<!-- 
RSS generated by JIRA (9.4.14#940014-sha1:734e6822bbf0d45eff9af51f82432957f73aa32c) at Sat Feb 10 02:35:09 UTC 2024

It is possible to restrict the fields that are returned in this document by specifying the 'field' parameter in your request.
For example, to request only the issue key and summary append 'field=key&field=summary' to the URL of your request.
-->
<rss version="0.92" >
<channel>
    <title>Whamcloud Community JIRA</title>
    <link>https://jira.whamcloud.com</link>
    <description>This file is an XML representation of an issue</description>
    <language>en-us</language>    <build-info>
        <version>9.4.14</version>
        <build-number>940014</build-number>
        <build-date>05-12-2023</build-date>
    </build-info>


<item>
            <title>[LU-10444] l_getidentity keeps remount /sys/kernel/debug and reverting permissions.</title>
                <link>https://jira.whamcloud.com/browse/LU-10444</link>
                <project id="10000" key="LU">Lustre</project>
                    <description>&lt;p&gt;We change the permissions of /sys/kernel/debug to 755. But it kept revering to 700.&lt;/p&gt;

&lt;p&gt;Using systemtap script&lt;/p&gt;
&lt;div class=&quot;code panel&quot; style=&quot;border-width: 1px;&quot;&gt;&lt;div class=&quot;codeContent panelContent&quot;&gt;
&lt;pre class=&quot;code-java&quot;&gt;#!/usr/bin/env stap

probe kernel.function(&lt;span class=&quot;code-quote&quot;&gt;&quot;debug_mount&quot;&lt;/span&gt;) {
 printf(&lt;span class=&quot;code-quote&quot;&gt;&quot;mounting &quot;&lt;/span&gt;)
 printf(&lt;span class=&quot;code-quote&quot;&gt;&quot;pid %i %s %s %s \n&quot;&lt;/span&gt;, pid(),execname(), cmdline_str(), caller())
 print_backtrace()
}

probe kernel.function(&lt;span class=&quot;code-quote&quot;&gt;&quot;debugfs_remount&quot;&lt;/span&gt;) {
 printf(&lt;span class=&quot;code-quote&quot;&gt;&quot;remounting &quot;&lt;/span&gt;)
 printf(&lt;span class=&quot;code-quote&quot;&gt;&quot;pid %i %s %s %s \n&quot;&lt;/span&gt;, pid(),execname(), cmdline_str(), caller())
 print_backtrace()
}


&lt;/pre&gt;
&lt;/div&gt;&lt;/div&gt;
&lt;p&gt;I tracked this down to l_getidentity. Specificly cfs_get_param_paths keeps remounting /sys/kernel/debug.&lt;/p&gt;
&lt;div class=&quot;code panel&quot; style=&quot;border-width: 1px;&quot;&gt;&lt;div class=&quot;codeContent panelContent&quot;&gt;
&lt;pre class=&quot;code-java&quot;&gt;# mount -o remount,mode=755 /sys/kernel/debug
debugfs on /sys/kernel/debug type debugfs (rw,relatime,mode=755)

