Messages in this thread | | | Date | Tue, 24 May 2005 22:51:01 +0100 | From | Jamie Lokier <> | Subject | Re: [RFC][PATCH] rbind across namespaces |
| |
Mike Waychison wrote: > > 1. Deny access to /proc/NNN/fd/, /proc/NNN/cwd, /proc/NNN/root > > if task NNN cannot be ptraced. > > > > 3. Allow entry to /proc/NNN/fd/, /proc/NNN/cwd, /proc/NNN/root > > if ptrace is allowed; the namespace being irrelevant. > > > > 3. Use _exactly_ the same condition as for ptracing, > > i.e. MAY_PTRACE in fs/proc/base.c. Ensure that condition is > > consistent with the tests in kernel/ptrace.c, possibly putting > > the condition in a common header file to keep it consistent in > > future. > > > > 4. If further restrictions are desired, to make namespaces more > > strict, those should be implemented by further restrictions on > > which tasks are allowed to ptrace other tasks. > > > > Indeed. A combination of MAY_PTRACE ||ed with a check against current > sounds reasonable to me.
Note that MAY_PTRACE already includes a check against current.
-- Jamie - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |