Messages in this thread | | | Subject | Re: Network isolation with RLIMIT_NETWORK, cont'd. | From | Bernie Innocenti <> | Date | Thu, 17 Dec 2009 14:35:17 -0500 |
| |
On Thu, 2009-12-17 at 13:24 -0500, Bryan Donlan wrote: > Can this be done using openat() and friends currently? It would seem > the natural way to implement this; open /proc/(pid)/root, then > openat() things from there (or even chdir to it and see the mounts > that it sees from there...)
Yeah, but /proc/<pid>/root is just a symlink. It's correct for chroots, but I doubt it can be meaningful for per-process namespaces.
If we were to implement Mark Seaborn's idea of naming namespaces, /proc/<pid>/rootfd would be a file descriptor providing access to the namespace through some fancy ioctls.
Or maybe not. Could such a file-descriptor be used as the source argument to mount(), perhaps along with a new MS_NS flag?
Alternatively, perhaps one could come up with a userspace solution: read /proc/<pid>/mounts and repeat all mounts, perhaps with a prefix. The downsides are that it would require superuser privs and wouldn't automatically stay synchronized with the real namespace.
-- // Bernie Innocenti - http://codewiz.org/ \X/ Sugar Labs - http://sugarlabs.org/
| |