&lt;/pre&gt;
&lt;/div&gt;&lt;/div&gt;
&lt;p&gt;Here is the output from the systemtap&lt;/p&gt;
&lt;div class=&quot;code panel&quot; style=&quot;border-width: 1px;&quot;&gt;&lt;div class=&quot;codeContent panelContent&quot;&gt;
&lt;pre class=&quot;code-java&quot;&gt;nbp1-mds ~ # stap -v debug_mount.stp 
Pass 1: parsed user script and 468 library scripts using 122940virt/39548res/3192shr/36448data kb, in 340usr/20sys/351real ms.
Pass 2: analyzed script: 2 probes, 22 functions, 5 embeds, 0 globals using 161632virt/79356res/4388shr/75140data kb, in 580usr/80sys/665real ms.
Pass 3: translated to C into &lt;span class=&quot;code-quote&quot;&gt;&quot;/tmp/stapYTzkIl/stap_6d34b35e04d11e38ae0c8b364ac253de_10487_src.c&quot;&lt;/span&gt; using 162160virt/80148res/4692shr/75668data kb, in 340usr/10sys/353real ms.
Pass 4: compiled C into &lt;span class=&quot;code-quote&quot;&gt;&quot;stap_6d34b35e04d11e38ae0c8b364ac253de_10487.ko&quot;&lt;/span&gt; in 5660usr/860sys/5857real ms.
Pass 5: starting run.
mounting pid 9739 l_getidentity &lt;span class=&quot;code-quote&quot;&gt;&quot;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&quot; mount_fs 0xffffffff811fec69 
 0xffffffff81289120 : debug_mount+0x0/0x20 [kernel]
 0xffffffff811fec69 : mount_fs+0x39/0x1b0 [kernel]
 0xffffffff8121b5c7 : vfs_kern_mount+0x67/0x110 [kernel]
 0xffffffff8121dad3 : do_mount+0x233/0xaf0 [kernel]
 0xffffffff8121e716 : SyS_mount+0x96/0xf0 [kernel]
 0xffffffff81695b89 : system_call_fastpath+0x16/0x1b [kernel]
remounting pid 9739 l_getidentity &lt;span class=&quot;code-quote&quot;&gt;&quot;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&quot; do_remount_sb 0xffffffff811fe7c2 
 0xffffffff81289330 : debugfs_remount+0x0/0x50 [kernel]
 0xffffffff811fe7c2 : do_remount_sb+0x72/0x200 [kernel]
 0xffffffff811feb07 : mount_single+0x57/0xc0 [kernel]
 0xffffffff81289138 : debug_mount+0x18/0x20 [kernel]
 0xffffffff811fec69 : mount_fs+0x39/0x1b0 [kernel]
 0xffffffff8121b5c7 : vfs_kern_mount+0x67/0x110 [kernel]
 0xffffffff8121dad3 : do_mount+0x233/0xaf0 [kernel]
 0xffffffff8121e716 : SyS_mount+0x96/0xf0 [kernel]
 0xffffffff81695b89 : system_call_fastpath+0x16/0x1b [kernel]
mounting pid 9779 l_getidentity &lt;span class=&quot;code-quote&quot;&gt;&quot;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&quot; mount_fs 0xffffffff811fec69 
 0xffffffff81289120 : debug_mount+0x0/0x20 [kernel]
 0xffffffff811fec69 : mount_fs+0x39/0x1b0 [kernel]
 0xffffffff8121b5c7 : vfs_kern_mount+0x67/0x110 [kernel]
 0xffffffff8121dad3 : do_mount+0x233/0xaf0 [kernel]
 0xffffffff8121e716 : SyS_mount+0x96/0xf0 [kernel]
 0xffffffff81695b89 : system_call_fastpath+0x16/0x1b [kernel]
remounting pid 9779 l_getidentity &lt;span class=&quot;code-quote&quot;&gt;&quot;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&lt;span class=&quot;code-quote&quot;&gt;&quot; &quot;&lt;/span&gt;&quot; do_remount_sb 0xffffffff811fe7c2 
 0xffffffff81289330 : debugfs_remount+0x0/0x50 [kernel]
 0xffffffff811fe7c2 : do_remount_sb+0x72/0x200 [kernel]
 0xffffffff811feb07 : mount_single+0x57/0xc0 [kernel]
 0xffffffff81289138 : debug_mount+0x18/0x20 [kernel]
 0xffffffff811fec69 : mount_fs+0x39/0x1b0 [kernel]
 0xffffffff8121b5c7 : vfs_kern_mount+0x67/0x110 [kernel]
 0xffffffff8121dad3 : do_mount+0x233/0xaf0 [kernel]
 0xffffffff8121e716 : SyS_mount+0x96/0xf0 [kernel]
 0xffffffff81695b89 : system_call_fastpath+0x16/0x1b [kernel]
&lt;/pre&gt;
&lt;/div&gt;&lt;/div&gt;</description>
                <environment></environment>
        <key id="50007">LU-10444</key>
            <summary>l_getidentity keeps remount /sys/kernel/debug and reverting permissions.</summary>
                <type id="1" iconUrl="https://jira.whamcloud.com/secure/viewavatar?size=xsmall&amp;avatarId=11303&amp;avatarType=issuetype">Bug</type>
                                            <priority id="3" iconUrl="https://jira.whamcloud.com/images/icons/priorities/major.svg">Major</priority>
                        <status id="5" iconUrl="https://jira.whamcloud.com/images/icons/statuses/resolved.png" description="A resolution has been taken, and it is awaiting verification by reporter. From here issues are either reopened, or are closed.">Resolved</status>
                    <statusCategory id="3" key="done" colorName="success"/>
                                    <resolution id="1">Fixed</resolution>
                                        <assignee username="green">Oleg Drokin</assignee>
                                    <reporter username="mhanafi">Mahmoud Hanafi</reporter>
                        <labels>
                    </labels>
                <created>Fri, 29 Dec 2017 07:32:58 +0000</created>
                <updated>Fri, 9 Feb 2018 21:57:43 +0000</updated>
                            <resolved>Sun, 14 Jan 2018 15:39:17 +0000</resolved>
                                    <version>Lustre 2.10.1</version>
                                    <fixVersion>Lustre 2.11.0</fixVersion>
                    <fixVersion>Lustre 2.10.4</fixVersion>
                                        <due></due>
                            <votes>0</votes>
                                    <watches>10</watches>
                                                                            <comments>
                            <comment id="217255" author="green" created="Fri, 29 Dec 2017 17:11:29 +0000"  >&lt;p&gt;hm.. Yes, this is a bug in this patch &lt;a href=&quot;https://review.whamcloud.com/25182.-&quot; class=&quot;external-link&quot; target=&quot;_blank&quot; rel=&quot;nofollow noopener&quot;&gt;https://review.whamcloud.com/25182.-&lt;/a&gt; we really should be checking if the fs is mounted before trying to mount it as the first step.&lt;/p&gt;

