From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Michael Kerrisk (man-pages)" Subject: Re: For review: user_namespace(7) man page Date: Thu, 11 Sep 2014 07:40:20 -0700 Message-ID: <5411B454.4010907@gmail.com> References: <53F5310A.5080503@gmail.com> <87d2bhfxvc.fsf@x220.int.ebiederm.org> <540F07C7.9000300@gmail.com> <87sik0oktt.fsf@x220.int.ebiederm.org> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Return-path: In-Reply-To: <87sik0oktt.fsf-JOvCrm2gF+uungPnsOpG7nhyD016LWXt@public.gmane.org> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org Errors-To: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org To: "Eric W. Biederman" Cc: "linux-man-u79uwXL29TY76Z2rM5mHXA@public.gmane.org" , richard.weinberger-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org, containers-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org, lkml , Andy Lutomirski , mtk.manpages-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org List-Id: containers.vger.kernel.org T24gMDkvMDkvMjAxNCAwODo0OSBBTSwgRXJpYyBXLiBCaWVkZXJtYW4gd3JvdGU6Cj4gIk1pY2hh ZWwgS2VycmlzayAobWFuLXBhZ2VzKSIgPG10ay5tYW5wYWdlc0BnbWFpbC5jb20+IHdyaXRlczoK PiAKPj4gSGkgRXJpYywKPj4KPj4gT24gMDgvMzAvMjAxNCAwMjo1MyBQTSwgRXJpYyBXLiBCaWVk ZXJtYW4gd3JvdGU6Cj4+PiAiTWljaGFlbCBLZXJyaXNrIChtYW4tcGFnZXMpIiA8bXRrLm1hbnBh Z2VzQGdtYWlsLmNvbT4gd3JpdGVzOgo+Pj4KPj4+PiBIZWxsbyBFcmljIGV0IGFsLiwKPj4+Pgo+ Pj4+IEZvciB2YXJpb3VzIHJlYXNvbnMsIG15IHdvcmsgb24gdGhlIG5hbWVzcGFjZXMgbWFuIHBh Z2VzIAo+Pj4+IGZlbGwgb2ZmIHRoZSB0YWJsZSBhIHdoaWxlIGJhY2suIE5ldmVydGhlbGVzcywg dGhlIHBhZ2VzIGhhdmUKPj4+PiBiZWVuIGNsb3NlIHRvIGNvbXBsZXRpb24gZm9yIGEgd2hpbGUg bm93LCBhbmQgSSByZWNlbnRseSByZXN0YXJ0ZWQsCj4+Pj4gaW4gYW4gZWZmb3J0IHRvIGZpbmlz aCB0aGVtLiBBcyB5b3UgYWxzbyBub3RlZCB0byBtZSBmMmYsIHRoZXJlIGhhdmUKPj4+PiBiZWVu IHJlY2VudGx5IGJlZW4gc29tZSBzbWFsbCBuYW1lc3BhY2UgY2hhbmdlcyB0aGF0IHlvdSBtYXkg YWZmZWN0Cj4+Pj4gdGhlIGNvbnRlbnQgb2YgdGhlIHBhZ2VzLiBUaGVyZWZvcmUsIEknbGwgdGFr ZSB0aGUgb3Bwb3J0dW5pdHkgdG8KPj4+PiBzZW5kIHRoZSBuYW1lc3BhY2UtcmVsYXRlZCBwYWdl cyBvdXQgZm9yIGZ1cnRoZXIgKGZpbmFsPykgcmV2aWV3Lgo+Pj4+Cj4+Pj4gU28sIGhlcmUsIEkg c3RhcnQgd2l0aCB0aGUgdXNlcl9uYW1lc3BhY2VzKDcpIHBhZ2UsIHdoaWNoIGlzIHNob3duIAo+ Pj4+IGluIHJlbmRlcmVkIGZvcm0gYmVsb3csIHdpdGggc291cmNlIGF0dGFjaGVkIHRvIHRoaXMg bWFpbC4gSSdsbAo+Pj4+IHNlbmQgdmFyaW91cyBvdGhlciBwYWdlcyBpbiBmb2xsb3ctb24gbWFp bHMuCj4+Pj4KPj4+PiBSZXZpZXcgY29tbWVudHMvc3VnZ2VzdGlvbnMgZm9yIGltcHJvdmVtZW50 cyAvIGJ1ZyBmaXhlcyB3ZWxjb21lLgo+Pj4+Cj4+Pj4gQ2hlZXJzLAo+Pj4+Cj4+Pj4gTWljaGFl