Messages in this thread | | | Subject | Re: [PATCHv5 01/37] ns: Introduce Time Namespace | From | Dmitry Safonov <> | Date | Fri, 2 Aug 2019 00:46:39 +0100 |
| |
Hi Andy,
Thank you for the review,
On 8/1/19 6:29 AM, Andy Lutomirski wrote: > On Mon, Jul 29, 2019 at 2:58 PM Dmitry Safonov <dima@arista.com> wrote: >> >> From: Andrei Vagin <avagin@openvz.org> >> >> Time Namespace isolates clock values. > >> +static int timens_install(struct nsproxy *nsproxy, struct ns_common *new) >> +{ >> + struct time_namespace *ns = to_time_ns(new); >> + >> + if (!thread_group_empty(current)) >> + return -EINVAL; > > You also need to check for other users of the mm.
Oops. It seems like, if the check was
if (!current_is_single_threaded()) return -EUSERS;
instead of thread_group_empty(current), it would address the concerns from 23/37 and 25/37 patches, too?
> >> + >> + if (!ns_capable(ns->user_ns, CAP_SYS_ADMIN) || >> + !ns_capable(current_user_ns(), CAP_SYS_ADMIN)) >> + return -EPERM; >> + >> + get_time_ns(ns); >> + get_time_ns(ns); >> + put_time_ns(nsproxy->time_ns); >> + put_time_ns(nsproxy->time_ns_for_children); >> + nsproxy->time_ns = ns; >> + nsproxy->time_ns_for_children = ns; >> + ns->initialized = true; > > I really really wish that setns() took an explicit flag for "change > now" or "change for children", since the semantics are different. Oh > well. >
Thanks, Dmitry
| |