tkernel: shield_mounts: filter mountstats for shielded mounts · Pull Request !978 · OpenCloudOS/OpenCloudOS-Kernel

## Problem

The shield mounts feature hides administrator-marked mounts
from containers in /proc/self/mounts and /proc/self/mountinfo
(fs/proc_namespace.c:110 and :147), but show_vfsstat() at
fs/proc_namespace.c:204 has no shield check, so a process
inside a container can still read the device name and mount
point of every shielded mount from /proc/self/mountstats.

## Root Cause

Commit 7dbd79cf59e8 ("tkernel: mounts: add shield mountpoint
in container support") hooked two of the three show helpers in
fs/proc_namespace.c and missed show_vfsstat().  mountstats is
registered S_IRUSR in fs/proc/base.c, and the owner is the
reading process itself, so the permission bits do not keep
container processes out.

## Fix

Add the same is_mount_shielded() guard at the top of
show_vfsstat() that the other two show helpers already use,
initialising err to 0 for the early skip path.  When the
feature is disabled the stub inlines to false and the output
is unchanged.

## Testing

- Built fs/proc_namespace.o with CONFIG_TKERNEL_SHIELD_MOUNTS
  =y and =n under W=1: 0 warnings in both configurations.
- Full tkernel kselftest suite in QEMU: OVERALL PASS
  (killblock/killprotect/irqlatency 12 each, ttools 4).
- scripts/checkpatch.pl --terse --no-tree: 0 errors.
- make dist-check-commit: PASS.

Upstream status: downstream-only

## Risk

Low: three-line guard identical in shape to the two existing
call sites; with the feature off the stub returns false and
behaviour is bit-identical.  No ABI change.

类型	指派人员	状态
审查	zoucao Huang Cun Jianping Liu	已完成 (0/0人)
测试	Jianping Liu	已完成 (0/0人)

GVPOpenCloudOS / OpenCloudOS-Kernel

搜索帮助

GVP OpenCloudOS / OpenCloudOS-Kernel