user namespaces config option

user namespaces config option

[Pavel Emelyanov]

Hi, Cedric, Serge.

I have noticed, that you have removed config options for
uts and ipc namespaces but kept one for user namespace.

What's the policy about what namespaces should have config
option? I thought, that the only code that is worth having
under option is clone/destroy one to save .text size for
people who don't need them (embedded).

Thanks,
Pavel

Re: user namespaces config option

[Serge E. Hallyn]

Quoting Pavel Emelyanov (xemul-GEFAQzZX7r8dnm+yROfE0A@public.gmane.org):
> Hi, Cedric, Serge.
>
> I have noticed, that you have removed config options for
> uts and ipc namespaces but kept one for user namespace.
>
> What's the policy about what namespaces should have config
> option? I thought, that the only code that is worth having
> under option is clone/destroy one to save .text size for
> people who don't need them (embedded).

The user namespaces are under a config and marked experimental because
uid-based permission checks do not take namespaces into account and the
root user in a namespace is not at all controlled.  You can handle the
security implications using selinux, but I guess the fear is that people
would assume uid namespaces do more than they currently do.

-serge

Re: user namespaces config option

[Cedric Le Goater]

Pavel Emelyanov wrote:
> Hi, Cedric, Serge.
> 
> I have noticed, that you have removed config options for
> uts and ipc namespaces but kept one for user namespace.
> 
> What's the policy about what namespaces should have config
> option? I thought, that the only code that is worth having
> under option is clone/destroy one to save .text size for
> people who don't need them (embedded).

yes .text size is important for the embedded people but performance 
also. so if perf is not impacted and .text increase is reasonable, 
it's interesting to remove the config option and clarify the code
at the same time. This was the case of uts and ipc ns.  

user ns is far from complete and should be kept experimental.

C.