All of lore.kernel.org
 help / color / mirror / Atom feed
From: ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org (Eric W. Biederman)
To: Andy Lutomirski <luto-kltTT9wpgjJwATOyAt5JVQ@public.gmane.org>
Cc: Jan Kara <jack-AlSwsSmVLrQ@public.gmane.org>,
	Jann Horn <jannh-hpIqsD4AKlfQT0dZR+AlfA@public.gmane.org>,
	Linux API <linux-api-u79uwXL29TY76Z2rM5mHXA@public.gmane.org>,
	Linux Containers
	<containers-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org>,
	James Bottomley
	<James.Bottomley-JuX6DAaQMKPCXq6kfMZ53/egYHeGw8Jk@public.gmane.org>,
	Seth Forshee
	<seth.forshee-Z7WLFzj8eWMS+FvcfC7Uqw@public.gmane.org>,
	Michael Kerrisk
	<mtk.manpages-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>,
	Linux FS Devel
	<linux-fsdevel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org>,
	Djalal Harouni <tixxdz-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
Subject: Re: [PATCH review 0/11] General unprivileged mount support
Date: Wed, 06 Jul 2016 10:21:02 -0500	[thread overview]
Message-ID: <87poqqlrmp.fsf@x220.int.ebiederm.org> (raw)
In-Reply-To: <CALCETrVof174gPCZnD2Z-RMjR-P=NcA0mYCU9ki6=o9hpFL-BA-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org> (Andy Lutomirski's message of "Wed, 6 Jul 2016 06:44:55 -0700")

Andy Lutomirski <luto-kltTT9wpgjJwATOyAt5JVQ@public.gmane.org> writes:

> On Sat, Jul 2, 2016 at 10:18 AM, Eric W. Biederman
> <ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org> wrote:
>>
>> As well as in these patches the code is also available from:
>> git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace.git for-testing
>>
>
> Minor nit: in "fs: Refuse uid/gid changes which don't map into
> s_user_ns", the changelog ends in the middle of a sentence.

This text?
> For filesystems mounted from a user namespace on-disk ids should
> be translated relative to s_users_ns rather than init_user_ns.

> When an id in the filesystem doesn't exist in s_user_ns the
> associated id in the inode will be set to INVALID_[UG]ID, which
> turns these into de facto "nobody" ids. This actually maps pretty
> well into the way most code already works, and those places where
> it didn't were fixed in previous patches. Moving forward vfs code
> needs to be careful to handle instances where ids in inodes may
> be invalid.


I don't see the changelog problem you are talking about.

Eric

WARNING: multiple messages have this Message-ID (diff)
From: ebiederm@xmission.com (Eric W. Biederman)
To: Andy Lutomirski <luto@amacapital.net>
Cc: Seth Forshee <seth.forshee@canonical.com>,
	Linux Containers <containers@lists.linux-foundation.org>,
	Linux FS Devel <linux-fsdevel@vger.kernel.org>,
	Linux API <linux-api@vger.kernel.org>,
	James Bottomley <James.Bottomley@hansenpartnership.com>,
	Djalal Harouni <tixxdz@gmail.com>,
	"Serge E. Hallyn" <serge@hallyn.com>, Jan Kara <jack@suse.cz>,
	Jann Horn <jannh@google.com>,
	Michael Kerrisk <mtk.manpages@gmail.com>
Subject: Re: [PATCH review 0/11] General unprivileged mount support
Date: Wed, 06 Jul 2016 10:21:02 -0500	[thread overview]
Message-ID: <87poqqlrmp.fsf@x220.int.ebiederm.org> (raw)
In-Reply-To: <CALCETrVof174gPCZnD2Z-RMjR-P=NcA0mYCU9ki6=o9hpFL-BA@mail.gmail.com> (Andy Lutomirski's message of "Wed, 6 Jul 2016 06:44:55 -0700")

Andy Lutomirski <luto@amacapital.net> writes:

> On Sat, Jul 2, 2016 at 10:18 AM, Eric W. Biederman
> <ebiederm@xmission.com> wrote:
>>
>> As well as in these patches the code is also available from:
>> git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace.git for-testing
>>
>
> Minor nit: in "fs: Refuse uid/gid changes which don't map into
> s_user_ns", the changelog ends in the middle of a sentence.

