1. 22 Mar, 2011 1 commit
  2. 21 Mar, 2011 7 commits
  3. 20 Mar, 2011 10 commits
  4. 18 Mar, 2011 5 commits
    • Josef Bacik's avatar
      fs: call security_d_instantiate in d_obtain_alias V2 · 24ff6663
      Josef Bacik authored
      
      
      While trying to track down some NFS problems with BTRFS, I kept noticing I was
      getting -EACCESS for no apparent reason.  Eric Paris and printk() helped me
      figure out that it was SELinux that was giving me grief, with the following
      denial
      
      type=AVC msg=audit(1290013638.413:95): avc:  denied  { 0x800000 } for  pid=1772
      comm="nfsd" name="" dev=sda1 ino=256 scontext=system_u:system_r:kernel_t:s0
      tcontext=system_u:object_r:unlabeled_t:s0 tclass=file
      
      Turns out this is because in d_obtain_alias if we can't find an alias we create
      one and do all the normal instantiation stuff, but we don't do the
      security_d_instantiate.
      
      Usually we are protected from getting a hashed dentry that hasn't yet run
      security_d_instantiate() by the parent's i_mutex, but obviously this isn't an
      option there, so in order to deal with the case that a second thread comes in
      and finds our new dentry before we get to run security_d_instantiate(), we go
      ahead and call it if we find a dentry already.  Eric assures me that this is ok
      as the code checks to see if the dentry has been initialized already so calling
      security_d_instantiate() against the same dentry multiple times is ok.  With
      this patch I'm no longer getting errant -EACCESS values.
      Signed-off-by: default avatarJosef Bacik <josef@redhat.com>
      Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      24ff6663
    • Al Viro's avatar
      lose 'mounting_here' argument in ->d_manage() · 1aed3e42
      Al Viro authored
      
      
      it's always false...
      Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      1aed3e42
    • Al Viro's avatar
      don't pass 'mounting_here' flag to follow_down() · 7cc90cc3
      Al Viro authored
      
      
      it's always false now
      Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      7cc90cc3
    • Al Viro's avatar
      change the locking order for namespace_sem · b12cea91
      Al Viro authored
      
      
      Have it nested inside ->i_mutex.  Instead of using follow_down()
      under namespace_sem, followed by grabbing i_mutex and checking that
      mountpoint to be is not dead, do the following:
      	grab i_mutex
      	check that it's not dead
      	grab namespace_sem
      	see if anything is mounted there
      	if not, we've won
      	otherwise
      		drop locks
      		put_path on what we had
      		replace with what's mounted
      		retry everything with new mountpoint to be
      
      New helper (lock_mount()) does that.  do_add_mount(), do_move_mount(),
      do_loopback() and pivot_root() switched to it; in case of the last
      two that eliminates a race we used to have - original code didn't
      do follow_down().
      Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      b12cea91
    • Al Viro's avatar
      fix deadlock in pivot_root() · 27cb1572
      Al Viro authored
      
      
      Don't hold vfsmount_lock over the loop traversing ->mnt_parent;
      do check_mnt(new.mnt) under namespace_sem instead; combined with
      namespace_sem held over all that code it'll guarantee the stability
      of ->mnt_parent chain all the way to the root.
      
      Doing check_mnt() outside of namespace_sem in case of pivot_root()
      is wrong anyway.
      Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      27cb1572
  5. 17 Mar, 2011 4 commits
  6. 16 Mar, 2011 13 commits