bAo+Pj4+Cj4+Pj4gPT0KPj4+Pgo+Pj4+IE5BTUUKPj4+PiAgICAgICAgdXNlcl9uYW1lc3BhY2Vz IC0gb3ZlcnZpZXcgb2YgTGludXggdXNlcl9uYW1lc3BhY2VzCj4+Pj4KPj4gWy4uLl0KPj4KPj4+ PiAgICAgICAgV2hlbiBhIG5ldyBJUEMsIG1vdW50LCBuZXR3b3JrLCBQSUQsIG9yIFVUUyBuYW1l c3BhY2UgaXMgIGNyZWF0ZWQKPj4+PiAgICAgICAgdmlhIGNsb25lKDIpIG9yIHVuc2hhcmUoMiks IHRoZSBrZXJuZWwgcmVjb3JkcyB0aGUgdXNlciBuYW1lc3BhY2UKPj4+PiAgICAgICAgb2YgdGhl IGNyZWF0aW5nIHByb2Nlc3MgYWdhaW5zdCB0aGUgbmV3IG5hbWVzcGFjZS4gIChUaGlzIGFzc29j aeKAkAo+Pj4+ICAgICAgICBhdGlvbiAgY2FuJ3QgIGJlICBjaGFuZ2VkLikgICBXaGVuIGEgcHJv Y2VzcyBpbiB0aGUgbmV3IG5hbWVzcGFjZQo+Pj4+ICAgICAgICBzdWJzZXF1ZW50bHkgIHBlcmZv cm1zICBwcml2aWxlZ2VkICBvcGVyYXRpb25zICB0aGF0ICBvcGVyYXRlICBvbgo+Pj4+ICAgICAg ICBnbG9iYWwgcmVzb3VyY2VzIGlzb2xhdGVkIGJ5IHRoZSBuYW1lc3BhY2UsIHRoZSBwZXJtaXNz aW9uIGNoZWNrcwo+Pj4+ICAgICAgICBhcmUgcGVyZm9ybWVkIGFjY29yZGluZyB0byB0aGUgcHJv Y2VzcydzIGNhcGFiaWxpdGllcyBpbiB0aGUgdXNlcgo+Pj4+ICAgICAgICBuYW1lc3BhY2UgdGhh dCB0aGUga2VybmVsIGFzc29jaWF0ZWQgd2l0aCB0aGUgbmV3IG5hbWVzcGFjZS4KPj4+Cj4+PiBS ZXN0cmljdGlvbnMgb24gbW91bnQgbmFtZXNwYWNlcy4KPj4+Cj4+PiAtIEEgbW91bnQgbmFtZXNw YWNlIGhhcyBhIG93bmVyIHVzZXIgbmFtZXNwYWNlLiAgQSBtb3VudCBuYW1lc3BhY2Ugd2hvc2UK Pj4+ICAgb3duZXIgdXNlciBuYW1lc3BhY2UgaXMgZGlmZmVyZW50IHRoYW4gdGhlIG93ZXJuZXIg dXNlciBuYW1lc3BhY2Ugb2YKPj4+ICAgaXQncyBwYXJlbnQgbW91bnQgbmFtZXNwYWNlIGlzIGNv bnNpZGVyZWQgYSBsZXNzIHByaXZpbGVnZWQgbW91bnQKPj4+ICAgbmFtZXNwYWNlLgo+Pj4KPj4+ IC0gV2hlbiBjcmVhdGluZyBhIGxlc3MgcHJpdmlsZWdlZCBtb3VudCBuYW1lc3BhY2Ugc2hhcmVk IG1vdW50cyBhcmUKPj4+ICAgcmVkdWNlZCB0byBzbGF2ZSBtb3VudHMuICBUaGlzIGVuc3VyZXMg dGhhdCBtYXBwaW5ncyBwZXJmb3JtZWQgaW4gbGVzcwo+Pj4gICBwcml2aWxlZ2VkIG1vdW50IG5h bWVzcGFjZXMgd2lsbCBub3QgcHJvcG9nYXRlIHRvIG1vcmUgcHJpdmllbGdlZAo+Pj4gICBtb3Vu dCBuYW1lc3BhY2VzLgo+Pj4KPj4+IC0gTW91bnRzIHRoYXQgY29tZSBhcyBhIHNpbmdsZSB1bml0 IGZyb20gbW9yZSBwcml2aWxlZ2VkIG1vdW50IGFyZQo+Pj4gICBsb2NrZWQgdG9nZXRoZXIgYW5k IG1heSBub3QgYmUgc2VwYXJhdGVkIGluIGEgbGVzcyBwcml2aWVsZ2VkIG1vdW50Cj4+PiAgIG5h bWVzcGFjZS4KPj4KPj4gQ291bGQgeW91IGNsYXJpZnkgd2hhdCB5b3UgbWVhbiBieSAiTW91bnRz IHRoYXQgY29tZSBhcyBhIHNpbmdsZQo+PiB1bml0Ij8KPiAKPiB1bnNoYXJlKENMT05FX05FV05T KSBicmluZ3MgYWNyb3NzIGFsbCBvZiB0aGUgbW91bnRzIGZyb20gdGhlIG9yaWdpbmFsCj4gbW91 bnQgbmFtZXNwYWNlIGFzIGEgc2luZ2xlIHVuaXQuCj4gCj4gcmVjdXJzaXZlIG1vdW50cyB0aGF0 IHByb3BvZ2F0ZSBiZXR3ZWVuIG1vdW50IG5hbWVzcGFjZXMgcHJvcG9nYXRlIGFzIGEKPiBzaW5n bGUgdW5pdC4KClRoYW5rcywgSSd2ZSBhZGRlZCB0aG9zZSBkZXRhaWxzIHRvIHRoZSBwYWdlLgoK