From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Michael Kerrisk (man-pages)" Subject: Re: For review: user_namespace(7) man page Date: Tue, 09 Sep 2014 07:00:48 -0700 Message-ID: <540F0810.7030408@gmail.com> References: <53F5310A.5080503@gmail.com> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Return-path: In-Reply-To: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org Errors-To: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org To: Andy Lutomirski Cc: "linux-man-u79uwXL29TY76Z2rM5mHXA@public.gmane.org" , richard -rw- weinberger , Linux Containers , lkml , mtk.manpages-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org, "Eric W. Biederman" List-Id: containers.vger.kernel.org SGkgQW5keSwgYW5kIEVyaWMsCgpPbiAwOS8wMS8yMDE0IDAxOjU3IFBNLCBBbmR5IEx1dG9taXJz a2kgd3JvdGU6Cj4gT24gV2VkLCBBdWcgMjAsIDIwMTQgYXQgNDozNiBQTSwgTWljaGFlbCBLZXJy aXNrIChtYW4tcGFnZXMpCj4gPG10ay5tYW5wYWdlc0BnbWFpbC5jb20+IHdyb3RlOgo+PiBIZWxs byBFcmljIGV0IGFsLiwKPj4KPj4gRm9yIHZhcmlvdXMgcmVhc29ucywgbXkgd29yayBvbiB0aGUg bmFtZXNwYWNlcyBtYW4gcGFnZXMKPj4gZmVsbCBvZmYgdGhlIHRhYmxlIGEgd2hpbGUgYmFjay4g TmV2ZXJ0aGVsZXNzLCB0aGUgcGFnZXMgaGF2ZQo+PiBiZWVuIGNsb3NlIHRvIGNvbXBsZXRpb24g Zm9yIGEgd2hpbGUgbm93LCBhbmQgSSByZWNlbnRseSByZXN0YXJ0ZWQsCj4+IGluIGFuIGVmZm9y dCB0byBmaW5pc2ggdGhlbS4gQXMgeW91IGFsc28gbm90ZWQgdG8gbWUgZjJmLCB0aGVyZSBoYXZl Cj4+IGJlZW4gcmVjZW50bHkgYmVlbiBzb21lIHNtYWxsIG5hbWVzcGFjZSBjaGFuZ2VzIHRoYXQg eW91IG1heSBhZmZlY3QKPj4gdGhlIGNvbnRlbnQgb2YgdGhlIHBhZ2VzLiBUaGVyZWZvcmUsIEkn bGwgdGFrZSB0aGUgb3Bwb3J0dW5pdHkgdG8KPj4gc2VuZCB0aGUgbmFtZXNwYWNlLXJlbGF0ZWQg cGFnZXMgb3V0IGZvciBmdXJ0aGVyIChmaW5hbD8pIHJldmlldy4KPj4KPj4gU28sIGhlcmUsIEkg c3RhcnQgd2l0aCB0aGUgdXNlcl9uYW1lc3BhY2VzKDcpIHBhZ2UsIHdoaWNoIGlzIHNob3duCj4+ IGluIHJlbmRlcmVkIGZvcm0gYmVsb3csIHdpdGggc291cmNlIGF0dGFjaGVkIHRvIHRoaXMgbWFp bC4gSSdsbAo+PiBzZW5kIHZhcmlvdXMgb3RoZXIgcGFnZXMgaW4gZm9sbG93LW9uIG1haWxzLgo+ Pgo+PiBSZXZpZXcgY29tbWVudHMvc3VnZ2VzdGlvbnMgZm9yIGltcHJvdmVtZW50cyAvIGJ1ZyBm aXhlcyB3ZWxjb21lLgo+Pgo+PiBDaGVlcnMsCj4+Cj4+IE1pY2hhZWwKPj4KPj4gPT0KPj4KPj4g TkFNRQo+PiAgICAgICAgdXNlcl9uYW1lc3BhY2VzIC0gb3ZlcnZpZXcgb2YgTGludXggdXNlcl9u YW1lc3BhY2VzCj4+Cj4+IERFU0NSSVBUSU9OCj4+ICAgICAgICBGb3IgYW4gb3ZlcnZpZXcgb2Yg bmFtZXNwYWNlcywgc2VlIG5hbWVzcGFjZXMoNykuCj4+Cj4+ICAgICAgICBVc2VyICAgbmFtZXNw YWNlcyAgIGlzb2xhdGUgICBzZWN1cml0eS1yZWxhdGVkICAgaWRlbnRpZmllcnMgIGFuZAo+PiAg ICAgICAgYXR0cmlidXRlcywgaW4gcGFydGljdWxhciwgdXNlciBJRHMgYW5kIGdyb3VwICBJRHMg IChzZWUgIGNyZWRlbuKAkAo+PiAgICAgICAgdGlhbHMoNyksIHRoZSByb290IGRpcmVjdG9yeSwg a2V5cyAoc2VlIGtleWN0bCgyKSksIGFuZCBjYXBhYmlsaeKAkAo+IAo+IFB1dHRpbmcgInJvb3Qg ZGlyZWN0b3J5IiBoZXJlIGlzIG9kZCAtLSB0aGF0J3MgcmVhbGx5IHBhcnQgb2YgYQo+IGRpZmZl cmVudCBuYW1lc3BhY2UuICBCdXQgdXNlciBuYW1lc3BhY2VzIHNvcnQgb2YgaXNvbGF0ZSB0aGUg b3RoZXIKPiBuYW1lc3BhY2VzIGZyb20gZWFjaCBvdGhlci4KCkknbSB0cnlpbmcgdG8gcmVtZW1i ZXIgdGhlIGRldGFpbHMgaGVyZS4gSSB0aGluayB0aGlzIHBpZWNlIG9yaWdpbmFsbHkgCmNhbWUg YWZ0ZXIgYSBkaXNjdXNzaW9uIHdpdGggRXJpYywgYnV0IEkgYW0gbm90IHN1cmUuIEVyaWM/Cgo+ IEFsc28sIHVnaCwga2V5cy4gIEhvdyBkaWQga2V5Y3RsKDIpIGV2ZXIgbWFrZSBpdCB0aHJvdWdo IGFueSBraW5kIG9mIHJldmlldz8KPiAKPj4gICAgICAgIHRpZXMgKHNlZSBjYXBhYmlsaXRpZXMo NykpLiAgQSBwcm9jZXNzJ3MgdXNlciBhbmQgZ3JvdXAgIElEcyAgY2FuCj4+ICAgICAgICBiZSBk aWZmZXJlbnQgaW5zaWRlIGFuZCBvdXRzaWRlIGEgdXNlciBuYW1lc3BhY2UuICBJbiBwYXJ0aWN1 bGFyLAo+PiAgICAgICAgYSBwcm9jZXNzIGNhbiBoYXZlIGEgbm9ybWFsIHVucHJpdmlsZWdlZCB1 c2VyIElEIG91dHNpZGUgIGEgIHVzZXIKPj4gICAgICAgIG5hbWVzcGFjZSB3aGlsZSBhdCB0aGUg c2FtZSB0aW1lIGhhdmluZyBhIHVzZXIgSUQgb2YgMCBpbnNpZGUgdGhlCj4+ICAgICAgICBuYW1l c3BhY2U7IGluIG90aGVyIHdvcmRzLCB0aGUgcHJvY2VzcyBoYXMgIGZ1bGwgIHByaXZpbGVnZXMg IGZvcgo+PiAgICAgICAgb3BlcmF0aW9ucyAgaW5zaWRlICB0aGUgIHVzZXIgIG5hbWVzcGFjZSwg YnV0IGlzIHVucHJpdmlsZWdlZCBmb3IKPj4gICAgICAgIG9wZXJhdGlvbnMgb3V0c2lkZSB0aGUg bmFtZXNwYWNlLgo+Pgo+PiAgICBOZXN0ZWQgbmFtZXNwYWNlcywgbmFtZXNwYWNlIG1lbWJlcnNo aXAKPj4gICAgICAgIFVzZXIgbmFtZXNwYWNlcyBjYW4gYmUgbmVzdGVkOyAgdGhhdCAgaXMsICBl YWNoICB1c2VyICBuYW1lc3BhY2XigJQKPj4gICAgICAgIGV4Y2VwdCAgdGhlICBpbml0aWFsICAo InJvb3QiKSBuYW1lc3BhY2XigJRoYXMgYSBwYXJlbnQgdXNlciBuYW1lc+KAkAo+PiAgICAgICAg cGFjZSwgYW5kIGNhbiBoYXZlIHplcm8gb3IgbW9yZSBjaGlsZCB1c2VyIG5hbWVzcGFjZXMuICBU aGUgIHBhcuKAkAo+PiAgICAgICAgZW50IHVzZXIgbmFtZXNwYWNlIGlzIHRoZSB1c2VyIG5hbWVz cGFjZSBvZiB0aGUgcHJvY2VzcyB0aGF0IGNyZeKAkAo+PiAgICAgICAgYXRlcyB0aGUgdXNlciBu YW1lc3BhY2UgdmlhIGEgY2FsbCB0byB1bnNoYXJlKDIpIG9yIGNsb25lKDIpIHdpdGgKPj4gICAg ICAgIHRoZSBDTE9ORV9ORVdVU0VSIGZsYWcuCj4+Cj4+ICAgICAgICBUaGUga2VybmVsIGltcG9z ZXMgKHNpbmNlIHZlcnNpb24gMy4xMSkgYSBsaW1pdCBvZiAzMiBuZXN0ZWQgbGV24oCQCj4+ICAg ICAgICBlbHMgb2YgdXNlciBuYW1lc3BhY2VzLiAgQ2FsbHMgdG8gIHVuc2hhcmUoMikgIG9yICBj bG9uZSgyKSAgdGhhdAo+PiAgICAgICAgd291bGQgY2F1c2UgdGhpcyBsaW1pdCB0byBiZSBleGNl ZWRlZCBmYWlsIHdpdGggdGhlIGVycm9yIEVVU0VSUy4KPj4KPj4gICAgICAgIEVhY2ggIHByb2Nl c3MgIGlzICBhICBtZW1iZXIgIG9mICBleGFjdGx5ICBvbmUgdXNlciBuYW1lc3BhY2UuICBBCj4+ ICAgICAgICBwcm9jZXNzIGNyZWF0ZWQgdmlhIGZvcmsoMikgb3IgY2xvbmUoMikgd2l0aG91dCB0 aGUgQ0xPTkVfTkVXVVNFUgo+PiAgICAgICAgZmxhZyAgaXMgIGEgIG1lbWJlciAgb2YgdGhlIHNh bWUgdXNlciBuYW1lc3BhY2UgYXMgaXRzIHBhcmVudC4gIEEKPj4gICAgICAgIHByb2Nlc3MgY2Fu IGpvaW4gYW5vdGhlciB1c2VyIG5hbWVzcGFjZSB3aXRoIHNldG5zKDIpIGlmICBpdCAgaGFzCj4+ ICAgICAgICB0aGUgIENBUF9TWVNfQURNSU4gIGluICB0aGF0IG5hbWVzcGFjZTsgdXBvbiBkb2lu ZyBzbywgaXQgZ2FpbnMgYQo+PiAgICAgICAgZnVsbCBzZXQgb2YgY2FwYWJpbGl0aWVzIGluIHRo YXQgbmFtZXNwYWNlLgo+Pgo+PiAgICAgICAgQSBjYWxsIHRvIGNsb25lKDIpIG9yICB1bnNoYXJl KDIpICB3aXRoICB0aGUgIENMT05FX05FV1VTRVIgIGZsYWcKPj4gICAgICAgIG1ha2VzICB0aGUg IG5ldyAgY2hpbGQgIHByb2Nlc3MgKGZvciBjbG9uZSgyKSkgb3IgdGhlIGNhbGxlciAoZm9yCj4+ ICAgICAgICB1bnNoYXJlKDIpKSBhIG1lbWJlciBvZiB0aGUgbmV3IHVzZXIgIG5hbWVzcGFjZSAg Y3JlYXRlZCAgYnkgIHRoZQo+PiAgICAgICAgY2FsbC4KPj4KPj4gICAgQ2FwYWJpbGl0aWVzCj4+ ICAgICAgICBUaGUgY2hpbGQgcHJvY2VzcyBjcmVhdGVkIGJ5IGNsb25lKDIpIHdpdGggdGhlIENM T05FX05FV1VTRVIgZmxhZwo+PiAgICAgICAgc3RhcnRzIG91dCB3aXRoIGEgY29tcGxldGUgc2V0 IG9mIGNhcGFiaWxpdGllcyBpbiAgdGhlICBuZXcgIHVzZXIKPj4gICAgICAgIG5hbWVzcGFjZS4g IExpa2V3aXNlLCBhIHByb2Nlc3MgdGhhdCBjcmVhdGVzIGEgbmV3IHVzZXIgbmFtZXNwYWNlCj4+ ICAgICAgICB1c2luZyB1bnNoYXJlKDIpICBvciAgam9pbnMgIGFuICBleGlzdGluZyAgdXNlciAg bmFtZXNwYWNlICB1c2luZwo+PiAgICAgICAgc2V0bnMoMikgIGdhaW5zIGEgZnVsbCBzZXQgb2Yg Y2FwYWJpbGl0aWVzIGluIHRoYXQgbmFtZXNwYWNlLiAgT24KPj4gICAgICAgIHRoZSBvdGhlciBo YW5kLCB0aGF0IHByb2Nlc3MgaGFzIG5vIGNhcGFiaWxpdGllcyAgaW4gIHRoZSAgcGFyZW50Cj4+ ICAgICAgICAoaW4gIHRoZSBjYXNlIG9mIGNsb25lKDIpKSBvciBwcmV2aW91cyAoaW4gdGhlIGNh c2Ugb2YgdW5zaGFyZSgyKQo+PiAgICAgICAgYW5kIHNldG5zKDIpKSB1c2VyIG5hbWVzcGFjZSwg ZXZlbiBpZiB0aGUgbmV3IG5hbWVzcGFjZSAgaXMgIGNyZeKAkAo+PiAgICAgICAgYXRlZCAgb3Ig IGpvaW5lZCBieSB0aGUgcm9vdCB1c2VyIChpLmUuLCBhIHByb2Nlc3Mgd2l0aCB1c2VyIElEIDAK Pj4gICAgICAgIGluIHRoZSByb290IG5hbWVzcGFjZSkuCj4+Cj4+ICAgICAgICBOb3RlIHRoYXQg YSBjYWxsIHRvIGV4ZWN2ZSgyKSB3aWxsIGNhdXNlIGEgcHJvY2VzcyAgdG8gIGxvc2UgIGFueQo+ PiAgICAgICAgY2FwYWJpbGl0aWVzIHRoYXQgaXQgaGFzLCB1bmxlc3MgaXQgaGFzIGEgdXNlciBJ RCBvZiAwIHdpdGhpbiB0aGUKPj4gICAgICAgIG5hbWVzcGFjZS4KPiAKPiBPciB1bmxlc3MgZmls ZSBjYXBhYmlsaXRpZXMgaGF2ZSBhIG5vbi1lbXB0eSBpbmhlcml0YWJsZSBtYXNrLgo+IAo+IEl0 IG1heSBiZSB3b3J0aCBtZW50aW9uaW5nIHRoYXQgZXhlY3ZlIGluIGEgdXNlciBuYW1lc3BhY2Ug d29ya3MKPiBleGFjdGx5IGxpa2UgZXhlY3ZlIG91dHNpZGUgYSB1c2VybnMuCgoKSSc7dmUgcmV3 b3JkZWQgdGhhdCBwYXJhIHRvIHNheToKCiAgICAgICBOb3RlIHRoYXQgYSBjYWxsIHRvIGV4ZWN2 ZSgyKSB3aWxsIGNhdXNlIGEgcHJvY2VzcydzICBjYXBhYmlsaeKAkAogICAgICAgdGllcyB0byBi ZSByZWNhbGN1bGF0ZWQgaW4gdGhlIHVzdWFsIHdheSAoc2VlIGNhcGFiaWxpdGllcyg3KSksCiAg ICAgICBzbyB0aGF0IHVzdWFsbHksIHVubGVzcyBpdCBoYXMgYSB1c2VyIElEIG9mIDAgd2l0aGlu IHRoZSBuYW1lc+KAkAogICAgICAgcGFjZSBvciB0aGUgZXhlY3V0YWJsZSBmaWxlIGhhcyBhIG5v bmVtcHR5IGluaGVyaXRhYmxlIGNhcGFiaWzigJAKICAgICAgIGl0aWVzIG1hc2ssIGl0IHdpbGwg bG9zZSBhbGwgY2FwYWJpbGl0aWVzLiAgU2VlIHRoZSAgZGlzY3Vzc2lvbgogICAgICAgb2YgdXNl ciBhbmQgZ3JvdXAgSUQgbWFwcGluZ3MsIGJlbG93LgoKT2theT8KCj4gCj4+ICAgICAgICAgICAg JCBjYXQgL3Byb2MvJCQvdWlkX21hcAo+PiAgICAgICAgICAgICAgICAgICAgIDAgICAgICAgICAg MCA0Mjk0OTY3Mjk1Cj4+Cj4+ICAgICAgICBUaGlzIG1hcHBpbmcgdGVsbHMgdXMgdGhhdCB0aGUg cmFuZ2Ugc3RhcnRpbmcgYXQgIHVzZXIgIElEICAwICBpbgo+PiAgICAgICAgdGhpcyBuYW1lc3Bh Y2UgbWFwcyB0byBhIHJhbmdlIHN0YXJ0aW5nIGF0IDAgaW4gdGhlIChub25leGlzdGVudCkKPj4g ICAgICAgIHBhcmVudCBuYW1lc3BhY2UsIGFuZCB0aGUgbGVuZ3RoIG9mICB0aGUgIHJhbmdlICBp cyAgdGhlICBsYXJnZXN0Cj4+ICAgICAgICAzMi1iaXQgdW5zaWduZWQgaW50ZWdlci4KPj4KPj4g ICAgRGVmaW5pbmcgdXNlciBhbmQgZ3JvdXAgSUQgbWFwcGluZ3M6IHdyaXRpbmcgdG8gdWlkX21h cCBhbmQgZ2lkX21hcAo+PiAgICAgICAgQWZ0ZXIgIHRoZSAgY3JlYXRpb24gb2YgYSBuZXcgdXNl ciBuYW1lc3BhY2UsIHRoZSB1aWRfbWFwIGZpbGUgb2YKPj4gICAgICAgIG9uZSBvZiB0aGUgcHJv Y2Vzc2VzIGluIHRoZSBuYW1lc3BhY2UgbWF5IGJlIHdyaXR0ZW4gdG8gIG9uY2UgIHRvCj4+ICAg ICAgICBkZWZpbmUgIHRoZSAgbWFwcGluZyAgb2YgIHVzZXIgSURzIGluIHRoZSBuZXcgdXNlciBu YW1lc3BhY2UuICBBbgo+PiAgICAgICAgYXR0ZW1wdCB0byB3cml0ZSBtb3JlIHRoYW4gb25jZSB0 byAgYSAgdWlkX21hcCAgZmlsZSAgaW4gIGEgIHVzZXIKPj4gICAgICAgIG5hbWVzcGFjZSAgZmFp bHMgIHdpdGggIHRoZSBlcnJvciBFUEVSTS4gIFNpbWlsYXIgcnVsZXMgYXBwbHkgZm9yCj4+ICAg ICAgICBnaWRfbWFwIGZpbGVzLgo+Pgo+PiAgICAgICAgVGhlIGxpbmVzIHdyaXR0ZW4gdG8gdWlk