From mboxrd@z Thu Jan 1 00:00:00 1970 From: George Dunlap Subject: [PATCH 3/5] tools/dm_restrict: Unshare mount and IPC namespaces on Linux Date: Fri, 5 Oct 2018 17:56:59 +0100 Message-ID: <20181005165701.28030-3-george.dunlap@citrix.com> References: <20181005165701.28030-1-george.dunlap@citrix.com> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Return-path: Received: from us1-rack-dfw2.inumbo.com ([104.130.134.6]) by lists.xenproject.org with esmtp (Exim 4.89) (envelope-from ) id 1g8TPY-0001KE-NC for xen-devel@lists.xenproject.org; Fri, 05 Oct 2018 16:57:08 +0000 In-Reply-To: <20181005165701.28030-1-george.dunlap@citrix.com> List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Sender: "Xen-devel" To: xen-devel@lists.xenproject.org Cc: Anthony Perard , Ian Jackson , Wei Liu , George Dunlap List-Id: xen-devel@lists.xenproject.org UUVNVSBydW5uaW5nIHVuZGVyIFhlbiBkb2Vzbid0IG5lZWQgbW91bnQgb3IgSVBDIGZ1bmN0aW9u YWxpdHkuCkNyZWF0ZSBhbmQgZW50ZXIgc2VwYXJhdGUgbmFtZXNwYWNlcyBmb3IgZWFjaCBvZiB0 aGVzZSBiZWZvcmUKZXhlY3V0aW5nIFFFTVUsIHNvIHRoYXQgaW4gdGhlIGV2ZW50IHRoYXQgb3Ro ZXIgcmVzdHJpY3Rpb25zIGZhaWwsIHRoZQpwcm9jZXNzIHdvbid0IGJlIGFibGUgdG8gZXZlbiBu YW1lIHN5c3RlbSBtb3VudCBwb2ludHMgb3IgZXhzdGluZwpub24tZmlsZS1iYXNlZCBJUEMgZGVz Y3JpcHRvcnMgdG8gYXR0ZW1wdCB0byBhdHRhY2sgdGhlbS4KClVuc2hhcmluZyBpcyBzb21ldGhp bmcgYSBwcm9jZXNzIGNhbiBvbmx5IGRvIHRvIGl0c2VsZiAoaXQgd291bGQKc2VlbSk7IHNvIGFk ZCBhbiBvcy1zcGVjaWZpYyAiZG1fcHJlZXhlY19yZXN0cmljdCgpIiBob29rIGp1c3QgYmVmb3Jl CndlIGV4ZWMoKSB0aGUgZGV2aWNlIG1vZGVsLgoKQWxzbyBhZGQgY2hlY2tzIHRvIGRlcHJpdi1w cm9jZXNzLWNoZWNrZXIuc2ggdG8gdmVyaWZ5IHRoYXQgZG0gaXMKcnVubmluZyBpbiBhIG5ldyBu YW1lc3BhY2UgKG9yIGF0IGxlYXN0LCBhIGRpZmZlcmVudCBvbmUgdGhhbiB0aGUKY2FsbGVyKS4K ClN1Z2dlc3RlZC1ieTogUm9zcyBMYWdlcndhbGwgPHJvc3MubGFnZXJ3YWxsQGNpdHJpeC5jb20+ ClNpZ25lZC1vZmYtYnk6IEdlb3JnZSBEdW5sYXAgPGdlb3JnZS5kdW5sYXBAY2l0cml4LmNvbT4K