PiBUaGUgaW1wb3J0YW5jZSBvZiB0aGlzIGlzIGFsbG93IHRoZSBnbG9iYWwgcm9vdCB0byBtb3Vu dCBvdmVyIHRoaW5ncwo+IGFuZCBub3QgaGF2ZSB0byB3b3JyeSB0aGF0IHNvbWVvbmUgZnJvbSBh IHVzZXIgbmFtZXNwYWNlIHJvb3QgY2FuCj4gcGVlayB1bmRlcm5lYXRoLgo+IAo+Pj4gLSBUaGUg bW91bnQgZmxhZ3MgcmVhZG9ubHksIG5vZGV2LCBub3N1aWQsIG5vZXhlYywgYW5kIHRoZSBtb3Vu dCBhdGltZQo+Pj4gICBzZXR0aW5ncyB3aGVuIHByb3BvZ2F0ZWQgZnJvbSBhIG1vcmUgcHJpdmll bGdlZCB0byBhIGxlc3MgcHJpdmlsZWdlZAo+Pj4gICBtb3VudCBuYW1lc3BhY2UgYmVjb21lIGxv Y2tlZCwgYW5kIG1heSBub3QgYmUgY2hhbmdlZCBpbiB0aGUgbGVzcwo+Pj4gICBwcml2aWVsZ2Vk IG1vdW50IG5hbWVzcGFjZS4KPj4+Cj4+PiAtIChBcyBvZiAzLjE4LXJjMSAoaW4gdG9kYXlzIEFs IFZpcm9zIHZmcy5naXQjZm9yLW5leHQgdHJlZSkpIEEgZmlsZSBvcgo+Pj4gICBkaXJlY3Rvcnkg dGhhdCBpcyBhIG1vdW50cG9pbnQgaW4gb25lIG5hbWVzcGFjZSB0aGF0IGlzIG5vdCBhIG1vdW50 Cj4+PiAgIHBvaW50IGluIGFub3RoZXIgbmFtZXNwYWNlLCBtYXkgYmUgcmVuYW1lZCwgdW5saW5r ZWQsIG9yIHJtZGlyZWQgaW4KPj4+ICAgdGhlIG1vdW50IG5hbWVzcGFjZSBpbiB3aGljaCBpdCBp cyBub3QgYSBtb3VudCBuYW1lc3BhY2UgaWYgdGhlCj4+PiAgIG9yZGluYXJ5IHBlcm1pc3Npb24g Y2hlY2tzIHBhc3MuCj4+Pgo+Pj4gICBQcmV2aW91c2x5IGF0dGVtcGluZyB0byBybWRpciwgdW5s aW5rIG9yIHJlbmFtZSBhIGZpbGUgb3IgZGlyZWN0b3J5Cj4+PiAgIHRoYXQgd2FzIGEgbW91bnQg cG9pbnQgaW4gYW5vdGhlciBtb3VudCBuYW1lc3BhY2Ugd291bGQgcmVzdWx0IGluCj4+PiAgIC1F QlVTWS4gIFRoaXMgYmVoYXZpb3IgaGFkIHRlY2huaWNhbCBwcm9ibGVtcyBvZiBlbmZvcmNlbWVu dCAobmZzKQo+Pj4gICBhbmQgcmVzdWx0ZWQgaW4gYSBuaWNlIGRlbmlhbCBvZiBzZXJ2aWFsIGF0 dGFjayBhZ2FpbnN0IG1vcmUKPj4+ICAgcHJpdmlsZWdlZCB1c2Vycy4gIChBa2EgcHJldmVudGlu ZyBpbmRpdmlkdWFsIGZpbGVzIGZyb20gYmVpbmcgdXBkYXRlZAo+Pj4gICBieSBiaW5kIG1vdW50 aW5nIG9uIHRvcCBvZiB0aGVtKS4KPj4KPj4gSSBoYXZlIHJld29ya2VkIHRoZSB0ZXh0IGFib3Zl IGEgbGl0dGxlIHNvIHRoYXQgbm93IHdlIGhhdmUgdGhlIGZvbGxvd2luZy4KPj4gQXNpZGUgZnJv bSBxdWVzdGlvbiBhYm92ZSwgZG9lcyBpdCBsb29rIG9rYXk/Cj4+Cj4+ICAgIFJlc3RyaWN0aW9u cyBvbiBtb3VudCBuYW1lc3BhY2VzCj4+ICAgICAgICBOb3RlIHRoZSBmb2xsb3dpbmcgcG9pbnRz IHdpdGggcmVzcGVjdCB0byBtb3VudCBuYW1lc3BhY2VzOgo+Pgo+PiAgICAgICAgKiAgQSAgbW91 bnQgIG5hbWVzcGFjZSAgaGFzICBuYSAgb3duZXIgdXNlciBuYW1lc3BhY2UuICBBIG1vdW50Cj4g ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIF5zL25hL2FuLwo+PiAgICAgICAg ICAgbmFtZXNwYWNlIHdob3NlIG93bmVyIHVzZXIgbmFtZXNwYWNlIGlzIGRpZmZlcmVudCAgZnJv bSAgdGhlCj4+ICAgICAgICAgICBvd25lciAgdXNlciAgbmFtZXNwYWNlIG9mIGl0cyBwYXJlbnQg bW91bnQgbmFtZXNwYWNlIGlzIGNvbuKAkAo+PiAgICAgICAgICAgc2lkZXJlZCBhIGxlc3MgcHJp dmlsZWdlZCBtb3VudCBuYW1lc3BhY2UuCj4+Cj4+ICAgICAgICAqICBXaGVuIGNyZWF0aW5nIGEg IGxlc3MgIHByaXZpbGVnZWQgIG1vdW50ICBuYW1lc3BhY2UsICBzaGFyZWQKPj4gICAgICAgICAg