nullfs: stop lying about mount flags in statfs(2)

[kib]

Summary

Flags should not propagate from the lower fs.  Behavior for the upper fs
is determined by flags from its mount point structure.  When lower fs
acts according to its mount configuration, it is reported up as VOP
errors.

PR:     283425

[markj]

When lower fs acts according to its mount configuration, it is reported up as VOP errors.

I do not quite understand what you mean here.

sys/fs/nullfs/null_vfsops.c

367–368

This comment isn't really explaining anything anymore, nothing is being faked.

[kib]

In D48150#1098146, @markj wrote:

When lower fs acts according to its mount configuration, it is reported up as VOP errors.

I do not quite understand what you mean here.

I mean that mnt_flags from lower fs do not need to be propagated to upper fs to make the mount operate correctly. Lower fs flags are checked when bypass calls lower VOP. So there is no need to 'fake' mnt_flags for upper fs, and esp. to fake it for only reporting to user in statfs(2).

[markj]

In D48150#1098159, @kib wrote:

In D48150#1098146, @markj wrote:

When lower fs acts according to its mount configuration, it is reported up as VOP errors.

I do not quite understand what you mean here.

I mean that mnt_flags from lower fs do not need to be propagated to upper fs to make the mount operate correctly. Lower fs flags are checked when bypass calls lower VOP. So there is no need to 'fake' mnt_flags for upper fs, and esp. to fake it for only reporting to user in statfs(2).

Suppose a filesystem has MNT_NOSUID set, and contains a setuid root executable. If I create a nullfs mount of that filesystem and run the executable though nullfs, should the suid bit be honoured? I would expect not, but it is. In particular, MNT_NOSUID is not copied to the upper mount, and the code which checks MNT_NOSUID does not use a VOP, it just checks vp->v_mount->mnt_flags.

[kib]

In D48150#1098161, @markj wrote:

Suppose a filesystem has MNT_NOSUID set, and contains a setuid root executable. If I create a nullfs mount of that filesystem and run the executable though nullfs, should the suid bit be honoured? I would expect not, but it is. In particular, MNT_NOSUID is not copied to the upper mount, and the code which checks MNT_NOSUID does not use a VOP, it just checks vp->v_mount->mnt_flags.

This is the current behavior, before or after the change, and in fact it is not that weird. Imagine that instead of nullfs, the lower fs is exported and mounted by nfs. The result is same.

[markj]

In D48150#1098165, @kib wrote:

In D48150#1098161, @markj wrote:

Suppose a filesystem has MNT_NOSUID set, and contains a setuid root executable. If I create a nullfs mount of that filesystem and run the executable though nullfs, should the suid bit be honoured? I would expect not, but it is. In particular, MNT_NOSUID is not copied to the upper mount, and the code which checks MNT_NOSUID does not use a VOP, it just checks vp->v_mount->mnt_flags.

This is the current behavior, before or after the change, and in fact it is not that weird. Imagine that instead of nullfs, the lower fs is exported and mounted by nfs. The result is same.

Indeed, I understand that this change is mostly cosmetic. The current behaviour is quite surprising IMO: some properties of the lower mount are preserved, e.g., RO, while others are not, e.g., NOSUID, NOEXEC. I would expect nullfs to inherit those properties from the lower mountpoint. The code you're deleting suggests that others assumed the same behaviour.