X21hcCAoZ2lkX21hcCkgbXVzdCBjb25mb3JtIHRvICB0aGUgIGZvbOKAkAo+PiAgICAgICAgbG93 aW5nIHJ1bGVzOgo+Pgo+PiAgICAgICAgKiAgVGhlICB0aHJlZSAgZmllbGRzICBtdXN0ICBiZSB2 YWxpZCBudW1iZXJzLCBhbmQgdGhlIGxhc3QgZmllbGQKPj4gICAgICAgICAgIG11c3QgYmUgZ3Jl YXRlciB0aGFuIDAuCj4+Cj4+ICAgICAgICAqICBMaW5lcyBhcmUgdGVybWluYXRlZCBieSBuZXds aW5lIGNoYXJhY3RlcnMuCj4+Cj4+ICAgICAgICAqICBUaGVyZSBpcyBhbiAoYXJiaXRyYXJ5KSBs aW1pdCBvbiB0aGUgbnVtYmVyIG9mICBsaW5lcyAgaW4gIHRoZQo+PiAgICAgICAgICAgZmlsZS4g IEFzIGF0IExpbnV4IDMuOCwgdGhlIGxpbWl0IGlzIGZpdmUgbGluZXMuICBJbiBhZGRpdGlvbiwK Pj4gICAgICAgICAgIHRoZSBudW1iZXIgb2YgYnl0ZXMgd3JpdHRlbiB0byB0aGUgZmlsZSBtdXN0 IGJlIGxlc3MgdGhhbiAgdGhlCj4+ICAgICAgICAgICBzeXN0ZW0gcGFnZSBzaXplLCBhbmQgdGhl IHdyaXRlIG11c3QgYmUgcGVyZm9ybWVkIGF0IHRoZSBzdGFydAo+PiAgICAgICAgICAgb2YgdGhl IGZpbGUgKGkuZS4sIGxzZWVrKDIpIGFuZCBwd3JpdGUoMikgIGNhbid0ICBiZSAgdXNlZCAgdG8K Pj4gICAgICAgICAgIHdyaXRlIHRvIG5vbnplcm8gb2Zmc2V0cyBpbiB0aGUgZmlsZSkuCj4+Cj4+ ICAgICAgICAqICBUaGUgIHJhbmdlIG9mIHVzZXIgSURzIChncm91cCBJRHMpIHNwZWNpZmllZCBp biBlYWNoIGxpbmUgY2Fu4oCQCj4+ICAgICAgICAgICBub3Qgb3ZlcmxhcCB3aXRoIHRoZSByYW5n ZXMgaW4gYW55IG90aGVyIGxpbmVzLiAgSW4gIHRoZSAgaW5p4oCQCj4+ICAgICAgICAgICB0aWFs ICBpbXBsZW1lbnRhdGlvbiAgKExpbnV4IDMuOCksIHRoaXMgcmVxdWlyZW1lbnQgd2FzIHNhdGlz 4oCQCj4+ICAgICAgICAgICBmaWVkIGJ5IGEgc2ltcGxpc3RpYyBpbXBsZW1lbnRhdGlvbiB0aGF0 IGltcG9zZWQgIHRoZSAgZnVydGhlcgo+PiAgICAgICAgICAgcmVxdWlyZW1lbnQgIHRoYXQgIHRo ZSAgdmFsdWVzICBpbiBib3RoIGZpZWxkIDEgYW5kIGZpZWxkIDIgb2YKPj4gICAgICAgICAgIHN1 Y2Nlc3NpdmUgbGluZXMgbXVzdCBiZSBpbiBhc2NlbmRpbmcgbnVtZXJpY2FsICBvcmRlciwgIHdo aWNoCj4+ICAgICAgICAgICBwcmV2ZW50ZWQgc29tZSBvdGhlcndpc2UgdmFsaWQgbWFwcyBmcm9t IGJlaW5nIGNyZWF0ZWQuICBMaW51eAo+PiAgICAgICAgICAgMy45IGFuZCBsYXRlciBmaXggdGhp cyBsaW1pdGF0aW9uLCBhbGxvd2luZyBhbnkgdmFsaWQgIHNldCAgb2YKPj4gICAgICAgICAgIG5v bm92ZXJsYXBwaW5nIG1hcHMuCj4+Cj4+ICAgICAgICAqICBBdCBsZWFzdCBvbmUgbGluZSBtdXN0 IGJlIHdyaXR0ZW4gdG8gdGhlIGZpbGUuCj4+Cj4+ICAgICAgICBXcml0ZXMgdGhhdCB2aW9sYXRl IHRoZSBhYm92ZSBydWxlcyBmYWlsIHdpdGggdGhlIGVycm9yIEVJTlZBTC4KPj4KPj4gICAgICAg IEluICBvcmRlciAgZm9yICBhICBwcm9jZXNzICB0byAgd3JpdGUgIHRvIHRoZSAvcHJvYy9bcGlk XS91aWRfbWFwCj4+ICAgICAgICAoL3Byb2MvW3BpZF0vZ2lkX21hcCkgZmlsZSwgYWxsICBvZiAg dGhlICBmb2xsb3dpbmcgIHJlcXVpcmVtZW50cwo+PiAgICAgICAgbXVzdCBiZSBtZXQ6Cj4+Cj4+ ICAgICAgICAxLiBUaGUgIHdyaXRpbmcgIHByb2Nlc3MgIG11c3QgIGhhdmUgIHRoZSBDQVBfU0VU VUlEIChDQVBfU0VUR0lEKQo+PiAgICAgICAgICAgY2FwYWJpbGl0eSBpbiB0aGUgdXNlciBuYW1l c3BhY2Ugb2YgdGhlIHByb2Nlc3MgcGlkLgo+IAo+IFRoaXMgY2hlY2tlZCBmb3IgdGhlIG9wZW5p bmcgcHJvY2VzcyAoYW5kIEkgZG9uJ3QgYWN0dWFsbHkgcmVtZW1iZXIKPiB3aGV0aGVyIGl0J3Mg Y2hlY2tlZCBmb3IgdGhlIHdyaXRpbmcgcHJvY2VzcykuCgpFcmljLCBjYW4geW91IGNvbW1lbnQ/ Cgo+Pgo+PiAgICAgICAgMi4gVGhlIHdyaXRpbmcgcHJvY2VzcyBtdXN0IGJlIGluIGVpdGhlciB0 aGUgIHVzZXIgIG5hbWVzcGFjZSAgb2YKPj4gICAgICAgICAgIHRoZSAgcHJvY2VzcyAgcGlkICBv ciAgaW5zaWRlIHRoZSBwYXJlbnQgdXNlciBuYW1lc3BhY2Ugb2YgdGhlCj4+ICAgICAgICAgICBw cm9jZXNzIHBpZC4KPj4KPj4gICAgICAgIDMuIFRoZSBtYXBwZWQgdXNlciBJRHMgKGdyb3VwIElE cykgbXVzdCBpbiB0dXJuIGhhdmUgYSBtYXBwaW5nIGluCj4+ICAgICAgICAgICB0aGUgcGFyZW50 