From owner-freebsd-fs Mon Aug 28 9:43:42 2000 Delivered-To: freebsd-fs@freebsd.org Received: from fledge.watson.org (fledge.watson.org [204.156.12.50]) by hub.freebsd.org (Postfix) with ESMTP id D9CB737B424; Mon, 28 Aug 2000 09:43:39 -0700 (PDT) Received: from fledge.watson.org (robert@fledge.pr.watson.org [192.0.2.3]) by fledge.watson.org (8.9.3/8.9.3) with SMTP id MAA85796; Mon, 28 Aug 2000 12:43:39 -0400 (EDT) (envelope-from robert@fledge.watson.org) Date: Mon, 28 Aug 2000 12:43:39 -0400 (EDT) From: Robert Watson X-Sender: robert@fledge.watson.org To: phk@FreeBSD.org Cc: freebsd-fs@FreeBSD.org Subject: Re: procfs_lookup() and jail interaction In-Reply-To: Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-fs@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org So I've largely resolved these concerns -- as a synthetic in-memory file system, procfs is not using the name cache -- the issue I'm running into now in procfs is with the open() syscall. Following the p_stuff patches, procfs_getattrt() and so on all return ENOENT. However, an attempt to call open(/proc/1, O_CREAT) results in an EISDIR error, instead of EROFS. I believe this may be a result of that type check happening in vn_open, above the VFS layer, resulting in procfs_* never seeing the request, and thereby revealing the presence of the directory. You can replicate this simply by calling, ``touch /proc/1'' with kern.ps_showallprocs set to 0. It should be the same if you apply the p_stuff.diff patch previously advertised on -security, which cleans up a number of inter-process authorization checks, as well as vaccess(). Robert N M Watson robert@fledge.watson.org http://www.watson.org/~robert/ PGP key fingerprint: AF B5 5F FF A6 4A 79 37 ED 5F 55 E9 58 04 6A B1 TIS Labs at Network Associates, Safeport Network Services To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-fs" in the body of the message