LWN: Comments on "Removing the kthread freezer?"

Removing the kthread freezer?

mcgrof — Tue, 08 May 2018 18:57:27 +0000

The notes from the session:

https://lkml.kernel.org/r/20180426212243.GA27853@wotan.su...

nasty ioctl()

amir73il — Sun, 29 Apr 2018 08:31:58 +0000

FYI, the "nasty ioctl()" is LOOP_CHANGE_FD:
https://mirrors.edge.kernel.org/pub/linux/kernel/people/a...

Not only can one use this ioctl to change the filesystem dependency graph, but it could also be used by an evil privileged user to loop a device into a backing file that is created inside the file system that is mounted on the loop device itself. Don't try this at home..

If we had a dependency graph, LOOP_CHANGE_FD can be fixed to not allow creating loops in the graph.

Removing the kthread freezer?

neilbrown — Fri, 27 Apr 2018 02:41:39 +0000

> so containers can get leaks from the parent's domain.

Leaks of what, exactly?
Leaks of the list of existing devices?
Leaks of a list of which devices are mounted - any maybe which filesystem. Don't need to expose options is sysfs, they already appear in /proc/mounts.

Maybe there would be leaks, but without being specific they are hard to reason about.

In sysfs there is a file I can write to which removes a disk drive from the system. Does that mean someone in a container can already unplug someone else's disk drive?

Removing the kthread freezer?

Cyberax — Thu, 26 Apr 2018 08:08:34 +0000

I would guess that /sys is not namespace-aware, so containers can get leaks from the parent's domain.

Perhaps /proc is a better place?

Removing the kthread freezer?

neilbrown — Thu, 26 Apr 2018 03:03:27 +0000

> Nice except for the naming problem, and the information leak.

Every filesystem has a bdi, and every bdi has a unique name. Maybe some filesytems have multiple bdi, but they can choose one. Actually, every filesystem has a unique st_dev, does it not?

> /sys does a reasonable job for hardware but once we get into software abstractions it can be a real drag on maintenance.

Seems to work well enough for md, which can be seen extremely simple filesystem - certainly not hardware. All of /sys/devices/virtual isn't hardware (though some bits are closer than other bits).
Now I confess that md is represented in /sys/devices in an unfortunate way - it should have its own bus rather hang just hanging off block devices - so it shouldn't serve as a model. It can serve as an existence proof though.

Can you say more about the "information leak" issue?

Thanks.

Removing the kthread freezer?

ebiederm — Wed, 25 Apr 2018 22:40:31 +0000

Nice except for the naming problem, and the information leak.

/sys does a reasonable job for hardware but once we get into software abstractions it can be a real drag on maintenance.

Placing filesystem instances in sysfs does not seem like a good idea at all.

Removing the kthread freezer?

neilbrown — Wed, 25 Apr 2018 21:01:08 +0000

> It would have nodes for filesystems and devices, with edges that describe the dependencies between them

Maybe we will, at last, get individual filesystems appearing in /sys/devices - with symlinks for dependencies. That would be nice.