LS0tCkNoYW5nZXMgaW4gdjI6Ci0gUmV0dXJuIGFuIGVycm9yIHJhdGhlciB0aGFuIGNhbGxpbmcg ZXhpdCgpCi0gVXNlIExPR0UoKSBhbmQgcHJpbnQgdG8gdGhlIGN1cnJlbnQgc3RkZXJyIGZkLCBy YXRoZXIgdGhhbgogIHByaW50aW5nIHRvIHRoZSBuZXcgc3RkZXJyIGZkIHZpYSB3cml0ZSgpCi0g VXNlIHIgZm9yIGV4dGVybmFsIHJldHVybiB2YWx1ZXMgcmF0aGVyIHRoYW4gcmMuCgpDQzogSWFu IEphY2tzb24gPGlhbi5qYWNrc29uQGNpdHJpeC5jb20+CkNDOiBXZWkgTGl1IDx3ZWkubGl1MkBj aXRyaXguY29tPgpDQzogQW50aG9ueSBQZXJhcmQgPGFudGhvbnkucGVyYXJkQGNpdHJpeC5jb20+ Ci0tLQogZG9jcy9kZXNpZ25zL3FlbXUtZGVwcml2aWxlZ2UubWQgfCAxMiArKysrKystLS0tLS0K IHRvb2xzL2xpYnhsL2xpYnhsX2RtLmMgICAgICAgICAgIHwgIDYgKysrKysrCiB0b29scy9saWJ4 bC9saWJ4bF9mcmVlYnNkLmMgICAgICB8ICA1ICsrKysrCiB0b29scy9saWJ4bC9saWJ4bF9pbnRl cm5hbC5oICAgICB8ICA1ICsrKysrCiB0b29scy9saWJ4bC9saWJ4bF9saW51eC5jICAgICAgICB8 IDE0ICsrKysrKysrKysrKysrCiB0b29scy9saWJ4bC9saWJ4bF9uZXRic2QuYyAgICAgICB8ICA1 ICsrKysrCiA2IGZpbGVzIGNoYW5nZWQsIDQxIGluc2VydGlvbnMoKyksIDYgZGVsZXRpb25zKC0p CgpkaWZmIC0tZ2l0IGEvZG9jcy9kZXNpZ25zL3FlbXUtZGVwcml2aWxlZ2UubWQgYi9kb2NzL2Rl c2lnbnMvcWVtdS1kZXByaXZpbGVnZS5tZAppbmRleCA2ZGMzYzZkMTQ5Li5lMWM5NzYzYTcxIDEw MDY0NAotLS0gYS9kb2NzL2Rlc2lnbnMvcWVtdS1kZXByaXZpbGVnZS5tZAorKysgYi9kb2NzL2Rl c2lnbnMvcWVtdS1kZXByaXZpbGVnZS5tZApAQCAtNzgsMTIgKzc4LDYgQEAgVGhlbiBhZGRzIHRo ZSBmb2xsb3dpbmcgdG8gdGhlIHFlbXUgY29tbWFuZC1saW5lOgogCQogJycnVGVzdGVkJycnOiBO b3QgdGVzdGVkCiAKLSMjIFJlc3RyaWN0aW9ucyAvIGltcHJvdmVtZW50cyBzdGlsbCB0byBkbwot Ci1UaGlzIGxpc3RzIHBvdGVudGlhbCByZXN0cmljdGlvbnMgc3RpbGwgdG8gZG8uICBJdCBpcyBt ZWFudCB0byBiZQotbGlzdGVkIGluIG9yZGVyIG9mIGVhc2Ugb2YgaW1wbGVtZW50YXRpb24sIHdp dGggbG93LWhhbmdpbmcgZnJ1aXQKLWZpcnN0LgotCiAjIyBOYW1lc3BhY2VzIGZvciB1bnVzZWQg ZnVuY3Rpb25hbGl0eSAoTGludXggb25seSkKIAogJycnRGVzY3JpcHRpb24nJyc6IFFFTVUgZG9l c24ndCB1c2UgdGhlIGZ1bmN0aW9uYWxpdHkgYXNzb2NpYXRlZCB3aXRoCkBAIC0xMTEsNiArMTA1 LDEyIEBAIGNhbGw6CiAKIFtxZW11LW5hbWVzcGFjZXNdOiBodHRwczovL2xpc3RzLmdudS5vcmcv YXJjaGl2ZS9odG1sL3FlbXUtZGV2ZWwvMjAxNy0xMC9tc2cwNDcyMy5odG1sCiAKKyMgUmVzdHJp