IG1vdW50cyAgYXJlIHJlZHVjZWQgdG8gc2xhdmUgbW91bnRzLiAgVGhpcyBlbnN1cmVzIHRoYXQg bWFw4oCQCj4+ICAgICAgICAgICBwaW5ncyBwZXJmb3JtZWQgaW4gbGVzcyBwcml2aWxlZ2VkIG1v dW50IG5hbWVzcGFjZXMgd2lsbCBub3QKPj4gICAgICAgICAgIHByb3BhZ2F0ZSB0byBtb3JlIHBy aXZpbGVnZWQgbW91bnQgbmFtZXNwYWNlcy4KPj4KPj4gICAgICAgICogIE1vdW50cyB0aGF0IGNv bWUgYXMgYSBzaW5nbGUgdW5pdCBmcm9tIG1vcmUgcHJpdmlsZWdlZCBtb3VudAo+ICAgICAgICAg ICAgIF4gbmFtZXNwYWNlcwo+PiAgICAgICAgICAgYXJlIGxvY2tlZCB0b2dldGhlciBhbmQgbWF5 IG5vdCBiZSBzZXBhcmF0ZWQgaW4gYSBsZXNzIHByaXbigJAKPj4gICAgICAgICAgIGlsZWdlZCBt b3VudCBuYW1lc3BhY2UuCj4+Cj4+ICAgICAgICAqICBUaGUgIG1vdW50KDIpIGZsYWdzIE1TX1JE T05MWSwgTVNfTk9TVUlELCBNU19OT0VYRUMsIGFuZCB0aGUKPj4gICAgICAgICAgICJhdGltZSIg ZmxhZ3MgKE1TX05PQVRJTUUsIE1TX05PRElSQVRJTUUsIE1TX1JFTEFUSU1FKSAgc2V04oCQCj4+ ICAgICAgICAgICB0aW5ncyAgYmVjb21lICBsb2NrZWQgd2hlbiBwcm9wYWdhdGVkIGZyb20gYSBt b3JlIHByaXZpbGVnZWQKPj4gICAgICAgICAgIHRvIGEgbGVzcyBwcml2aWxlZ2VkIG1vdW50IG5h bWVzcGFjZSwgYW5kIG1heSBub3QgYmUgY2hhbmdlZAo+PiAgICAgICAgICAgaW4gdGhlIGxlc3Mg cHJpdmlsZWdlZCBtb3VudCBuYW1lc3BhY2UuCj4+Cj4+ICAgICAgICAqICBBICBmaWxlICBvciBk aXJlY3RvcnkgdGhhdCBpcyBhIG1vdW50IHBvaW50IGluIG9uZSBuYW1lc3BhY2UKPj4gICAgICAg ICAgIHRoYXQgaXMgbm90IGEgbW91bnQgIHBvaW50ICBpbiAgYW5vdGhlciAgbmFtZXNwYWNlLCAg bWF5ICBiZQo+PiAgICAgICAgICAgcmVuYW1lZCwgdW5saW5rZWQsIG9yIHJlbW92ZWQgKHJtZGly KDIpKSBpbiB0aGUgbW91bnQgbmFtZXPigJAKPj4gICAgICAgICAgIHBhY2UgaW4gd2hpY2ggaXQg aXMgbm90IGEgbW91bnQgcG9pbnQgKHN1YmplY3QgdG8gdGhlICB1c3VhbAo+PiAgICAgICAgICAg cGVybWlzc2lvbiBjaGVja3MpLgo+Pgo+PiAgICAgICAgICAgUHJldmlvdXNseSwgIGF0dGVtcHRp bmcgIHRvIHVubGluaywgcmVuYW1lLCBvciByZW1vdmUgYSBmaWxlCj4+ICAgICAgICAgICBvciBk aXJlY3RvcnkgdGhhdCB3YXMgYSBtb3VudCBwb2ludCBpbiBhbm90aGVyIG1vdW50ICBuYW1lc+KA kAo+PiAgICAgICAgICAgcGFjZSAgd291bGQgIHJlc3VsdCAgaW4gIHRoZSBlcnJvciBFQlVTWS4g IFRoYXQgYmVoYXZpb3IgaGFkCj4+ICAgICAgICAgICB0ZWNobmljYWwgcHJvYmxlbXMgb2YgZW5m b3JjZW1lbnQgKGUuZy4sIGZvciBORlMpICBhbmQgIHBlcuKAkAo+PiAgICAgICAgICAgbWl0dGVk ICBkZW5pYWwtb2Ytc2VydmljZSAgYXR0YWNrcyAgYWdhaW5zdCAgbW9yZSBwcml2aWxlZ2VkCj4+ ICAgICAgICAgICB1c2Vycy4gICAoaS5lLiwgIHByZXZlbnRpbmcgIGluZGl2aWR1YWwgIGZpbGVz ICBmcm9tICAgYmVpbmcKPj4gICAgICAgICAgIHVwZGF0ZWQgYnkgYmluZCBtb3VudGluZyBvbiB0 b3Agb2YgdGhlbSkuCj4gCj4gU3ViamVjdCB0byB0aW55IHR5cG8gY29ycmVjdGlvbnMgdGhhdCBs b29rcyBmaW5lLgoKWXVwLCBJIGFscmVhZHkgZm91bmQgYW5kIGZpeGVkIDstKS4KClRoYW5rcywg RXJpYy4KCkNoZWVycywKCk1pY2hhZWwKCgoKLS0gCk1pY2hhZWwgS2VycmlzawpMaW51eCBtYW4t cGFnZXMgbWFpbnRhaW5lcjsgaHR0cDovL3d3dy5rZXJuZWwub3JnL2RvYy9tYW4tcGFnZXMvCkxp