Re: [PATCH -mm 5/7] add user namespace

[ebiederm@xmission.com (Eric W. Biederman)]

"Serge E. Hallyn" <serue@us.ibm.com> writes:

> Quoting Eric W. Biederman (ebiederm@xmission.com):
>> If you permission checks are not (user namespace, uid) what can't you do?
>
> File descripters can only be passed over a unix socket, right?

No.  You can use /proc to do the same thing.  You can inherit
file descriptors, etc.  This isn't a door you can just close and ignore.
It is too easy to do this to assume you have closed every possible
way to get a descriptor from outside of ``container''.

Suppose you have user fred uid 1000 outside of any containers,
and you have user joe uid 1000 inside user uid namespace.  If you don't
make your permission checks (user namespace, uid) fred can do terrible
things to joe.

If I we don't do the expanded permission checks the only alternative
is to check to see if every object is in our ``container'' at every
access.  That isn't something I want to do.

I don't intend to partition objects just partition object look ups by name.
Which means that if you very carefully setup your initial process you
will never be able to find an object outside of your namespace.  But
the kernel never should assume user space has done that.

> So this seems to fall into the same "userspace should set things up
> sanely" argument you've brought up before.

For using it yes.  But not for correct kernel operation.

> Don't get me wrong though - the idea of using in-kernel keys as
> cross-namespace uid's is definately interesting.

That is their role in the kernel.  A flavor of key to handle uid
mapping needs to be added, but that is all.

Eric