Y3Rpb25zIC8gaW1wcm92ZW1lbnRzIHN0aWxsIHRvIGRvCisKK1RoaXMgbGlzdHMgcG90ZW50aWFs IHJlc3RyaWN0aW9ucyBzdGlsbCB0byBkby4gIEl0IGlzIG1lYW50IHRvIGJlCitsaXN0ZWQgaW4g b3JkZXIgb2YgZWFzZSBvZiBpbXBsZW1lbnRhdGlvbiwgd2l0aCBsb3ctaGFuZ2luZyBmcnVpdAor Zmlyc3QuCisKICMjIyBCYXNpYyBSTElNSVRzCiAKICcnJ0Rlc2NyaXB0aW9uJycnOiBBIG51bWJl ciBvZiBsaW1pdHMgb24gdGhlIHJlc291cmNlcyB0aGF0IGEgZ2l2ZW4KZGlmZiAtLWdpdCBhL3Rv b2xzL2xpYnhsL2xpYnhsX2RtLmMgYi90b29scy9saWJ4bC9saWJ4bF9kbS5jCmluZGV4IDM4NTY0 M2I1MmMuLjcwMmVhNzUxNDkgMTAwNjQ0Ci0tLSBhL3Rvb2xzL2xpYnhsL2xpYnhsX2RtLmMKKysr IGIvdG9vbHMvbGlieGwvbGlieGxfZG0uYwpAQCAtMjM5Myw2ICsyMzkzLDEyIEBAIHJldHJ5X3Ry YW5zYWN0aW9uOgogICAgICAgICBnb3RvIG91dF9jbG9zZTsKICAgICBpZiAoIXJjKSB7IC8qIGlu bmVyIGNoaWxkICovCiAgICAgICAgIHNldHNpZCgpOworICAgICAgICBpZiAobGlieGxfZGVmYm9v bF92YWwoYl9pbmZvLT5kbV9yZXN0cmljdCkpCisgICAgICAgIHsKKyAgICAgICAgICAgIHJjID0g bGlieGxfX2xvY2FsX2RtX3ByZWV4ZWNfcmVzdHJpY3QoZ2MpOworICAgICAgICAgICAgaWYgKHJj ICE9IDApCisgICAgICAgICAgICAgICAgX2V4aXQoLTEpOworICAgICAgICB9CiAgICAgICAgIGxp YnhsX19leGVjKGdjLCBudWxsLCBsb2dmaWxlX3csIGxvZ2ZpbGVfdywgZG0sIGFyZ3MsIGVudnMp OwogICAgIH0KIApkaWZmIC0tZ2l0IGEvdG9vbHMvbGlieGwvbGlieGxfZnJlZWJzZC5jIGIvdG9v bHMvbGlieGwvbGlieGxfZnJlZWJzZC5jCmluZGV4IDY0NDJjY2VjNzIuLmY3ZWY0YTg5MTAgMTAw NjQ0Ci0tLSBhL3Rvb2xzL2xpYnhsL2xpYnhsX2ZyZWVic2QuYworKysgYi90b29scy9saWJ4bC9s aWJ4bF9mcmVlYnNkLmMKQEAgLTI0NSwzICsyNDUsOCBAQCBpbnQgbGlieGxfX3BjaV90b3BvbG9n eV9pbml0KGxpYnhsX19nYyAqZ2MsCiB7CiAgICAgcmV0dXJuIEVSUk9SX05JOwogfQorCitpbnQg bGlieGxfX2xvY2FsX2RtX3ByZWV4ZWNfcmVzdHJpY3QobGlieGxfX2djICpnYykKK3sKKyAgICBy ZXR1cm4gMDsKK30KZGlmZiAtLWdpdCBhL3Rvb2xzL2xpYnhsL2xpYnhsX2ludGVybmFsLmggYi90 b29scy9saWJ4bC9saWJ4bF9pbnRlcm5hbC5oCmluZGV4IDgwMjM4MmM3MDQuLmRmODVkZGZmMjcg MTAwNjQ0Ci0tLSBhL3Rvb2xzL2xpYnhsL2xpYnhsX2ludGVybmFsLmgKKysrIGIvdG9vbHMvbGli eGwvbGlieGxfaW50ZXJuYWwuaApAQCAtMzc4Miw2ICszNzgyLDExIEBAIHN0cnVjdCBsaWJ4bF9f ZG1fc3Bhd25fc3RhdGUgewogCiBfaGlkZGVuIHZvaWQgbGlieGxfX3NwYXduX2xvY2FsX2RtKGxp