Messages in this thread | | | Date | Fri, 14 Oct 2011 11:54:06 -0400 | From | Ted Ts'o <> | Subject | Re: Detecting if you are running in a container |
| |
On Wed, Oct 12, 2011 at 03:12:34PM -0400, Kyle Moffett wrote: > Well, you're going to need to introduce a bunch of new xattrs to > handle the namespacing anyways. > > As I understand it you can use RichACLs to grant all the same > privileges as owner and group, so you can simply map the real > namespaced owner and group into RichACLs (or another xattr) and force > the inode uid/gid to be root/root (or maybe nobody/nogroup or > something).
It's going to be all about mapping tables, and whether the mapping is done in userspace or kernel space. For example, you might want to take a Kerberos principal name, and mapping it to a 128bit identifier (64 bit realm id + 64 bit user id), and that in turn might require mapping to some 32-bit Linux uid namespace.
If people want to support multiple 32-bit Linux uid namespaces, then it's a question of how you name these uid name spaces, and how to manage the mapping tables outside of kernel, and how the mapping tables get loaded into the kernel.
> I am of course making it sound a million times easier than it's > actually likely to be, but I do think it's possible without too many > odd corner cases.
It's not the corner cases, it's all of the different name spaces that different system administrators and their sites are going to want to use, and how to support them all....
And of course, once we start naming uid name spaces, eventually someone will want to virtualize containers, and then we will have namespaces for namespaces. (It's turtles all the way down! :-)
- Ted
| |