This text?
> For filesystems mounted from a user namespace on-disk ids should
> be translated relative to s_users_ns rather than init_user_ns.

> When an id in the filesystem doesn't exist in s_user_ns the
> associated id in the inode will be set to INVALID_[UG]ID, which
> turns these into de facto "nobody" ids. This actually maps pretty
> well into the way most code already works, and those places where
> it didn't were fixed in previous patches. Moving forward vfs code
> needs to be careful to handle instances where ids in inodes may
> be invalid.


I don't see the changelog problem you are talking about.

Eric

  parent reply	other threads:[~2016-07-06 15:21 UTC|newest]

Thread overview: 135+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2016-07-02 17:18 [PATCH review 0/11] General unprivileged mount support Eric W. Biederman
2016-07-02 17:18 ` Eric W. Biederman
2016-07-02 17:20 ` [PATCH review 01/11] fs: Refuse uid/gid changes which don't map into s_user_ns Eric W. Biederman
2016-07-02 17:20   ` [PATCH review 03/11] vfs: Verify acls are valid within superblock's s_user_ns Eric W. Biederman
2016-07-02 17:20   ` [PATCH review 05/11] cred: Reject inodes with invalid ids in set_create_file_as() Eric W. Biederman
2016-07-02 17:20   ` [PATCH review 07/11] vfs: Don't create inodes with a uid or gid unknown to the vfs Eric W. Biederman
     [not found]     ` <20160702172035.19568-7-ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org>
2016-07-04  7:59       ` Jan Kara
2016-07-04  7:59       ` Jan Kara
2016-07-04  7:59         ` Jan Kara
     [not found]         ` <20160704075919.GA5200-4I4JzKEfoa/jFM9bn6wA6Q@public.gmane.org>
2016-07-05 14:55           ` Eric W. Biederman
2016-07-05 14:55             ` Eric W. Biederman
     [not found]             ` <87zipwxhgp.fsf-JOvCrm2gF+uungPnsOpG7nhyD016LWXt@public.gmane.org>
2016-07-06  9:07               ` Jan Kara
2016-07-06  9:07                 ` Jan Kara
     [not found]                 ` <20160706090705.GE14067-4I4JzKEfoa/jFM9bn6wA6Q@public.gmane.org>
2016-07-06 15:37                   ` Eric W. Biederman
2016-07-06 15:37                     ` Eric W. Biederman
2016-07-06 15:37                   ` Eric W. Biederman
2016-07-02 17:20   ` [PATCH review 08/11] quota: Ensure qids map to the filesystem Eric W. Biederman
     [not found]   ` <20160702172035.19568-1-ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org>
2016-07-02 17:20     ` [PATCH review 02/11] userns: Handle -1 in k[ug]id_has_mapping when !CONFIG_USER_NS Eric W. Biederman
2016-07-02 17:20       ` Eric W. Biederman
2016-07-02 17:20     ` [PATCH review 03/11] vfs: Verify acls are valid within superblock's s_user_ns Eric W. Biederman
2016-07-02 17:20     ` [PATCH review 04/11] fs: Check for invalid i_uid in may_follow_link() Eric W. Biederman
2016-07-02 17:20       ` Eric W. Biederman
2016-07-02 17:20     ` Eric W. Biederman
2016-07-02 17:20     ` [PATCH review 05/11] cred: Reject inodes with invalid ids in set_create_file_as() Eric W. Biederman
2016-07-02 17:20     ` [PATCH review 06/11] vfs: Don't modify inodes with a uid or gid unknown to the vfs Eric W. Biederman
2016-07-02 17:20       ` Eric W. Biederman
2016-07-02 17:20     ` Eric W. Biederman
2016-07-02 17:20     ` [PATCH review 07/11] vfs: Don't create " Eric W. Biederman
2016-07-02 17:20     ` [PATCH review 08/11] quota: Ensure qids map to the filesystem Eric W. Biederman