&lt;p&gt;Let me see if I can make a simple patch.&lt;/p&gt;</comment>
                            <comment id="217276" author="gerrit" created="Sat, 30 Dec 2017 03:17:29 +0000"  >&lt;p&gt;Oleg Drokin (oleg.drokin@intel.com) uploaded a new patch: &lt;a href=&quot;https://review.whamcloud.com/30675&quot; class=&quot;external-link&quot; target=&quot;_blank&quot; rel=&quot;nofollow noopener&quot;&gt;https://review.whamcloud.com/30675&lt;/a&gt;&lt;br/&gt;
Subject: &lt;a href=&quot;https://jira.whamcloud.com/browse/LU-10444&quot; title=&quot;l_getidentity keeps remount /sys/kernel/debug and reverting permissions.&quot; class=&quot;issue-link&quot; data-issue-key=&quot;LU-10444&quot;&gt;&lt;del&gt;LU-10444&lt;/del&gt;&lt;/a&gt; utils: Don&apos;t remount debugfs every time&lt;br/&gt;
Project: fs/lustre-release&lt;br/&gt;
Branch: master&lt;br/&gt;
Current Patch Set: 1&lt;br/&gt;
Commit: 64e656deebdc977593c6d43e7a5ee50c045803dc&lt;/p&gt;</comment>
                            <comment id="217328" author="simmonsja" created="Tue, 2 Jan 2018 19:30:02 +0000"  >&lt;p&gt;That is really strange. You would think it would return -EBUSY in that case instead of remounting.&lt;/p&gt;</comment>
                            <comment id="217332" author="mhanafi" created="Tue, 2 Jan 2018 22:19:03 +0000"  >&lt;p&gt;The only reason we needed to change&#160; permissions on /sys/kernel/debug was, user level access need for&#160; &apos;/sys/kernel/debug/lustre/devices.&apos; Why was this file moved from /proc/sys/fs/lustre/devices to /sys/kernel/debug/lustre/devices. Is this the correct place for this file? We think relocating this file should be considered.&lt;/p&gt;

&lt;p&gt;-Mahmoud&lt;/p&gt;

&lt;p&gt;&#160;&lt;/p&gt;</comment>
                            <comment id="217355" author="adilger" created="Wed, 3 Jan 2018 05:05:21 +0000"  >&lt;p&gt;James, is it possible to create the &lt;tt&gt;devices&lt;/tt&gt; file with 755 permissions from the start?&lt;/p&gt;</comment>
                            <comment id="217371" author="simmonsja" created="Wed, 3 Jan 2018 15:00:31 +0000"  >&lt;p&gt;Andreas yes you can change the permissions with the mount() function by using the last parameter and passing in the mode value. The question is this a good thing. The problem is so much devices but the debugfs mount point itself. Its mounted for root access only by default. Their is a reason debugfs is not accessible to non-root users. I do understand what the problem is now. I still think Oleg&apos;s approach is better.&lt;/p&gt;