bnV4L1VOSVggU3lzdGVtIFByb2dyYW1taW5nIFRyYWluaW5nOiBodHRwOi8vbWFuNy5vcmcvdHJh aW5pbmcvCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCkNv bnRhaW5lcnMgbWFpbGluZyBsaXN0CkNvbnRhaW5lcnNAbGlzdHMubGludXgtZm91bmRhdGlvbi5v cmcKaHR0cHM6Ly9saXN0cy5saW51eGZvdW5kYXRpb24ub3JnL21haWxtYW4vbGlzdGluZm8vY29u dGFpbmVycw== From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755958AbaIKOkp (ORCPT ); Thu, 11 Sep 2014 10:40:45 -0400 Received: from mail-pd0-f170.google.com ([209.85.192.170]:45079 "EHLO mail-pd0-f170.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755826AbaIKOkm (ORCPT ); Thu, 11 Sep 2014 10:40:42 -0400 Message-ID: <5411B454.4010907@gmail.com> Date: Thu, 11 Sep 2014 07:40:20 -0700 From: "Michael Kerrisk (man-pages)" User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Thunderbird/24.7.0 MIME-Version: 1.0 To: "Eric W. Biederman" CC: mtk.manpages@gmail.com, lkml , "linux-man@vger.kernel.org" , containers@lists.linux-foundation.org, Andy Lutomirski , richard.weinberger@gmail.com, "Serge E. Hallyn" Subject: Re: For review: user_namespace(7) man page References: <53F5310A.5080503@gmail.com> <87d2bhfxvc.fsf@x220.int.ebiederm.org> <540F07C7.9000300@gmail.com> <87sik0oktt.fsf@x220.int.ebiederm.org> In-Reply-To: <87sik0oktt.fsf@x220.int.ebiederm.org> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 09/09/2014 08:49 AM, Eric W. Biederman wrote: > "Michael Kerrisk (man-pages)" writes: > >> Hi Eric, >> >> On 08/30/2014 02:53 PM, Eric W. Biederman wrote: >>> "Michael Kerrisk (man-pages)" writes: >>> >>>> Hello Eric et al., >>>> >>>> For various reasons, my work on the namespaces man pages >>>> fell off the table a while back. Nevertheless, the pages have >>>> been close to completion for a while now, and I recently restarted, >>>> in an effort to finish them. As you also noted to me f2f, there have >>>> been recently been some small namespace changes that you may affect >>>> the content of the pages. Therefore, I'll take the opportunity to >>>> send the namespace-related pages out for further (final?) review. >>>> >>>> So, here, I start with the user_namespaces(7) page, which is shown >>>> in rendered form below, with source attached to this mail. I'll >>>> send various other pages in follow-on mails. >>>> >>>> Review comments/suggestions for improvements / bug fixes welcome. >>>> >>>> Cheers, >>>> >>>> Michael >>>> >>>> == >>>> >>>> NAME >>>> user_namespaces - overview