2016-07-02 17:20     ` [PATCH review 09/11] quota: Handle quota data stored in s_user_ns Eric W. Biederman
2016-07-02 17:20     ` Eric W. Biederman
2016-07-02 17:20       ` Eric W. Biederman
     [not found]       ` <20160702172035.19568-9-ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org>
2016-07-02 17:33         ` [PATCH v2 " Eric W. Biederman
2016-07-02 17:33         ` Eric W. Biederman
2016-07-02 17:33           ` Eric W. Biederman
     [not found]           ` <87mvm03pxy.fsf_-_-JOvCrm2gF+uungPnsOpG7nhyD016LWXt@public.gmane.org>
2016-07-04  9:11             ` Jan Kara
2016-07-04  9:11             ` Jan Kara
2016-07-04  9:11               ` Jan Kara
2016-07-05 14:48               ` Seth Forshee
2016-07-05 15:34               ` Eric W. Biederman
     [not found]                 ` <87d1msumhy.fsf-JOvCrm2gF+uungPnsOpG7nhyD016LWXt@public.gmane.org>
2016-07-05 20:57                   ` Dave Chinner
2016-07-05 20:57                   ` Dave Chinner
2016-07-05 20:57                     ` Dave Chinner
2016-07-05 21:28                     ` Eric W. Biederman
2016-07-05 21:28                     ` Eric W. Biederman
2016-07-05 21:28                       ` Eric W. Biederman
     [not found]                       ` <8737nnrcyy.fsf-JOvCrm2gF+uungPnsOpG7nhyD016LWXt@public.gmane.org>
2016-07-06  6:35                         ` Dave Chinner
2016-07-06  6:35                           ` Dave Chinner
2016-07-06  8:25                           ` Jan Kara
2016-07-06  8:25                             ` Jan Kara
2016-07-06 17:51                             ` Eric W. Biederman
     [not found]                             ` <20160706082545.GC14067-4I4JzKEfoa/jFM9bn6wA6Q@public.gmane.org>
2016-07-06 17:51                               ` Eric W. Biederman
     [not found]               ` <20160704091100.GD5200-4I4JzKEfoa/jFM9bn6wA6Q@public.gmane.org>
2016-07-05 14:48                 ` Seth Forshee
2016-07-05 15:34                 ` Eric W. Biederman
2016-07-02 17:20     ` [PATCH review 10/11] evm: Translate user/group ids relative to s_user_ns when computing HMAC Eric W. Biederman
2016-07-02 17:20     ` [PATCH review 11/11] fs: Update i_[ug]id_(read|write) to translate relative to s_user_ns Eric W. Biederman
2016-07-02 17:20       ` Eric W. Biederman
2016-07-02 17:20   ` [PATCH review 10/11] evm: Translate user/group ids relative to s_user_ns when computing HMAC Eric W. Biederman
2016-07-04  8:52 ` [PATCH review 0/11] General unprivileged mount support Jan Kara
     [not found]   ` <20160704085220.GC5200-4I4JzKEfoa/jFM9bn6wA6Q@public.gmane.org>
2016-07-04 16:27     ` Eric W. Biederman
2016-07-04 16:27       ` Eric W. Biederman
     [not found]       ` <87h9c52wsd.fsf-JOvCrm2gF+uungPnsOpG7nhyD016LWXt@public.gmane.org>
2016-07-06  8:54         ` Jan Kara
2016-07-06  8:54           ` Jan Kara
     [not found]           ` <20160706085440.GD14067-4I4JzKEfoa/jFM9bn6wA6Q@public.gmane.org>
2016-07-06 13:54             ` Seth Forshee
2016-07-06 13:54           ` Seth Forshee
2016-07-06 14:22             ` Jan Kara
2016-07-06 14:22             ` Jan Kara
2016-07-06 14:22               ` Jan Kara
2016-07-06 14:46               ` Seth Forshee
     [not found]               ` <20160706142255.GB21164-4I4JzKEfoa/jFM9bn6wA6Q@public.gmane.org>
2016-07-06 14:46                 ` Seth Forshee
2016-07-06 15:01                 ` Eric W. Biederman
