From mboxrd@z Thu Jan 1 00:00:00 1970 From: ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org (Eric W. Biederman) Subject: Re: [PATCH] userns,pidns: Verify the userns for new pid namespaces Date: Sat, 29 Apr 2017 23:33:24 -0500 Message-ID: <87a86yseej.fsf@xmission.com> References: <149329634856.21195.14196911999722279118.stgit@localhost.localdomain> <87mvb16fv7.fsf@xmission.com> <12a73543-79ea-4bac-7e96-6ab237534af2@virtuozzo.com> <877f254yx0.fsf@xmission.com> <8737crt4dz.fsf@xmission.com> <87vapnrp7f.fsf_-_@xmission.com> <20170429205325.GB1119@mail.hallyn.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <20170429205325.GB1119-7LNsyQBKDXoIagZqoN9o3w@public.gmane.org> (Serge E. Hallyn's message of "Sat, 29 Apr 2017 15:53:25 -0500") List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org Errors-To: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org To: "Serge E. Hallyn" Cc: paul-r2n+y4ga6xFZroRs9YW3xA@public.gmane.org, keescook-F7+t8E8rja9g9hUCZPvPmw@public.gmane.org, gregkh-hQyY1W1yCW8ekmWlsbkhG0B+6BGkLq7r@public.gmane.org, Linux Containers , oleg-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org, linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, gorcunov-GEFAQzZX7r8dnm+yROfE0A@public.gmane.org, Kirill Tkhai , viro-RmSDqhL/yNMiFSDQTTA3OLVCufUGDwFn@public.gmane.org, avagin-GEFAQzZX7r8dnm+yROfE0A@public.gmane.org, linux-api-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, linux-fsdevel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, mtk.manpages-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org, akpm-de/tnXTf+JLsfHDXvbKv3WD2FQJk+8+b@public.gmane.org, luto-kltTT9wpgjJwATOyAt5JVQ@public.gmane.org, mingo-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org, agruenba-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org List-Id: containers.vger.kernel.org "Serge E. Hallyn" writes: > Quoting Eric W. Biederman (ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org): >> >> It is pointless and confusing to allow a pid namespace hierarchy and >> the user namespace hierarchy to get out of sync. The owner of a child >> pid namespace should be the owner of the parent pid namespace or >> a descendant of the owner of the parent pid namespace. >> >> Otherwise it is possible to construct scenarios where it is legal to >> do something in a parent pid namespace but in a child pid namespace. > > Hi, > > did you mean 'but not in a child...' above? Actually I believe I meant: >> Otherwise it is possible to construct scenarios where it is not legal >> to do something in a parent pid namespace but it is legal a child pid >> namespace. I definitely need to fix that wording thank you. Eric From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from out02.mta.xmission.com ([166.70.13.232]:51076 "EHLO out02.mta.xmission.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S940035AbdD3Ejv (ORCPT ); Sun, 30 Apr 2017 00:39:51 -0400 From: ebiederm@xmission.com (Eric W. Biederman) To: "Serge E. Hallyn" Cc: Linux Containers , agruenba@redhat.com, gregkh@linuxfoundation.org, linux-kernel@vger.kernel.org, oleg@redhat.com, paul@paul-moore.com, viro@zeniv.linux.org.uk, avagin@openvz.org, linux-api@vger.kernel.org, linux-fsdevel@vger.kernel.org, mtk.manpages@gmail.com, akpm@linux-foundation.org, luto@amacapital.net, gorcunov@openvz.org, mingo@kernel.org, keescook@chromium.org, Kirill Tkhai References: <149329634856.21195.14196911999722279118.stgit@localhost.localdomain> <87mvb16fv7.fsf@xmission.com> <12a73543-79ea-4bac-7e96-6ab237534af2@virtuozzo.com> <877f254yx0.fsf@xmission.com> <8737crt4dz.fsf@xmission.com> <87vapnrp7f.fsf_-_@xmission.com> <20170429205325.GB1119@mail.hallyn.com> Date: Sat, 29 Apr 2017 23:33:24 -0500 In-Reply-To: <20170429205325.GB1119@mail.hallyn.com> (Serge E. Hallyn's message of "Sat, 29 Apr 2017 15:53:25 -0500") Message-ID: <87a86yseej.fsf@xmission.com> MIME-Version: 1.0 Content-Type: text/plain Subject: Re: [PATCH] userns,pidns: Verify the userns for new pid namespaces Sender: linux-fsdevel-owner@vger.kernel.org List-ID: "Serge E. Hallyn" writes: > Quoting Eric W. Biederman (ebiederm@xmission.com): >> >> It is pointless and confusing to allow a pid namespace hierarchy and >> the user namespace hierarchy to get out of sync. The owner of a child >> pid namespace should be the owner of the parent pid namespace or >> a descendant of the owner of the parent pid namespace. >> >> Otherwise it is possible to construct scenarios where it is legal to >> do something in a parent pid namespace but in a child pid namespace. > > Hi, > > did you mean 'but not in a child...' above? Actually I believe I meant: >> Otherwise it is possible to construct scenarios where it is not legal >> to do something in a parent pid namespace but it is legal a child pid >> namespace. I definitely need to fix that wording thank you. Eric