On Tue, Feb 21, 2017 at 03:57:47PM +0100, Oleg Nesterov wrote: > On 02/18, Alexey Gladkov wrote: > > > > This patch allows to mount only the part of /proc related to pids > > without rest objects. Since this is an addon to /proc, flags applied to > > /proc have an effect on this pidfs filesystem. > > I leave this to you and Eric, but imo it would be nice to avoid another > filesystem. > > > Why not implement it as another flag to /proc ? > > > > The /proc flags is stored in the pid_namespace and are global for > > namespace. It means that if you add a flag to hide all except the pids, > > then it will act on all mounted instances of /proc. > > But perhaps we can use mnt_flags? For example, lets abuse MNT_NODEV, see > the simple patch below. Not sure it is correct/complete, just to illustrate > the idea. > > With this patch you can mount proc with -onodev and it will only show > pids/self/thread_self: > > # mkdir /tmp/D > # mount -t proc -o nodev none /tmp/D > # ls /tmp/D > 1 11 13 15 17 19 20 22 24 28 3 31 33 4 56 7 9 > thread-self > 10 12 14 16 18 2 21 23 27 29 30 32 34 5 6 8 self > # cat /tmp/D/meminfo > cat: /tmp/D/meminfo: No such file or directory > # ls /tmp/D/irq > ls: cannot open directory /tmp/D/irq: No such file or directory > > No?
I like the idea of using mnt_flags to turn procfs into pidfs, thus avoiding yet another filesystem, but MNT_NODEV has a different meaning, namely "do not interpret character or block special devices on the file system". I've actually found a system nearby that already mounts /proc with nodev: # grep 'proc.*nodev' /proc/mounts proc /var/lib/vz/root/1002/proc proc rw,nosuid,nodev,noexec,relatime,gid=19,hidepid=2 0 0 proc /var/lib/vz/root/1003/proc proc rw,nosuid,nodev,noexec,relatime,gid=19,hidepid=2 0 0 proc /var/lib/vz/root/1004/proc proc rw,nosuid,nodev,noexec,relatime,gid=19,hidepid=2 0 0 proc /var/lib/vz/root/1005/proc proc rw,nosuid,nodev,noexec,relatime,gid=19,hidepid=2 0 0 -- ldv
pgpXDfpGgQURJ.pgp
Description: PGP signature
