From: Ian Kent <ikent@redhat.com>
To: Oleg Nesterov <oleg@redhat.com>
Cc: Kernel Mailing List <linux-kernel@vger.kernel.org>,
"J. Bruce Fields" <bfields@fieldses.org>,
Stanislav Kinsbursky <skinsbursky@parallels.com>,
Trond Myklebust <trond.myklebust@primarydata.com>,
David Howells <dhowells@redhat.com>,
Benjamin Coddington <bcodding@redhat.com>,
Al Viro <viro@ZenIV.linux.org.uk>,
"Eric W. Biederman" <ebiederm@xmission.com>
Subject: Re: [RFC PATCH 3/4] kmod - add call_usermodehelper_ns() helper
Date: Wed, 26 Nov 2014 07:14:30 +0800 [thread overview]
Message-ID: <1416957270.2509.40.camel@pluto.fritz.box> (raw)
In-Reply-To: <20141125220637.GA10008@redhat.com>
On Tue, 2014-11-25 at 23:06 +0100, Oleg Nesterov wrote:
> On 11/25, Oleg Nesterov wrote:
> >
> > Let me first apologize, I didn't actually read this series yet.
> >
> > But I have to admit that so far I do not like this approach...
> > probably I am biased.
>
> Yes.
>
> And I have another concern... this is mostly a feeling, I can be
> easily wrong but:
>
> > On 11/25, Ian Kent wrote:
> > >
> > > +static int umh_set_ns(struct subprocess_info *info, struct cred *new)
> > > +{
> > > + struct nsproxy *ns = info->data;
> > > +
> > > + mntns_setfs(ns->mnt_ns);
> >
> > Firstly, it is not clear to me if we should use the caller's ->mnt_ns.
> > Let me remind about the coredump. The dumping task can cloned with
> > CLONE_NEWNS or it cam do unshare(NEWNS)... but OK, I do not understand
> > this enough.
>
> And otoh. If we actually want to use the caller's mnt_ns/namespaces we
> could simply fork/reparent a child which will do execve ?
Are you saying that the user space program should be modified to do
this?
Ian
next prev parent reply other threads:[~2014-11-25 23:14 UTC|newest]
Thread overview: 27+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-11-25 1:07 [RFC PATCH 0/4] Namespace contrained helper execution Ian Kent
2014-11-25 1:07 ` [RFC PATCH 1/4] vfs - fs/namespaces.c: break out mntns_setfs() from mntns_install() Ian Kent
2014-11-25 1:07 ` [RFC PATCH 2/4] nsproxy - make create_new_namespaces() non-static Ian Kent
2014-11-25 1:07 ` [RFC PATCH 3/4] kmod - add call_usermodehelper_ns() helper Ian Kent
2014-11-25 21:52 ` Oleg Nesterov
2014-11-25 22:06 ` Oleg Nesterov
2014-11-25 22:23 ` Eric W. Biederman
2014-11-25 23:07 ` Ian Kent
2014-11-25 23:19 ` Eric W. Biederman
2014-11-25 23:50 ` Ian Kent
2014-11-26 0:44 ` Ian Kent
2014-11-26 1:38 ` Eric W. Biederman
2014-12-01 21:56 ` Benjamin Coddington
2014-12-02 23:33 ` Ian Kent
2014-12-03 16:49 ` Eric W. Biederman
2014-12-03 18:14 ` Benjamin Coddington
2014-12-03 22:53 ` Ian Kent
2014-12-03 23:34 ` Ian Kent
2014-11-26 11:46 ` David Howells
2014-11-26 15:00 ` Eric W. Biederman
2014-11-26 22:57 ` J. Bruce Fields
2014-11-25 23:14 ` Ian Kent [this message]
2014-11-25 22:36 ` Ian Kent
2014-11-25 23:27 ` Eric W. Biederman
2014-11-28 0:19 ` Ian Kent
2014-11-27 1:30 ` Oleg Nesterov
2014-11-25 1:07 ` [RFC PATCH 4/4] KEYS: exec request-key within the requesting task's namespace Ian Kent
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1416957270.2509.40.camel@pluto.fritz.box \
--to=ikent@redhat.com \
--cc=bcodding@redhat.com \
--cc=bfields@fieldses.org \
--cc=dhowells@redhat.com \
--cc=ebiederm@xmission.com \
--cc=linux-kernel@vger.kernel.org \
--cc=oleg@redhat.com \
--cc=skinsbursky@parallels.com \
--cc=trond.myklebust@primarydata.com \
--cc=viro@ZenIV.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.