• Pavel Emelyanov's avatar
    [NET]: Make /proc/net a symlink on /proc/self/net (v3) · e9720acd
    Pavel Emelyanov authored
    Current /proc/net is done with so called "shadows", but current
    implementation is broken and has little chances to get fixed.
    
    The problem is that dentries subtree of /proc/net directory has
    fancy revalidation rules to make processes living in different
    net namespaces see different entries in /proc/net subtree, but
    currently, tasks see in the /proc/net subdir the contents of any
    other namespace, depending on who opened the file first.
    
    The proposed fix is to turn /proc/net into a symlink, which points
    to /proc/self/net, which in turn shows what previously was in
    /proc/net - the network-related info, from the net namespace the
    appropriate task lives in.
    
    # ls -l /proc/net
    lrwxrwxrwx  1 root root 8 Mar  5 15:17 /proc/net -> self/net
    
    In other words - this behaves like /proc/mounts, but unlike
    "mounts", "net" is not a file, but a directory.
    
    Changes from v2:
    * Fixed discrepancy of /proc/net nlink count and selinux labeling
      screwup pointed out by Stephen.
    
      To get the correct nlink count the ->getattr callback for /proc/net
      is overridden to read one from the net->proc_net entry.
    
      To make selinux still work the net->proc_net entry is initialized
      properly, i.e. with the "net" name and the proc_net parent.
    
    Selinux fixes are
    Acked-by: default avatarStephen Smalley <sds@tycho.nsa.gov>
    
    Changes from v1:
    * Fixed a task_struct leak in get_proc_task_net, pointed out by Paul.
    Signed-off-by: default avatarPavel Emelyanov <xemul@openvz.org>
    Acked-by: default avatar"Eric W. Biederman" <ebiederm@xmission.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    e9720acd
net_namespace.h 3.87 KB