From: "Serge E. Hallyn" <serge.hallyn@ubuntu.com>
To: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: "Serge E. Hallyn" <serge@hallyn.com>,
Richard Weinberger <richard@nod.at>,
Richard Weinberger <richard.weinberger@gmail.com>,
LKML <linux-kernel@vger.kernel.org>,
"open list:ABI/API" <linux-api@vger.kernel.org>,
Linux Containers <containers@lists.linux-foundation.org>,
LXC development mailing-list
<lxc-devel@lists.linuxcontainers.org>, Tejun Heo <tj@kernel.org>,
cgroups mailinglist <cgroups@vger.kernel.org>,
Andrew Morton <akpm@linux-foundation.org>
Subject: Re: CGroup Namespaces (v4)
Date: Wed, 18 Nov 2015 09:43:06 -0600 [thread overview]
Message-ID: <20151118154306.GA24719@mail.hallyn.com> (raw)
In-Reply-To: <87r3jnfyx7.fsf@x220.int.ebiederm.org>
On Wed, Nov 18, 2015 at 03:18:44AM -0600, Eric W. Biederman wrote:
> "Serge E. Hallyn" <serge@hallyn.com> writes:
>
> > On Mon, Nov 16, 2015 at 04:24:27PM -0600, Eric W. Biederman wrote:
> >> Similary have you considered what it required to be able to safely set
> >> FS_USERNS_MOUNT?
> >
> > I pushed the one patch which I feel is needed to my branch (it's also
> > included in another reply). Aditya had already added FS_USERNS_MOUNT to
> > the cgroup fs flags, so I think we're now all set. I can start
> > unprivileged containers which mount cgroupfs (which make systemd happy).
>
> In principle that sounds very good, and I am glad to see that.
>
> Let's hold off on merging the unprivileged part until everything else is
> reviewed and merged and we have performed an extra hard look at the
> security implications as it can be easy to overlook something when
> relaxing the permissions.
I'll break out the FS_USERNS_MOUNT flag into the very last patch.
prev parent reply other threads:[~2015-11-18 15:43 UTC|newest]
Thread overview: 54+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-11-16 19:51 serge
2015-11-16 19:51 ` [PATCH 1/8] kernfs: Add API to generate relative kernfs path serge
2015-11-24 16:16 ` Tejun Heo
2015-11-24 16:17 ` Tejun Heo
2015-11-24 17:43 ` Serge E. Hallyn
2015-11-27 5:25 ` Serge E. Hallyn
2015-11-30 15:11 ` Tejun Heo
2015-11-30 18:37 ` Serge E. Hallyn
2015-11-30 22:53 ` Tejun Heo
2015-12-01 2:08 ` Serge E. Hallyn
2015-11-16 19:51 ` [PATCH 2/8] sched: new clone flag CLONE_NEWCGROUP for cgroup namespace serge
2015-11-16 19:51 ` [PATCH 3/8] cgroup: add function to get task's cgroup serge
2015-11-24 16:27 ` Tejun Heo
2015-11-24 16:54 ` Tejun Heo
2015-11-16 19:51 ` [PATCH 4/8] cgroup: export cgroup_get() and cgroup_put() serge
2015-11-24 16:30 ` Tejun Heo
2015-11-24 22:35 ` Serge E. Hallyn
2015-11-16 19:51 ` [PATCH 5/8] cgroup: introduce cgroup namespaces serge
2015-11-24 16:49 ` Tejun Heo
2015-11-16 19:51 ` [PATCH 6/8] cgroup: cgroup namespace setns support serge
2015-11-24 16:52 ` Tejun Heo
2015-11-16 19:51 ` [PATCH 7/8] cgroup: mount cgroupns-root when inside non-init cgroupns serge
2015-11-24 17:16 ` Tejun Heo
2015-11-25 6:01 ` Serge E. Hallyn
2015-11-25 19:10 ` Tejun Heo
2015-11-25 19:55 ` Serge Hallyn
2015-11-25 19:57 ` Tejun Heo
2015-11-27 5:17 ` Serge E. Hallyn
2015-11-30 15:09 ` Tejun Heo
2015-12-01 4:07 ` Serge E. Hallyn
2015-12-01 16:46 ` Tejun Heo
2015-12-01 21:58 ` Serge E. Hallyn
2015-12-02 16:53 ` Tejun Heo
2015-12-02 16:56 ` Serge E. Hallyn
2015-12-02 16:58 ` Tejun Heo
2015-12-02 17:02 ` Serge E. Hallyn
2015-12-02 17:05 ` Tejun Heo
2015-12-03 22:47 ` Serge E. Hallyn
2015-12-07 15:39 ` Tejun Heo
2015-12-07 15:53 ` Serge Hallyn
2015-11-16 19:51 ` [PATCH 8/8] cgroup: Add documentation for cgroup namespaces serge
2015-11-24 17:16 ` Tejun Heo
2015-11-16 20:41 ` CGroup Namespaces (v4) Richard Weinberger
2015-11-16 20:46 ` Serge E. Hallyn
2015-11-16 20:50 ` Richard Weinberger
2015-11-16 20:54 ` Serge E. Hallyn
2015-11-16 22:24 ` Eric W. Biederman
2015-11-16 22:37 ` Tejun Heo
2015-11-17 1:13 ` Serge E. Hallyn
2015-11-17 1:40 ` Serge E. Hallyn
2015-11-17 3:54 ` Serge E. Hallyn
2015-11-18 2:30 ` Serge E. Hallyn
2015-11-18 9:18 ` Eric W. Biederman
2015-11-18 15:43 ` Serge E. Hallyn [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20151118154306.GA24719@mail.hallyn.com \
--to=serge.hallyn@ubuntu.com \
--cc=akpm@linux-foundation.org \
--cc=cgroups@vger.kernel.org \
--cc=containers@lists.linux-foundation.org \
--cc=ebiederm@xmission.com \
--cc=linux-api@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=lxc-devel@lists.linuxcontainers.org \
--cc=richard.weinberger@gmail.com \
--cc=richard@nod.at \
--cc=serge@hallyn.com \
--cc=tj@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Powered by JetHome