IHVzZXIgbmFtZXNwYWNlLgo+Pgo+PiAgICAgICAgNC4gT25lIG9mIHRoZSBmb2xsb3dpbmcgaXMg dHJ1ZToKPj4KPj4gICAgICAgICAgICogIFRoZSAgZGF0YSB3cml0dGVuIHRvIHVpZF9tYXAgKGdp ZF9tYXApIGNvbnNpc3RzIG9mIGEgc2luZ2xlCj4+ICAgICAgICAgICAgICBsaW5lIHRoYXQgbWFw cyB0aGUgd3JpdGluZyAgcHJvY2VzcydzICBmaWxlc3lzdGVtICB1c2VyICBJRAo+PiAgICAgICAg ICAgICAgKGdyb3VwIElEKSBpbiB0aGUgcGFyZW50IHVzZXIgbmFtZXNwYWNlIHRvIGEgdXNlciBJ RCAoZ3JvdXAKPj4gICAgICAgICAgICAgIElEKSBpbiB0aGUgdXNlciBuYW1lc3BhY2UuICBUaGUg dXN1YWwgIGNhc2UgIGhlcmUgIGlzICB0aGF0Cj4+ICAgICAgICAgICAgICB0aGlzICBzaW5nbGUg IGxpbmUgIHByb3ZpZGVzICBhICBtYXBwaW5nIGZvciB1c2VyIElEIG9mIHRoZQo+PiAgICAgICAg ICAgICAgcHJvY2VzcyB0aGF0IGNyZWF0ZWQgdGhlIG5hbWVzcGFjZS4KPj4KPj4gICAgICAgICAg ICogIFRoZSBwcm9jZXNzIGhhcyB0aGUgQ0FQX1NFVFVJRCAoQ0FQX1NFVEdJRCkgIGNhcGFiaWxp dHkgIGluCj4+ICAgICAgICAgICAgICB0aGUgIHBhcmVudCB1c2VyIG5hbWVzcGFjZS4gIFRodXMs IGEgcHJpdmlsZWdlZCBwcm9jZXNzIGNhbgo+PiAgICAgICAgICAgICAgbWFrZSBtYXBwaW5ncyB0 byBhcmJpdHJhcnkgdXNlciBJRHMgKGdyb3VwIElEcykgaW4gdGhlIHBhcuKAkAo+PiAgICAgICAg ICAgICAgZW50IHVzZXIgbmFtZXNwYWNlLgo+IAo+IFRoZSBvcGVuaW5nIHByb2Nlc3MuCgpGaXhl ZC4KCj4gT25lIG90aGVyIHRoaW5nIHRoYXQgY291bGQgYmUgd29ydGggbWVudGlvbmluZyBpdDog YW55IG5vbi11c2VyCj4gbmFtZXNwYWNlIHRoYXQncyBjcmVhdGVkIGlzIG93bmVkIGJ5IHRoZSB1 c2VyIG5hbWVzcGFjZSBvZiB0aGUgcHJvY2Vzcwo+IHRoYXQgY3JlYXRlZCBpdCBhdCB0aGUgdGlt ZSBvZiBjcmVhdGlvbi4gIEFjdGlvbnMgb24gdGhvc2UgbmFtZXNwYWNlcwo+IHJlcXVpcmUgY2Fw YWJpbGl0aWVzIGluIHRoZSBjb3JyZXNwb25kaW5nIHVzZXIgbmFtZXNwYWNlLgoKSSBhZGRlZDoK CltbCldoZW4gYSBub24tdXNlci1uYW1lc3BhY2UgaXMgY3JlYXRlZCwKaXQgaXMgb3duZWQgYnkg dGhlIHVzZXIgbmFtZXNwYWNlIGluIHdoaWNoIHRoZSBjcmVhdGluZyBwcm9jZXNzCndhcyBhIG1l bWJlciBhdCB0aGUgdGltZSBvZiB0aGUgY3JlYXRpb24gb2YgdGhlIG5hbWVzcGFjZS4KQWN0aW9u cyBvbiB0aGUgbm9uLXVzZXItbmFtZXNwYWNlCnJlcXVpcmUgY2FwYWJpbGl0aWVzIGluIHRoZSBj b3JyZXNwb25kaW5nIHVzZXIgbmFtZXNwYWNlLgpdXQoKPiBUaGFua3MgZm9yIGRvaW5nIHRoaXMh CgpZb3UncmUgd2VsY29tZS4gVGhhbmtzIGZvciB0aGUgcmV2aWV3IQoKQ2hlZXJzLAoKTWljaGFl bAoKCgotLSAKTWljaGFlbCBLZXJyaXNrCkxpbnV4IG1hbi1wYWdlcyBtYWludGFpbmVyOyBodHRw Oi8vd3d3Lmtlcm5lbC5vcmcvZG9jL21hbi1wYWdlcy8KTGludXgvVU5JWCBTeXN0ZW0gUHJvZ3Jh bW1pbmcgVHJhaW5pbmc6IGh0dHA6Ly9tYW43Lm9yZy90cmFpbmluZy8KX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KQ29udGFpbmVycyBtYWlsaW5nIGxpc3QK Q29udGFpbmVyc0BsaXN0cy5saW51eC1mb3VuZGF0aW9uLm9yZwpodHRwczovL2xpc3RzLmxpbnV4 Zm91bmRhdGlvbi5vcmcvbWFpbG1hbi9saXN0aW5mby9jb250YWluZXJz From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756852AbaIIOA7 (ORCPT ); Tue, 9 Sep 2014 10:00:59 -0400 Received: from mail-pd0-f171.google.com ([209.85.192.171]:62418 "EHLO mail-pd0-f171.