&lt;p&gt;Mahmoud the file was moved due to a requirement from the linux kernel maintainers. All special files in /proc are in the process of being&#160; moved into /sysfs in the linux kernel. In the case of &quot;devices&quot; it breaks the one item per file rule for sysfs so it has to be placed into debugfs. Now what you are doing is not the best idea for security reasons but I see why you are doing it. The question is do non root users really/ need to access &quot;devices&quot; or the other case stat files in debugfs? Other than that all the other files look&#160;administrative.&lt;/p&gt;

&lt;p&gt;Mahmoud are you using lctl device_list or directly accessing /proc. The reason I ask is that lctl device_list will attempt to access the debugfs file first and if it fails call an ioctl. If lctl device_list doesn&apos;t work for you then its really broken.&lt;/p&gt;

&lt;p&gt;Mahmoud are you using lctl device_list or directly accessing /proc. The reason I ask is that lctl device_list will attempt to access the&#160;&lt;/p&gt;</comment>
                            <comment id="217376" author="mhanafi" created="Wed, 3 Jan 2018 17:03:19 +0000"  >&lt;p&gt;We have nagios monitoring scripts that read the file directly. The script ran as a regular usr. I guess we could scan /proc/fs/lustre to get the same info.&lt;/p&gt;</comment>
                            <comment id="217377" author="simmonsja" created="Wed, 3 Jan 2018 17:20:36 +0000"  >&lt;p&gt;Can you tell me if lctl device_list works for you? You shouldn&apos;t be reading procfs/sysfs/debugfs files directly &lt;img class=&quot;emoticon&quot; src=&quot;https://jira.whamcloud.com/images/icons/emoticons/smile.png&quot; height=&quot;16&quot; width=&quot;16&quot; align=&quot;absmiddle&quot; alt=&quot;&quot; border=&quot;0&quot;/&gt;&lt;/p&gt;</comment>
                            <comment id="217381" author="green" created="Wed, 3 Jan 2018 17:36:14 +0000"  >&lt;p&gt;/proc/fs/lustre is going away, so don&apos;t depend on it being there for a long time.&lt;/p&gt;

&lt;p&gt;The content is moving to /sys/fs/lustre for simple one file per value cases, everything else is removed or moved to debugfs.&lt;/p&gt;</comment>
                            <comment id="217382" author="adilger" created="Wed, 3 Jan 2018 17:52:47 +0000"  >&lt;p&gt;Janes, I was thinking that it would be possible to change the permission of only the &lt;tt&gt;devices&lt;/tt&gt; file at create time, like is possible for files in /proc and /sys. If the permission is for the whole filesystem then I agree it might be more problematic. &lt;/p&gt;

&lt;p&gt;That said, read access shouldn&apos;t be a huge problem. What files are currently in debugfs?&lt;/p&gt;</comment>
                            <comment id="217384" author="bogl" created="Wed, 3 Jan 2018 17:57:18 +0000"  >&lt;p&gt;default permissions of root of mounted debugfs is hard coded to be DEBUGFS_DEFAULT_MODE (0700),&lt;/p&gt;</comment>
                            <comment id="217385" author="green" created="Wed, 3 Jan 2018 17:58:35 +0000"  >&lt;p&gt;It&apos;s most definitely possible to change default permission of  files in debugfs, but /sys/kernel/debug itself is 700 and we cannot really do anything about it from Lustre&lt;/p&gt;</comment>
                            <comment id="217389" author="mhanafi" created="Wed, 3 Jan 2018 18:48:47 +0000"  >&lt;p&gt;you can change the permissions via systemd.&lt;/p&gt;

&lt;p&gt;/etc/systemd/system/sys-kernel-debug.mount.&lt;/p&gt;
&lt;div class=&quot;code panel&quot; style=&quot;border-width: 1px;&quot;&gt;&lt;div class=&quot;codeContent panelContent&quot;&gt;
&lt;pre class=&quot;code-java&quot;&gt;# $id:$
# This file is part of systemd.
#
# systemd is free software; you can redistribute it and/or modify it
# under the terms of the GNU Lesser General Public License as published by
# the Free Software Foundation; either version 2.1 of the License, or
# (at your option) any later version.

