[lkml]   [2006]   [Jul]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: [PATCH -mm 5/7] add user namespace
    Kirill Korotaev <> writes:

    >>>- if (current->fsuid == inode->i_uid)
    >>>+ if ((current->fsuid == inode->i_uid) &&
    >>>+ (current->nsproxy->user_ns == inode->i_sb->user_ns))
    >>> mode >>= 6;
    >> I really don't think assigning a user namespace to a superblock is the
    >> right way to go. Seems to me like the _view_ into the filesystem is
    >> what you want to modify. That would seem to me to mean that each
    >> 'struct namespace' (filesystem namespace) or vfsmount would be assigned
    >> a corresponding user namespace, *not* the superblock.
    > I dislike this way either. We need an ability to have an access to container
    > filesystems and data from the host.
    > such a strong checks break this.

    No this check doesn't. CAP_DAC_OVERRIDE still works.

    Of course enter a running container is a subject for major debate.


    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    More majordomo info at
    Please read the FAQ at

     \ /
      Last update: 2006-07-16 12:13    [W:0.042 / U:2.172 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site