Messages in this thread | | | Date | Wed, 28 Mar 2012 10:48:38 +0400 | From | Cyrill Gorcunov <> | Subject | Re: [rfc] fcntl: Add F_GETOWNER_UIDS option |
| |
On Tue, Mar 27, 2012 at 07:22:48PM -0700, Eric W. Biederman wrote: > >> Hi Serge, thanks for info. But if it will be unconverted uid, can't > >> be there some security problem with that which I missed? > > I would suggest the easy route and create a KCONFIG dependency > on !CONFIG_USER_NS until the code for that is a little farther along. > > Hopefully later this week or begginning of next week I should be posting > my patches and seeing how well the rest of the world takes them. >
CC me on them, please.
> > Noone is really using the user namespaces right now, but rather than > > adding the cred (and refcounting concerns), my suggestion for now > > would be to hardcode a check in modown() that current_user_ns() == > > &init_user_ns.
OK, thanks
> > > > I *did* have a patch in the past which added the cred to fown, but > > no idea where it is right now... > > So I guess there are two questions. > - Does it make sense besides translation to add a cred here in general? >
I personally fail to find a reason except uids translation.
> - How will it work with the user_namespace? > > I am just about ready to post a patchset that at the edges of > userspace maps all uid and gids into uid and gids in the initial user > namespace.
So, we could map tme into initial user namesapce right? And we could require for a while that F_GETOWNER_UIDS should be called from initial user namespace only. Then we could extend it for being called from any user-namespace if such need appear. Or I miss something?
Cyrill
| |