Re: multiple device exports for knfsd

Bill Hawes (whawes@star.net)
Fri, 21 Nov 1997 09:26:50 -0500


Olaf Kirch wrote:
> The problem with multiple exports per device is that you have to be
> extra careful with lookups, and link/rename operations between
> different exports.
>
> The first is that you have to check whether the result of a lookup(..)
> operation is in a different volume. The simplest case is that
> you don't want to move into an unexported part of the FS at all (this
> seems to be possible with the current implementation; I had quite
> elaborate checks for this in 2.1.36 but they seem to have disappeared).
> For the case you're thinking of, you'd have to apply this check also
> when moving _down_ the path because, e.g. /usr may have been assigned
> different export options than /usr/local.
>
> The second problem is e.g. with link operations. Suppose you've got
> a single disk, and exported /usr readonly with root squashing etc,
> while /home is readwrite and doesn't have root squashing. Then
> root on some client might create a hard link from /usr/bin/vi to
> /home/joedoe/vi and overwrite the file.

Could these issues be handled by requiring that looked-up dentries (i.e.
obtained from nfsd_lookup) have the export dentry as an ancester, or is
this too restrictive? If all dentries used in nfsd operations have to
come from nfsd_lookup, it seems like this would keep each operation in
its own export sandbox. Crossing mount points could happen only in
client space then.

> I didn't believe the issue was that serious for so many people; most
> other unices also support just one export per disk. However, it should
> be possible to do this if demand is really huge; but given the
> complications I would leave things the way for now until the rest
> works. (Except for restoring the pre-dentry checks for .. lookups. This
> is really a big security issue).

OK, I'll put this off for now.

> A quite different things also having to do with exports is that people
> have been complaining early on that when they export /mnt/cdrom they
> can't unmount the cdrom anymore... I'm not sure how that could be
> fixed.

I've been thinking about this, and one possibility would be to create a
registration list for each mount. Then at umount time the system could
call an unregister function for each element on the list. If possible,
the resource would be freed and the list element removed. If the list
became empty, the umount would proceed, otherwise it would fail with
EBUSY.

Right now I can't think of anything except knfsd that needs something
like this, but it would be applicable to any system needing to cache
use-counted fs resources.

Regards,
Bill