of Linux user_namespaces >>>> >> [...] >> >>>> When a new IPC, mount, network, PID, or UTS namespace is created >>>> via clone(2) or unshare(2), the kernel records the user namespace >>>> of the creating process against the new namespace. (This associ‐ >>>> ation can't be changed.) When a process in the new namespace >>>> subsequently performs privileged operations that operate on >>>> global resources isolated by the namespace, the permission checks >>>> are performed according to the process's capabilities in the user >>>> namespace that the kernel associated with the new namespace. >>> >>> Restrictions on mount namespaces. >>> >>> - A mount namespace has a owner user namespace. A mount namespace whose >>> owner user namespace is different than the owerner user namespace of >>> it's parent mount namespace is considered a less privileged mount >>> namespace. >>> >>> - When creating a less privileged mount namespace shared mounts are >>> reduced to slave mounts. This ensures that mappings performed in less >>> privileged mount namespaces will not propogate to more privielged >>> mount namespaces. >>> >>> - Mounts that come as a single unit from more privileged mount are >>> locked together and may not be separated in a less privielged mount >>> namespace. >> >> Could you clarify what you mean by "Mounts that come as a single >> unit"? > > unshare(CLONE_NEWNS) brings across all of the mounts from the original > mount namespace as a single unit. > > recursive mounts that propogate between mount namespaces propogate as a > single unit. Thanks, I've added those details to the page. > The importance of this is allow the global root to mount over things > and not have to worry that someone from a user namespace root can > peek underneath. > >>> - The mount flags readonly, nodev, nosuid, noexec, and the mount atime >>> settings when propogated from a more privielged to a less privileged >>> mount namespace become locked, and may not be changed in the less >>> privielged mount namespace. >>> >>> - (As of 3.18-rc1 (in todays Al Viros vfs.git#for-next tree)) A file or >>> directory that is a mountpoint in one namespace that is not a mount >>> point in another namespace, may be renamed, unlinked, or rmdired in >>> the mount namespace in which it is not a mount namespace if the >>> ordinary permission checks pass. >>> >>> Previously attemping to rmdir, unlink or rename a file or directory >>> that was a