[lkml]   [2016]   [Jul]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [CRIU] Introspecting userns relationships to other namespaces? (Eric W. Biederman) writes:

> Andrew Vagin <> writes:
>> All these thoughts about security make me thinking that kcmp is what we
>> should use here. It's maybe something like this:
>> kcmp(pid1, pid2, KCMP_NS_USERNS, fd1, fd2)
>> - to check if userns of the fd1 namepsace is equal to the fd2 userns
>> kcmp(pid1, pid2, KCMP_NS_PARENT, fd1, fd2)
>> - to check if a parent namespace of the fd1 pidns is equal to fd pidns.
>> fd1 and fd2 is file descriptors to namespace files.
>> So if we want to build a hierarchy, we need to collect all namespaces
>> and then enumerate them to check dependencies with help of kcmp.
> That is certainly one way to go.
> There is a funny case where we would want to compare a user namespace
> file descriptor to a parent user namespace file descriptor.
> Grumble, Grumble. I think this may actually a case for creating ioctls
> for these two cases. Now that random nsfs file descriptors are bind
> mountable the original reason for using proc files is not as pressing.
> One ioctl for the user namespace that owns a file descriptor.
> One ioctl for the parent namespace of a namespace file descriptor.
> We also need some way to get a command file descriptor for a file system
> super block. Al Viro has a pet project for cleaning up the mount API
> and this might be the idea excuse to start looking at that.
> (In principle we might be able to run commands through the namespace
> file descriptor and using an ioctl feels dirty. But an ioctl that
> only uses the fd and request argument does not suffer from the same
> problems that ioctls that have to pass additional arguments suffer
> from.)

Of course it should be an error perhaps -EINVAL to get a user
namespace owner or parent namespace that is outside of a processes
current user namespace or pid namespace. That way thing stay bounded
within the current namespaces the process is in. Which prevents any
leak possibilities, and keeps CRIU working.


 \ /
  Last update: 2016-07-09 21:21    [W:0.050 / U:5.948 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site