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752883AbaIIOAz (ORCPT ); Tue, 9 Sep 2014 10:00:55 -0400 Message-ID: <540F0810.7030408@gmail.com> Date: Tue, 09 Sep 2014 07:00:48 -0700 From: "Michael Kerrisk (man-pages)" User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Thunderbird/24.7.0 MIME-Version: 1.0 To: Andy Lutomirski CC: mtk.manpages@gmail.com, "Eric W. Biederman" , lkml , "linux-man@vger.kernel.org" , Linux Containers , richard -rw- weinberger , "Serge E. Hallyn" Subject: Re: For review: user_namespace(7) man page References: <53F5310A.5080503@gmail.com> In-Reply-To: Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Hi Andy, and Eric, On 09/01/2014 01:57 PM, Andy Lutomirski wrote: > On Wed, Aug 20, 2014 at 4:36 PM, Michael Kerrisk (man-pages) > wrote: >> Hello Eric et al., >> >> For various reasons, my work on the namespaces man pages >> fell off the table a while back. Nevertheless, the pages have >> been close to completion for a while now, and I recently restarted, >> in an effort to finish them. As you also noted to me f2f, there have >> been recently been some small namespace changes that you may affect >> the content of the pages. Therefore, I'll take the opportunity to >> send the namespace-related pages out for further (final?) review. >> >> So, here, I start with the user_namespaces(7) page, which is shown >> in rendered form below, with source attached to this mail. I'll >> send various other pages in follow-on mails. >> >> Review comments/suggestions for improvements / bug fixes welcome. >> >> Cheers, >> >> Michael >> >> == >> >> NAME >> user_namespaces - overview of Linux user_namespaces >> >> DESCRIPTION >> For an overview of namespaces, see namespaces(7). >> >> User namespaces isolate security-related identifiers and >> attributes, in particular, user IDs and group IDs (see creden‐ >> tials(7), the root directory, keys (see keyctl(2)), and capabili‐ > > Putting "root directory" here is odd -- that's really part of a > different namespace. But user namespaces sort of isolate the other > namespaces from each other. I'm trying to remember the details here. I think this piece originally came after a discussion with Eric, but I am not sure. Eric? > Also, ugh, keys. How did keyctl(2) ever make it through any kind of review? > >> ties (see capabilities(7)). A process's user and group IDs can >> be different inside and outside a user namespace. In particular, >> a process can have a normal unprivileged user ID outside a user >> namespace while at the same time having a user ID of 0 inside the >> namespace; in other words, the process has full privileges for >> operations inside the user namespace, but is unprivileged for >> operations outside the namespace. >> >> Nested namespaces, namespace membership >> User namespaces can be nested; that is, each user namespace— >> except the initial ("root") namespace—has a parent user names‐ >> pace, and can have zero or more child user namespaces. The par‐ >> ent user namespace is the user namespace of the process that cre‐ >> ates the user namespace via a call to unshare(2) or clone(2) with >> the CLONE_NEWUSER flag. >> >> The kernel imposes (since version 3.11) a limit of 32 nested lev‐ >> els of user namespaces. Calls to unshare(2) or clone(2) that >> would cause this limit to be exceeded fail with the error EUSERS. >> >> Each process is