create-image that gets this wrong. I say sloppily created as in practice every mount of devpts needs "-o gid=5,mode=620". If xen-create-image and related software had gotting those mount options correct pt_chown could have been done away with, with no one noticing a long time ago. Those sloppy pieces of code are probably the things we want to break least as they work after their fasion and whoever wrote them is likely long gone. So I would be surprised if there was anyone to pick up the pieces if we break them. > But when we fix bad semantics (and always just looking up the initial > pts mount really is crazy semantics) that doesn't mean that we have to > bend over backwards to not make the changed semantics visible. We > don't _break_ user space, but we also don't care about some random > test-program that checks for particular semantics. No. Bending over backwards as you call it just makes the software test matrix smaller. That part is now settled in my book and those extra permission checks will not be in the next version of this patchset. Eric
[toc] | [prev] | [standalone]
Page 4 of 4 — ← Prev page 1 2 3 [4]
Back to top | Article view | linux.kernel
csiph-web