lkml.org 
[lkml]   [2006]   [Jan]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: RFC: Multiple instances of kernel namespaces.
    On Thu, Jan 26, 2006 at 01:13:45PM -0700, Eric W. Biederman wrote:
    > Herbert Poetzl <herbert@13thfloor.at> writes:
    >
    > > On Sat, Jan 21, 2006 at 03:04:16AM -0700, Eric W. Biederman wrote:
    > >> So in the simple case I have names like:
    > >> 1178/1632
    > >
    > > which is a new namespace in itself, but it doesn't matter
    > > as long as it uniquely and persistently identifies the
    > > namespace for the time it exists ... just leaves the
    > > question how to retrieve a list of all namespaces :)
    >
    > Yes but the name of the namespace is still in the original pid namespace.
    > And more importantly to me it isn't a new kind of namespace.
    >
    > >> If I want a guest that can keep secrets from the host sysadmin I don't
    > >> want transitioning into a guest namespace to come too easily.
    > >
    > > which can easily be achieved by 'marking' the namespace
    > > as private and/or applying certain rules/checks to the
    > > 'enter' procedure ...
    >
    > Right. The trick here is that you must be able to deny
    > transitioning into a namespace from the inside the namespace.
    > Or else a guest could never trust it. Something one of my
    > coworkers pointed out to me.

    not necessarily, for example have a 'private' flag, which
    can only be set once (usually from outside), ensuring that
    the namespace will not be entered. this flag could be
    checked from inside ...

    best,
    Herbert

    > Eric
    > -
    > To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    > the body of a message to majordomo@vger.kernel.org
    > More majordomo info at http://vger.kernel.org/majordomo-info.html
    > Please read the FAQ at http://www.tux.org/lkml/
    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2006-01-26 21:30    [W:0.036 / U:0.024 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site