a member of exactly one user namespace. A >> process created via fork(2) or clone(2) without the CLONE_NEWUSER >> flag is a member of the same user namespace as its parent. A >> process can join another user namespace with setns(2) if it has >> the CAP_SYS_ADMIN in that namespace; upon doing so, it gains a >> full set of capabilities in that namespace. >> >> A call to clone(2) or unshare(2) with the CLONE_NEWUSER flag >> makes the new child process (for clone(2)) or the caller (for >> unshare(2)) a member of the new user namespace created by the >> call. >> >> Capabilities >> The child process created by clone(2) with the CLONE_NEWUSER flag >> starts out with a complete set of capabilities in the new user >> namespace. Likewise, a process that creates a new user namespace >> using unshare(2) or joins an existing user namespace using >> setns(2) gains a full set of capabilities in that namespace. On >> the other hand, that process has no capabilities in the parent >> (in the case of clone(2)) or previous (in the case of unshare(2) >> and setns(2)) user namespace, even if the new namespace is cre‐ >> ated or joined by the root user (i.e., a process with user ID 0 >> in the root namespace). >> >> Note that a call to execve(2) will cause a process to lose any >> capabilities that it has, unless it has a user ID of 0 within the >> namespace. > > Or unless file capabilities have a non-empty inheritable mask. > > It may be worth mentioning that execve in a user namespace works > exactly like execve outside a userns. I';ve reworded that para to say: Note that a call to execve(2) will cause a process's capabili‐ ties to be recalculated in the usual way (see capabilities(7)), so that usually, unless it has a user ID of 0 within the names‐ pace or the executable file has a nonempty inheritable capabil‐ ities mask, it will lose all capabilities. See the discussion of user and group ID mappings, below. Okay? > >> $ cat /proc/$$/uid_map >> 0 0 4294967295 >> >> This mapping tells us that the range starting at user ID 0 in >> this namespace maps to a range starting at 0 in the (nonexistent) >> parent namespace, and the length of the range is the largest >> 32-bit unsigned integer. >> >> Defining user and group ID mappings: writing to uid_map and gid_map >> After the creation of a new user namespace, the uid_map file of >> one of the processes in the namespace may be written to once to >> define the mapping of user IDs in the new user namespace. An >> attempt to write more than once to a uid_map file in a user >> namespace fails with the error EPERM. Similar rules apply for >> gid_map files. >> >> The lines written to uid_map (gid_map) must conform to the fol‐ >> lowing rules: >> >> * The three fields must be valid numbers, and the last field >> must be greater than 0. >> >> * Lines are terminated by newline characters. >> >> * There is an (arbitrary) limit on the number of lines in the >> file. As at Linux 3.8, the limit is five