lkml.org 
[lkml]   [2019]   [Mar]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    Date
    SubjectRe: [PATCH 2/4] pid: add pidfd_open()
    On Wed, Mar 27, 2019 at 7:38 PM Jonathan Kowalski <bl0pbl33p@gmail.com> wrote:
    > ...
    > ... the process cannot get it out
    > of thin air on its own (and you already mentioned it has nothing to do
    > with security). What I do worry about is one can use NS_GET_PARENT

    disregard this, it works as it should.

    > ioctl to get the parent pidns if the owning userns is the same, and
    > just passing that gives me back a pidfd for the task. **So, you might
    > want to add the constraint that the PID is actually reachable by the
    > current task as well, apart from being reachable in the passed in
    > namespace.**
    >
    > Lastly, I also see no need of /proc/<PID> dir fd to pidfd conversion,
    > I would even recommend getting rid of that, so we only have one type
    > of pidfd, the anon inode one. What is the usecase behind that? It
    > would only be needed if you did not have a way to be able to metadata
    > access through a pidfd, which would be the case only prior to this
    > patch.
    >
    > I think this would simplify a lot of things, and ioctl_ns(2) is
    > probably already the place to do comparison operations and query
    > operations on hierarichal namespaces, just adding the relative PID bit
    > will make it gain feature parity with translate_pid.

    \
     
     \ /
      Last update: 2019-03-27 21:18    [W:3.317 / U:0.008 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site