mount point in another mount namespace would result in >>> -EBUSY. This behavior had technical problems of enforcement (nfs) >>> and resulted in a nice denial of servial attack against more >>> privileged users. (Aka preventing individual files from being updated >>> by bind mounting on top of them). >> >> I have reworked the text above a little so that now we have the following. >> Aside from question above, does it look okay? >> >> Restrictions on mount namespaces >> Note the following points with respect to mount namespaces: >> >> * A mount namespace has na owner user namespace. A mount > ^s/na/an/ >> namespace whose owner user namespace is different from the >> owner user namespace of its parent mount namespace is con‐ >> sidered a less privileged mount namespace. >> >> * When creating a less privileged mount namespace, shared >> mounts are reduced to slave mounts. This ensures that map‐ >> pings performed in less privileged mount namespaces will not >> propagate to more privileged mount namespaces. >> >> * Mounts that come as a single unit from more privileged mount > ^ namespaces >> are locked together and may not be separated in a less priv‐ >> ileged mount namespace. >> >> * The mount(2) flags MS_RDONLY, MS_NOSUID, MS_NOEXEC, and the >> "atime" flags (MS_NOATIME, MS_NODIRATIME, MS_RELATIME) set‐ >> tings become locked when propagated from a more privileged >> to a less privileged mount namespace, and may not be changed >> in the less privileged mount namespace. >> >> * A file or directory that is a mount point in one namespace >> that is not a mount point in another namespace, may be >> renamed, unlinked, or removed (rmdir(2)) in the mount names‐ >> pace in which it is not a mount point (subject to the usual >> permission checks). >> >> Previously, attempting to unlink, rename, or remove a file >> or directory that was a mount point in another mount names‐ >> pace would result in the error EBUSY. That behavior had >> technical problems of enforcement (e.g., for NFS) and per‐ >> mitted denial-of-service attacks against more privileged >> users. (i.e., preventing individual files from being >> updated by bind mounting on top of them). > > Subject to tiny typo corrections that looks fine. Yup, I already found and fixed ;-). Thanks, Eric. Cheers, Michael -- Michael Kerrisk Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/ Linux/UNIX System Programming Training: http://man7.org/training/