lines. In addition, >> the number of bytes written to the file must be less than the >> system page size, and the write must be performed at the start >> of the file (i.e., lseek(2) and pwrite(2) can't be used to >> write to nonzero offsets in the file). >> >> * The range of user IDs (group IDs) specified in each line can‐ >> not overlap with the ranges in any other lines. In the ini‐ >> tial implementation (Linux 3.8), this requirement was satis‐ >> fied by a simplistic implementation that imposed the further >> requirement that the values in both field 1 and field 2 of >> successive lines must be in ascending numerical order, which >> prevented some otherwise valid maps from being created. Linux >> 3.9 and later fix this limitation, allowing any valid set of >> nonoverlapping maps. >> >> * At least one line must be written to the file. >> >> Writes that violate the above rules fail with the error EINVAL. >> >> In order for a process to write to the /proc/[pid]/uid_map >> (/proc/[pid]/gid_map) file, all of the following requirements >> must be met: >> >> 1. The writing process must have the CAP_SETUID (CAP_SETGID) >> capability in the user namespace of the process pid. > > This checked for the opening process (and I don't actually remember > whether it's checked for the writing process). Eric, can you comment? >> >> 2. The writing process must be in either the user namespace of >> the process pid or inside the parent user namespace of the >> process pid. >> >> 3. The mapped user IDs (group IDs) must in turn have a mapping in >> the parent user namespace. >> >> 4. One of the following is true: >> >> * The data written to uid_map (gid_map) consists of a single >> line that maps the writing process's filesystem user ID >> (group ID) in the parent user namespace to a user ID (group >> ID) in the user namespace. The usual case here is that >> this single line provides a mapping for user ID of the >> process that created the namespace. >> >> * The process has the CAP_SETUID (CAP_SETGID) capability in >> the parent user namespace. Thus, a privileged process can >> make mappings to arbitrary user IDs (group IDs) in the par‐ >> ent user namespace. > > The opening process. Fixed. > One other thing that could be worth mentioning it: any non-user > namespace that's created is owned by the user namespace of the process > that created it at the time of creation. Actions on those namespaces > require capabilities in the corresponding user namespace. I added: [[ When a non-user-namespace is created, it is owned by the user namespace in which the creating process was a member at the time of the creation of the namespace. Actions on the non-user-namespace require capabilities in the corresponding user namespace. ]] > Thanks for doing this! You're welcome. Thanks for the review! Cheers, Michael -- Michael Kerrisk Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/ Linux/UNIX System Programming Training: http://man7.org/training/