linux/net
Dave Hansen ce8d2cdf3d r/o bind mounts: filesystem helpers for custom 'struct file's
Why do we need r/o bind mounts?

This feature allows a read-only view into a read-write filesystem.  In the
process of doing that, it also provides infrastructure for keeping track of
the number of writers to any given mount.

This has a number of uses.  It allows chroots to have parts of filesystems
writable.  It will be useful for containers in the future because users may
have root inside a container, but should not be allowed to write to
somefilesystems.  This also replaces patches that vserver has had out of the
tree for several years.

It allows security enhancement by making sure that parts of your filesystem
read-only (such as when you don't trust your FTP server), when you don't want
to have entire new filesystems mounted, or when you want atime selectively
updated.  I've been using the following script to test that the feature is
working as desired.  It takes a directory and makes a regular bind and a r/o
bind mount of it.  It then performs some normal filesystem operations on the
three directories, including ones that are expected to fail, like creating a
file on the r/o mount.

This patch:

Some filesystems forego the vfs and may_open() and create their own 'struct
file's.

This patch creates a couple of helper functions which can be used by these
filesystems, and will provide a unified place which the r/o bind mount code
may patch.

Also, rename an existing, static-scope init_file() to a less generic name.

Signed-off-by: Dave Hansen <haveblue@us.ibm.com>
Cc: Christoph Hellwig <hch@lst.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2007-10-17 08:43:04 -07:00
..
9p 9p: fix bad error path in conversion routines 2007-08-23 10:25:05 -05:00
802 [NET]: Move hardware header operations out of netdevice. 2007-10-10 16:52:52 -07:00
8021q [8021Q]: transfer dev_id from real device 2007-10-10 16:54:56 -07:00
appletalk [NET]: sparse warning fixes 2007-10-10 16:54:48 -07:00
atm Driver core: change add_uevent_var to use a struct 2007-10-12 14:51:01 -07:00
ax25 [NET]: Move hardware header operations out of netdevice. 2007-10-10 16:52:52 -07:00
bluetooth [BLUETOOTH]: Make hidp_setup_input() return int 2007-10-10 16:52:39 -07:00
bridge [BRIDGE]: Remove SKB share checks in br_nf_pre_routing(). 2007-10-15 12:26:35 -07:00
core [NEIGH]: Ensure that pneigh_lookup is protected with RTNL 2007-10-15 12:54:15 -07:00
dccp [IPV6]: Replace sk_buff ** with sk_buff * in input handlers 2007-10-15 12:50:28 -07:00
decnet [NETFILTER]: Replace sk_buff ** with sk_buff * 2007-10-15 12:26:29 -07:00
econet [NET]: Wrap netdevice hardware header creation. 2007-10-10 16:52:50 -07:00
ethernet [NET]: Move hardware header operations out of netdevice. 2007-10-10 16:52:52 -07:00
ieee80211 [IEEE80211]: Fix softmac lockdep reports. 2007-10-10 16:52:22 -07:00
ipv4 [INET]: kmalloc+memset -> kzalloc in frag_alloc_queue 2007-10-15 12:53:13 -07:00
ipv6 [IPV6]: Consolidate the ip6_pol_route_(input|output) pair 2007-10-15 13:02:51 -07:00
ipx [NET]: Make the device list and device lookups per namespace. 2007-10-10 16:49:10 -07:00
irda [IRDA]: Make the IRDA use the seq_open_private() 2007-10-10 16:55:35 -07:00
iucv [AF_IUCV]: postpone receival of iucv-packets 2007-10-10 16:54:51 -07:00
key [IPSEC]: Lock state when copying non-atomic fields to user-space 2007-10-10 16:55:02 -07:00
lapb [PATCH] remove many unneeded #includes of sched.h 2007-02-14 08:09:54 -08:00
llc [NET]: Introduce and use print_mac() and DECLARE_MAC_BUF() 2007-10-10 16:51:42 -07:00
mac80211 [PATCH] mac80211: Defer setting of RX_FLAG_DECRYPTED. 2007-10-10 16:55:23 -07:00
netfilter [NETFILTER]: Replace sk_buff ** with sk_buff * 2007-10-15 12:26:29 -07:00
netlabel [NETLINK]: Introduce nested and byteorder flag to netlink attribute 2007-10-10 16:49:16 -07:00
netlink [NETLINK]: Don't leak 'listeners' in netlink_kernel_create() 2007-10-15 12:26:32 -07:00
netrom [NET]: Move hardware header operations out of netdevice. 2007-10-10 16:52:52 -07:00
packet [NET]: Move hardware header operations out of netdevice. 2007-10-10 16:52:52 -07:00
rfkill [RFKILL]: Add support for hardware-only rfkill buttons 2007-10-10 16:54:11 -07:00
rose [NET]: Move hardware header operations out of netdevice. 2007-10-10 16:52:52 -07:00
rxrpc KEYS: Make request_key() and co fundamentally asynchronous 2007-10-17 08:42:57 -07:00
sched [NETFILTER]: Replace sk_buff ** with sk_buff * 2007-10-15 12:26:29 -07:00
sctp Remove "unsafe" from module struct 2007-10-17 08:42:49 -07:00
sunrpc Slab API: remove useless ctor parameter and reorder parameters 2007-10-17 08:42:45 -07:00
tipc [NET]: Wrap netdevice hardware header creation. 2007-10-10 16:52:50 -07:00
unix sched: affine sync wakeups 2007-10-15 17:00:19 +02:00
wanrouter [NET]: Make /proc/net per network namespace 2007-10-10 16:49:06 -07:00
wireless Driver core: change add_uevent_var to use a struct 2007-10-12 14:51:01 -07:00
x25 [NET]: Make the device list and device lookups per namespace. 2007-10-10 16:49:10 -07:00
xfrm [NET]: make netlink user -> kernel interface synchronious 2007-10-10 21:15:29 -07:00
compat.c O_CLOEXEC for SCM_RIGHTS 2007-07-16 09:05:45 -07:00
Kconfig [NET]: Add network namespace clone & unshare support. 2007-10-10 16:52:46 -07:00
Makefile 9p: Reorganization of 9p file system code 2007-07-14 15:13:40 -05:00
nonet.c
socket.c r/o bind mounts: filesystem helpers for custom 'struct file's 2007-10-17 08:43:04 -07:00
sysctl_net.c
TUNABLE