lkml.org 
[lkml]   [2006]   [Jul]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH -mm 5/7] add user namespace
Quoting Cedric Le Goater (clg@fr.ibm.com):
> Eric W. Biederman wrote:
>
> >> I think user namespace should be unshared with filesystem. if not, the
> >> user/admin should know what is doing.
> >
> > No. The uids in a filesystem are interpreted in some user namespace
> > context. We can discover that context at the first mount of the
> > filesystem.
>
> ok. so once you're in such a user namespace, you can't unshare from it
> without loosing access to all your files ?
>
> > Assuming the uids on a filesystem are the same set of uids your process
> > is using is just wrong.
>
> well, this is what is currently done without user namespaces.
>
> >>> I believe some of the key infrastructure which is roughly kerberos
> >>> authentication tokens could be used for this purpose.
> >> please elaborate ? i'm not sure to understand why you want to use the keys
> >> to map users.
> >
> > keys are essentially security credentials for something besides the
> > local kernel. Think kerberos tickets. That makes the keys the
> > obvious place to say what uid you are in a different user namespace
> > and similar things.
>
> what about performance ? wouldn't that slow the checking ?

Rather than try to store (uid, namespace) on the filesystem, I like the
idea of doing something like

mount --bind -o ro --uidswap 500,1001 --uidswap 501,0 /home /home

In other words, when you unshare the user namespace, nothing
filesystem-related changes unless you also unshare the fs-namespace and
set uid info on the vfsmount. This is fully backward-compatible and
should have no overhead if you don't need the feature.

-serge
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2006-07-13 19:51    [W:0.528 / U:0.292 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site