From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1161268AbWGNRGZ (ORCPT ); Fri, 14 Jul 2006 13:06:25 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1161269AbWGNRGZ (ORCPT ); Fri, 14 Jul 2006 13:06:25 -0400 Received: from e35.co.us.ibm.com ([32.97.110.153]:61150 "EHLO e35.co.us.ibm.com") by vger.kernel.org with ESMTP id S1161268AbWGNRGY (ORCPT ); Fri, 14 Jul 2006 13:06:24 -0400 Date: Fri, 14 Jul 2006 12:05:23 -0500 From: "Serge E. Hallyn" To: "Eric W. Biederman" Cc: "Serge E. Hallyn" , Dave Hansen , Cedric Le Goater , linux-kernel@vger.kernel.org, Andrew Morton , Kirill Korotaev , Andrey Savochkin , Herbert Poetzl , Sam Vilain Subject: Re: [PATCH -mm 5/7] add user namespace Message-ID: <20060714170523.GD25303@sergelap.austin.ibm.com> References: <20060713174721.GA21399@sergelap.austin.ibm.com> <1152815391.7650.58.camel@localhost.localdomain> <1152821011.24925.7.camel@localhost.localdomain> <1152887287.24925.22.camel@localhost.localdomain> <20060714162935.GA25303@sergelap.austin.ibm.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.11 Sender: linux-kernel-owner@vger.kernel.org X-Mailing-List: linux-kernel@vger.kernel.org Quoting Eric W. Biederman (ebiederm@xmission.com): > "Serge E. Hallyn" writes: > > > Quoting Eric W. Biederman (ebiederm@xmission.com): > >> Dave Hansen writes: > >> > >> > On Thu, 2006-07-13 at 21:45 -0600, Eric W. Biederman wrote: > >> >> I think for filesystems like /proc and /sys that there will normally > >> >> be problems. However many of those problems can be rationalized away > >> >> as a reasonable optimization, or are not immediately apparent. > >> > > >> > Could you talk about some of these problems? > >> > >> Already mentioned but. rw permissions on sensitive files are for > >> uid == 0. No capability checks are performed. > > > > As Herbert (IIRC) pointed out that could/should be fixed. > > Capabilities have always fitted badly in with the normal unix > permissions. Well they're not supposed to fit in. If we keep permchecks as uid==0 on files which invoke kernel callbacks, then we can only say once what root is allowed to do. If we make them capability checks, then for differnet uses of namespaces we can have them do different things. For instance if we're making a separate user namespace for a checkpoint/restart purpose, we might want root to retain more privs than if we're making a vserver. Look I just have to keep responding because you keep provoking :), but I'm looking at other code and don't even know which entries we're talking about. If when I get to looking at them I find they really should be done by capabilities, I'll submit a patch and we can argue then. > So if we have a solution that works nicely with normal > unix permissions we will have a nice general solution, that is > easy for people to understand. > > What I am talking about is making a small tweak to the permission > checking as below. Why do you keep avoiding even considering it? Not only don't I avoid considering it, I thought I'd even suggested it a while ago :) It sounds good to me. -serge