[vserver] NetApp filers and NFS junctions: Operation not permitted

Hello,

We are currently putting our new NetApp ONTAP GX system into production.
From the NFS point of view, the particularity of this product is that it
allows to "assemble" multiple volumes within a "unified" namespace,
using so-called "junctions", and access this "unified" namespace with a
(apparently) single mount operation.

Now, when using VServer - even from the host point of view - only the
root user is able to "roam" through the mounted hierarchy (as separate
volumes get automatically mounted in the background and appear in
'/proc/mounts'). Non-root user get a "Operation not permitted" message
as soon as they try to go pass the initially mounted volume.

This problem seem absolutely similar to what was discussed in this
thread: http://www.paul.sladen.org/vserver/archives/200709/0046.html

We have verified that removing the VServer-added checks in the
'vfs_kern_mount' function (in '<kernel-source>/fs/super.c') "solves" the
problem (we used the latest 2.6.30.2 vanilla kernel and 2.3.0.36.14pre4
VServer patches to perform this verification).

Now to the questions:

 1. What is the security impact of removing those checks (iow. is it a
"MUST NOT!!!" or a "well... that's being overkill anyway" ) ?

 2. Can we imagine to perform those checks slightly differently, in
order to allow non-root users to use such "joined" NFS exports, both
from the host and guests (since we're no kernel gurus, we don't know
which function/capability to start looking for) ?

Thank you very much for your help and time.

Cheers

-- 
Cédric Dufour @ Idiap Research Institute
Phone:  +41 27 721 77 40
Fax:    +41 27 721 77 12
Mail:   Idiap Research Institute
        Case postale 592
        Centre du Parc
        1920 Martigny (VS)
        Suisse (Switzerland)
Web:    www.idiap.ch <http://www.idiap.ch>