lkml.org 
[lkml]   [2016]   [Jul]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    Date
    SubjectRe: [CRIU] Introspecting userns relationships to other namespaces?
    Andrew Vagin <avagin@virtuozzo.com> writes:

    > All these thoughts about security make me thinking that kcmp is what we
    > should use here. It's maybe something like this:
    >
    > kcmp(pid1, pid2, KCMP_NS_USERNS, fd1, fd2)
    >
    > - to check if userns of the fd1 namepsace is equal to the fd2 userns
    >
    > kcmp(pid1, pid2, KCMP_NS_PARENT, fd1, fd2)
    >
    > - to check if a parent namespace of the fd1 pidns is equal to fd pidns.
    >
    > fd1 and fd2 is file descriptors to namespace files.
    >
    > So if we want to build a hierarchy, we need to collect all namespaces
    > and then enumerate them to check dependencies with help of kcmp.

    That is certainly one way to go.

    There is a funny case where we would want to compare a user namespace
    file descriptor to a parent user namespace file descriptor.


    Grumble, Grumble. I think this may actually a case for creating ioctls
    for these two cases. Now that random nsfs file descriptors are bind
    mountable the original reason for using proc files is not as pressing.

    One ioctl for the user namespace that owns a file descriptor.
    One ioctl for the parent namespace of a namespace file descriptor.

    We also need some way to get a command file descriptor for a file system
    super block. Al Viro has a pet project for cleaning up the mount API
    and this might be the idea excuse to start looking at that.

    (In principle we might be able to run commands through the namespace
    file descriptor and using an ioctl feels dirty. But an ioctl that
    only uses the fd and request argument does not suffer from the same
    problems that ioctls that have to pass additional arguments suffer
    from.)

    Eric

    \
     
     \ /
      Last update: 2016-07-09 21:01    [W:0.027 / U:156.932 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site