All of lore.kernel.org
 help / color / mirror / Atom feed
From: "Serge E. Hallyn" <serge@hallyn.com>
To: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: "Serge E. Hallyn" <serge@hallyn.com>,
	LSM <linux-security-module@vger.kernel.org>,
	containers@lists.linux-foundation.org,
	Kees Cook <kees.cook@canonical.com>,
	kernel list <linux-kernel@vger.kernel.org>
Subject: Re: [RFC PATCH 4/4] allow killing tasks in your own or child userns
Date: Fri, 10 Dec 2010 16:02:23 +0000	[thread overview]
Message-ID: <20101210160223.GA16601@mail.hallyn.com> (raw)
In-Reply-To: <m14oal3mjx.fsf@fess.ebiederm.org>

Quoting Eric W. Biederman (ebiederm@xmission.com):
> "Serge E. Hallyn" <serge@hallyn.com> writes:
> > +static inline int kill_ok_by_cred(struct cred *cred, struct cred *tcred)
> > +{
> Nit: You should just pass in the target task here.
> Making it abundantly clear where current and tcred come from.
> ns_capable implicitly uses current which is a little surprising
> when everything else is being passed in, but makes perfect sense
> in this context.

Thanks, that makes sense, will do.

If the set seems fine overall, then I'll also look at adding ptrace
controls, and hopefully send the result out next week.

thanks,
-serge

  reply	other threads:[~2010-12-10 16:02 UTC|newest]

Thread overview: 15+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2010-12-09 17:20 [RFC PATCH 1/4] Add a user_namespace as creator/owner of uts_namespace Serge E. Hallyn
2010-12-09 17:28 ` [RFC PATCH 2/4] security: Make capabilities relative to the user namespace Serge E. Hallyn
2010-12-09 17:30   ` [RFC PATCH 3/4] allow sethostname in a container Serge E. Hallyn
     [not found]     ` <20101209173050.GA10206-7LNsyQBKDXoIagZqoN9o3w@public.gmane.org>
2010-12-09 17:32       ` [RFC PATCH 4/4] allow killing tasks in your own or child userns Serge E. Hallyn
2010-12-09 17:32     ` Serge E. Hallyn
     [not found]       ` <20101209173245.GB10206-7LNsyQBKDXoIagZqoN9o3w@public.gmane.org>
2010-12-10 11:16         ` Eric W. Biederman
2010-12-10 11:16       ` Eric W. Biederman
2010-12-10 16:02         ` Serge E. Hallyn [this message]
     [not found]         ` <m14oal3mjx.fsf-+imSwln9KH6u2/kzUuoCbdi2O/JbrIOy@public.gmane.org>
2010-12-10 16:02           ` Serge E. Hallyn
     [not found]   ` <20101209172843.GA10155-7LNsyQBKDXoIagZqoN9o3w@public.gmane.org>
2010-12-09 17:30     ` [RFC PATCH 3/4] allow sethostname in a container Serge E. Hallyn
2010-12-11  0:50 ` [RFC PATCH 1/4] Add a user_namespace as creator/owner of uts_namespace Alexey Dobriyan
     [not found]   ` <20101211005044.GA25513-ymPLPWd2ZGbSs3Ovhc6N8g@public.gmane.org>
2010-12-11  1:29     ` Eric W. Biederman
2010-12-11  1:29   ` Eric W. Biederman
     [not found] ` <20101209172027.GA10085-7LNsyQBKDXoIagZqoN9o3w@public.gmane.org>
2010-12-09 17:28   ` [RFC PATCH 2/4] security: Make capabilities relative to the user namespace Serge E. Hallyn
2010-12-11  0:50   ` [RFC PATCH 1/4] Add a user_namespace as creator/owner of uts_namespace Alexey Dobriyan

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20101210160223.GA16601@mail.hallyn.com \
    --to=serge@hallyn.com \
    --cc=containers@lists.linux-foundation.org \
    --cc=ebiederm@xmission.com \
    --cc=kees.cook@canonical.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-security-module@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.