svn commit: r366015 - head/sys/kern

[Konstantin Belousov]

Author: kib
Date: Tue Sep 22 21:54:30 2020
New Revision: 366015
URL: https://svnweb.freebsd.org/changeset/base/366015

Log:
  Improve comment above nameicap_check_dotdot().
  
  Explain why tracker is needed at all.
  
  Reviewed by:	markj
  Tested by:	pho
  Sponsored by:	The FreeBSD Foundation
  MFC after:	1 week
  Differential revision:	https://reviews.freebsd.org/D25886

Modified:
  head/sys/kern/vfs_lookup.c

Modified: head/sys/kern/vfs_lookup.c
==============================================================================
--- head/sys/kern/vfs_lookup.c	Tue Sep 22 21:43:43 2020	(r366014)
+++ head/sys/kern/vfs_lookup.c	Tue Sep 22 21:54:30 2020	(r366015)
@@ -215,7 +215,11 @@ nameicap_cleanup(struct nameidata *ndp, bool clean_lat
 /*
  * For dotdot lookups in capability mode, only allow the component
  * lookup to succeed if the resulting directory was already traversed
- * during the operation.  Also fail dotdot lookups for non-local
+ * during the operation.  This catches situations where already
+ * traversed directory is moved to different parent, and then we walk
+ * over it with dotdots.
+ *
+ * Also allow to force failure of dotdot lookups for non-local
  * filesystems, where external agents might assist local lookups to
  * escape the compartment.
  */