YnhsX19lZ2MgKmVnYywgbGlieGxfX2RtX3NwYXduX3N0YXRlKik7CiAKKy8qIAorICogQ2FsbGVk IGFmdGVyIGZvcmtpbmcgYnV0IGJlZm9yZSBleGVjdXRpbmcgdGhlIGxvY2FsIGRldmljZW1vZGVs LgorICovCitfaGlkZGVuIGludCBsaWJ4bF9fbG9jYWxfZG1fcHJlZXhlY19yZXN0cmljdChsaWJ4 bF9fZ2MgKmdjKTsKKwogLyogU3R1YmRvbSBkZXZpY2UgbW9kZWxzLiAqLwogCiB0eXBlZGVmIHN0 cnVjdCB7CmRpZmYgLS1naXQgYS90b29scy9saWJ4bC9saWJ4bF9saW51eC5jIGIvdG9vbHMvbGli eGwvbGlieGxfbGludXguYwppbmRleCA2ZWYwYWJjNjkzLi4zNGFmMmUwZDkwIDEwMDY0NAotLS0g YS90b29scy9saWJ4bC9saWJ4bF9saW51eC5jCisrKyBiL3Rvb2xzL2xpYnhsL2xpYnhsX2xpbnV4 LmMKQEAgLTMwNyw2ICszMDcsMjAgQEAgaW50IGxpYnhsX19wY2lfdG9wb2xvZ3lfaW5pdChsaWJ4 bF9fZ2MgKmdjLAogICAgIHJldHVybiBlcnI7CiB9CiAKK2ludCBsaWJ4bF9fbG9jYWxfZG1fcHJl ZXhlY19yZXN0cmljdChsaWJ4bF9fZ2MgKmdjKQoreworICAgIGludCByOworCisgICAgLyogVW5z aGFyZSBtb3VudCBhbmQgSVBDIG5hbWVzcGFjZXMuICBUaGVzZSBhcmUgdW51c2VkIGJ5IFFFTVUu ICovCisgICAgciA9IHVuc2hhcmUoQ0xPTkVfTkVXTlMgfCBDTE9ORV9ORVdJUEMpOworICAgIGlm IChyIDwgMCkgeworICAgICAgICBMT0dFKEVSUk9SLCAibGlieGw6IE1vdW50IGFuZCBJUEMgbmFt ZXNwYWNlIHVuZmFpbGVkIik7CisgICAgICAgIHJldHVybiBFUlJPUl9GQUlMOworICAgIH0KKwor ICAgIHJldHVybiAwOworfQorCiAvKgogICogTG9jYWwgdmFyaWFibGVzOgogICogbW9kZTogQwpk aWZmIC0tZ2l0IGEvdG9vbHMvbGlieGwvbGlieGxfbmV0YnNkLmMgYi90b29scy9saWJ4bC9saWJ4 bF9uZXRic2QuYwppbmRleCAyZWRmYjAwNjQxLi5kY2UzZjFmZGNlIDEwMDY0NAotLS0gYS90b29s cy9saWJ4bC9saWJ4bF9uZXRic2QuYworKysgYi90b29scy9saWJ4bC9saWJ4bF9uZXRic2QuYwpA QCAtMTI0LDMgKzEyNCw4IEBAIGludCBsaWJ4bF9fcGNpX3RvcG9sb2d5X2luaXQobGlieGxfX2dj ICpnYywKIHsKICAgICByZXR1cm4gRVJST1JfTkk7CiB9CisKK3ZvaWQgbGlieGxfX2xvY2FsX2Rt X3ByZWV4ZWNfcmVzdHJpY3QobGlieGxfX2djICpnYywgaW50IHN0ZGVycmZkKQoreworICAgIHJl dHVybjsKK30KLS0gCjIuMTkuMAoKCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fClhlbi1kZXZlbCBtYWlsaW5nIGxpc3QKWGVuLWRldmVsQGxpc3RzLnhlbnBy b2plY3Qub3JnCmh0dHBzOi8vbGlzdHMueGVucHJvamVjdC5vcmcvbWFpbG1hbi9saXN0aW5mby94 ZW4tZGV2ZWw=