[Unit]
Description=Debug File &lt;span class=&quot;code-object&quot;&gt;System&lt;/span&gt;
Documentation=https:&lt;span class=&quot;code-comment&quot;&gt;//www.kernel.org/doc/Documentation/filesystems/debugfs.txt
&lt;/span&gt;Documentation=http:&lt;span class=&quot;code-comment&quot;&gt;//www.freedesktop.org/wiki/Software/systemd/APIFileSystems
&lt;/span&gt;DefaultDependencies=no
ConditionPathExists=/sys/kernel/debug
ConditionCapability=CAP_SYS_RAWIO
Before=sysinit.target

[Mount]
What=debugfs
Where=/sys/kernel/debug
Type=debugfs
Options=mode=755

&lt;/pre&gt;
&lt;/div&gt;&lt;/div&gt;
&lt;p&gt;From security point of view this could be an issue.&lt;/p&gt;</comment>
                            <comment id="217390" author="simmonsja" created="Wed, 3 Jan 2018 18:56:08 +0000"  >&lt;p&gt;Well we could in theory remount it with 644 permission using the mount() function which will give us what we have today with proc but that requires root privileges to start with &lt;img class=&quot;emoticon&quot; src=&quot;https://jira.whamcloud.com/images/icons/emoticons/sad.png&quot; height=&quot;16&quot; width=&quot;16&quot; align=&quot;absmiddle&quot; alt=&quot;&quot; border=&quot;0&quot;/&gt;&#160;&#160;Its kind of fluke we give normal users full read access to all tunables. I never heard of our users every looking at /proc entries. I fact I doubt they even know if the lctl get_param option exist. I did test lctl devices_list locally and found also the ioctl to get the obd device list also only works with root access.&lt;/p&gt;

&lt;p&gt;So the reason for this ticket is that Mahmoud attempted to access the &quot;devices&quot; file as a non-root user. Is this kosher?&lt;/p&gt;</comment>
                            <comment id="217391" author="simmonsja" created="Wed, 3 Jan 2018 19:08:40 +0000"  >&lt;p&gt;Mahmoud is the only reason for changing debugfs root permissions is the device file?&lt;/p&gt;</comment>
                            <comment id="217408" author="mhanafi" created="Wed, 3 Jan 2018 21:06:22 +0000"  >&lt;p&gt;Correct the only reason we needed to change permissions was the device file, because our tools broke when it was moved. For now I wrote a work around to scan the /proc/fs/lustre and build the device list.&lt;/p&gt;

&lt;p&gt;I think the patch here does the job by persevering existing mount options. &lt;/p&gt;

&lt;p&gt;Typically our monitoring tools run as non-root so having read access to /proc/ is critical&lt;/p&gt;

