Re: openg and path_to_handle

2006-12-14 Thread Matthew Wilcox
On Thu, Dec 14, 2006 at 03:00:41PM -0600, Rob Ross wrote: I don't think that I understand what you're saying here. The openg() call does not perform file open (not that that is necessarily even a first-class FS operation), it simply does the lookup. When we were naming these calls, from a

Re: openg and path_to_handle

2006-12-14 Thread Rob Ross
Christoph Hellwig wrote: On Wed, Dec 06, 2006 at 03:09:10PM -0700, Andreas Dilger wrote: While it could do that, I'd be interested to see how you'd construct the handle such that it's immune to a malicious user tampering with it, or saving it across a reboot, or constructing one from scratch.

Re: openg and path_to_handle

2006-12-14 Thread Rob Ross
Matthew Wilcox wrote: On Thu, Dec 14, 2006 at 03:00:41PM -0600, Rob Ross wrote: I don't think that I understand what you're saying here. The openg() call does not perform file open (not that that is necessarily even a first-class FS operation), it simply does the lookup. When we were naming

Re: openg and path_to_handle

2006-12-06 Thread David Chinner
On Wed, Dec 06, 2006 at 09:53:39AM -0600, Rob Ross wrote: David Chinner wrote: On Tue, Dec 05, 2006 at 05:47:16PM +0100, Latchesar Ionkov wrote: On 12/5/06, Rob Ross [EMAIL PROTECTED] wrote: Hi, I agree that it is not feasible to add new system calls every time somebody has a problem, and

Re: openg and path_to_handle

2006-12-06 Thread Matthew Wilcox
On Thu, Dec 07, 2006 at 07:40:05AM +1100, David Chinner wrote: Permission checks are done on the path_to_handle(), so in reality only root or CAP_SYS_ADMIN users can currently use the open_by_handle interface because of this lack of checking. Given that our current users of this interface need

Re: openg and path_to_handle

2006-12-06 Thread David Chinner
On Wed, Dec 06, 2006 at 10:20:23AM -0600, Rob Ross wrote: Matthew Wilcox wrote: On Wed, Dec 06, 2006 at 09:53:39AM -0600, Rob Ross wrote: David Chinner wrote: Does anyone here know about the XFS libhandle API? This has been around for years and it does _exactly_ what these proposed syscalls

Re: openg and path_to_handle

2006-12-06 Thread Rob Ross
David Chinner wrote: On Wed, Dec 06, 2006 at 09:53:39AM -0600, Rob Ross wrote: David Chinner wrote: On Tue, Dec 05, 2006 at 05:47:16PM +0100, Latchesar Ionkov wrote: On 12/5/06, Rob Ross [EMAIL PROTECTED] wrote: Hi, I agree that it is not feasible to add new system calls every time somebody

Re: openg and path_to_handle

2006-12-06 Thread David Chinner
On Wed, Dec 06, 2006 at 02:50:49PM -0600, Rob Ross wrote: David Chinner wrote: On Wed, Dec 06, 2006 at 09:53:39AM -0600, Rob Ross wrote: David Chinner wrote: Does anyone here know about the XFS libhandle API? This has been around for years and it does _exactly_ what these proposed syscalls

Re: openg and path_to_handle

2006-12-06 Thread David Chinner
On Wed, Dec 06, 2006 at 01:50:24PM -0700, Matthew Wilcox wrote: On Thu, Dec 07, 2006 at 07:40:05AM +1100, David Chinner wrote: Permission checks are done on the path_to_handle(), so in reality only root or CAP_SYS_ADMIN users can currently use the open_by_handle interface because of this

Re: openg and path_to_handle

2006-12-06 Thread Matthew Wilcox
On Wed, Dec 06, 2006 at 03:09:10PM -0700, Andreas Dilger wrote: Considering that filesystems like GFS and OCFS allow clients DIRECT ACCESS to the block device itself (which no amount of authentication will fix, unless it is in the disks themselves), the risk of passing a file handle around is

Re: openg and path_to_handle

2006-12-06 Thread Latchesar Ionkov
On 12/6/06, Rob Ross [EMAIL PROTECTED] wrote: David Chinner wrote: On Tue, Dec 05, 2006 at 05:47:16PM +0100, Latchesar Ionkov wrote: On 12/5/06, Rob Ross [EMAIL PROTECTED] wrote: Hi, I agree that it is not feasible to add new system calls every time somebody has a problem, and we don't

Re: openg and path_to_handle

2006-12-06 Thread Christoph Hellwig
On Wed, Dec 06, 2006 at 03:09:10PM -0700, Andreas Dilger wrote: While it could do that, I'd be interested to see how you'd construct the handle such that it's immune to a malicious user tampering with it, or saving it across a reboot, or constructing one from scratch. If the server has to