&lt;p&gt;-Mahmoud&lt;/p&gt;</comment>
                            <comment id="217410" author="simmonsja" created="Wed, 3 Jan 2018 21:17:38 +0000"  >&lt;p&gt;Can post which lustre proc files you monitor. I&apos;m working on a patch to restore lctl device_list as non-root.&lt;/p&gt;</comment>
                            <comment id="217450" author="adilger" created="Thu, 4 Jan 2018 07:09:33 +0000"  >&lt;p&gt;I don&apos;t think it is ok to allow read access only to specific files. That means the monitoring tools need to run as root, which some sites would prefer to avoid. Also, some lfs commands may need to be able to read the /proc files as well. I don&apos;t think there is a security issue for reading most of the files, but we used to have individual permissions for each file and that would need to be reviewed. &lt;/p&gt;
</comment>
                            <comment id="218193" author="gerrit" created="Sun, 14 Jan 2018 02:36:53 +0000"  >&lt;p&gt;Oleg Drokin (oleg.drokin@intel.com) merged in patch &lt;a href=&quot;https://review.whamcloud.com/30675/&quot; class=&quot;external-link&quot; target=&quot;_blank&quot; rel=&quot;nofollow noopener&quot;&gt;https://review.whamcloud.com/30675/&lt;/a&gt;&lt;br/&gt;
Subject: &lt;a href=&quot;https://jira.whamcloud.com/browse/LU-10444&quot; title=&quot;l_getidentity keeps remount /sys/kernel/debug and reverting permissions.&quot; class=&quot;issue-link&quot; data-issue-key=&quot;LU-10444&quot;&gt;&lt;del&gt;LU-10444&lt;/del&gt;&lt;/a&gt; utils: Don&apos;t remount debugfs every time&lt;br/&gt;
Project: fs/lustre-release&lt;br/&gt;
Branch: master&lt;br/&gt;
Current Patch Set: &lt;br/&gt;
Commit: 767f03b161ae44bd9d33dae7e03e71e73852813f&lt;/p&gt;</comment>
                            <comment id="218214" author="pjones" created="Sun, 14 Jan 2018 15:39:17 +0000"  >&lt;p&gt;Landed for 2.11&lt;/p&gt;</comment>
                            <comment id="218427" author="gerrit" created="Wed, 17 Jan 2018 16:11:30 +0000"  >&lt;p&gt;Minh Diep (minh.diep@intel.com) uploaded a new patch: &lt;a href=&quot;https://review.whamcloud.com/30900&quot; class=&quot;external-link&quot; target=&quot;_blank&quot; rel=&quot;nofollow noopener&quot;&gt;https://review.whamcloud.com/30900&lt;/a&gt;&lt;br/&gt;
Subject: &lt;a href=&quot;https://jira.whamcloud.com/browse/LU-10444&quot; title=&quot;l_getidentity keeps remount /sys/kernel/debug and reverting permissions.&quot; class=&quot;issue-link&quot; data-issue-key=&quot;LU-10444&quot;&gt;&lt;del&gt;LU-10444&lt;/del&gt;&lt;/a&gt; utils: Don&apos;t remount debugfs every time&lt;br/&gt;
Project: fs/lustre-release&lt;br/&gt;
Branch: b2_10&lt;br/&gt;
Current Patch Set: 1&lt;br/&gt;
Commit: 4a567792a13668d1872481c36f365912253f751e&lt;/p&gt;</comment>
                            <comment id="220616" author="gerrit" created="Fri, 9 Feb 2018 18:07:55 +0000"  >&lt;p&gt;John L. Hammond (john.hammond@intel.com) merged in patch &lt;a href=&quot;https://review.whamcloud.com/30900/&quot; class=&quot;external-link&quot; target=&quot;_blank&quot; rel=&quot;nofollow noopener&quot;&gt;https://review.whamcloud.com/30900/&lt;/a&gt;&lt;br/&gt;
Subject: &lt;a href=&quot;https://jira.whamcloud.com/browse/LU-10444&quot; title=&quot;l_getidentity keeps remount /sys/kernel/debug and reverting permissions.&quot; class=&quot;issue-link&quot; data-issue-key=&quot;LU-10444&quot;&gt;&lt;del&gt;LU-10444&lt;/del&gt;&lt;/a&gt; utils: Don&apos;t remount debugfs every time&lt;br/&gt;
Project: fs/lustre-release&lt;br/&gt;
Branch: b2_10&lt;br/&gt;
Current Patch Set: &lt;br/&gt;
Commit: 82bf22a4200ba657465302daf6a77b9ebd6b7853&lt;/p&gt;</comment>
                    </comments>
                <issuelinks>
                            <issuelinktype id="10011">
                    <name>Related</name>
                                            <outwardlinks description="is related to ">
                                                        </outwardlinks>
                                                        </issuelinktype>
                    </issuelinks>
                <attachments>
                    </attachments>
                <subtasks>
                    </subtasks>
                <customfields>
                                                                                                                                                                                            <customfield id="customfield_10890" key="com.atlassian.jira.plugins.jira-development-integration-plugin:devsummary">
                        <customfieldname>Development</customfieldname>
                        <customfieldvalues>
                            
                        </customfieldvalues>
                    </customfield>
                                                                                                                                                                                                                                                                                                                                                        <customfield id="customfield_10390" key="com.pyxis.greenhopper.jira:gh-lexo-rank">
                        <customfieldname>Rank</customfieldname>
                        <customfieldvalues>
                            <customfieldvalue>1|hzzq8n:</customfieldvalue>

                        </customfieldvalues>
                    </customfield>
                                                                <customfield id="customfield_10090" key="com.pyxis.greenhopper.jira:gh-global-rank">
                        <customfieldname>Rank (Obsolete)</customfieldname>
                        <customfieldvalues>
                            <customfieldvalue>9223372036854775807</customfieldvalue>
                        </customfieldvalues>
                    </customfield>
                                                                                            <customfield id="customfield_10060" key="com.atlassian.jira.plugin.system.customfieldtypes:select">
                        <customfieldname>Severity</customfieldname>
                        <customfieldvalues>
                                <customfieldvalue key="10022"><![CDATA[3]]></customfieldvalue>

                        </customfieldvalues>
                    </customfield>
                                                                                                                                                                                                                                                                                                                                                        </customfields>
    </item>
</channel>
</rss>