2016-07-06 15:23                 ` James Bottomley
2016-07-06 15:01               ` Eric W. Biederman
2016-07-06 15:23               ` James Bottomley
     [not found]                 ` <1467818630.2369.21.camel-d9PhHud1JfjCXq6kfMZ53/egYHeGw8Jk@public.gmane.org>
2016-07-06 16:35                   ` Eric W. Biederman
2016-07-06 16:35                     ` Eric W. Biederman
2016-07-04 16:27     ` Eric W. Biederman
     [not found] ` <87ziq03qnj.fsf-JOvCrm2gF+uungPnsOpG7nhyD016LWXt@public.gmane.org>
2016-07-02 17:20   ` [PATCH review 01/11] fs: Refuse uid/gid changes which don't map into s_user_ns Eric W. Biederman
2016-07-04  8:52   ` [PATCH review 0/11] General unprivileged mount support Jan Kara
2016-07-06 13:44   ` Andy Lutomirski
2016-07-06 13:44   ` Andy Lutomirski
2016-07-06 13:44     ` Andy Lutomirski
     [not found]     ` <CALCETrVof174gPCZnD2Z-RMjR-P=NcA0mYCU9ki6=o9hpFL-BA-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2016-07-06 15:21       ` Eric W. Biederman [this message]
2016-07-06 15:21         ` Eric W. Biederman
2016-07-06 14:01   ` Andy Lutomirski
2016-07-06 14:01   ` Andy Lutomirski
2016-07-06 14:01     ` Andy Lutomirski
2016-07-06 15:19     ` Eric W. Biederman
2016-07-06 15:19       ` Eric W. Biederman
2016-07-06 18:10   ` [PATCH review 0/12] General unprivileged mount support v2 Eric W. Biederman
2016-07-06 18:10     ` Eric W. Biederman
     [not found]     ` <874m82bptc.fsf-JOvCrm2gF+uungPnsOpG7nhyD016LWXt@public.gmane.org>
2016-07-06 18:12       ` [PATCH review 01/12] fs: Refuse uid/gid changes which don't map into s_user_ns Eric W. Biederman
2016-07-06 18:12         ` Eric W. Biederman
2016-07-06 18:12         ` [PATCH review 02/12] userns: Handle -1 in k[ug]id_has_mapping when !CONFIG_USER_NS Eric W. Biederman
2016-07-06 18:12         ` [PATCH review 03/12] vfs: Verify acls are valid within superblock's s_user_ns Eric W. Biederman
2016-07-06 18:12         ` [PATCH review 04/12] fs: Check for invalid i_uid in may_follow_link() Eric W. Biederman
2016-07-06 18:12         ` [PATCH review 05/12] cred: Reject inodes with invalid ids in set_create_file_as() Eric W. Biederman
2016-07-06 18:12         ` [PATCH review 08/12] quota: Ensure qids map to the filesystem Eric W. Biederman
     [not found]           ` <20160706181212.16267-8-ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org>
2016-07-11 10:14             ` Jan Kara
2016-07-11 10:14               ` Jan Kara
     [not found]               ` <20160711101424.GH12410-4I4JzKEfoa/jFM9bn6wA6Q@public.gmane.org>
2016-07-11 18:12                 ` Eric W. Biederman
2016-07-11 18:12                   ` Eric W. Biederman
     [not found]                   ` <878tx8dowu.fsf-JOvCrm2gF+uungPnsOpG7nhyD016LWXt@public.gmane.org>
2016-07-13  1:34                     ` Dave Chinner
2016-07-13  1:34                       ` Dave Chinner
2016-07-13  3:45                       ` Dave Chinner
2016-07-13  3:45                         ` Dave Chinner
2016-07-13  5:43                       ` Jann Horn
2016-07-13  5:43                         ` Jann Horn
     [not found]                         ` <20160713054358.GB28635-J1fxOzX/cBvk1uMJSBkQmQ@public.gmane.org>
2016-07-14 17:03                           ` Eric W. Biederman
2016-07-14 17:03                         ` Eric W. Biederman
2016-07-11 18:12                 ` Eric W. Biederman
2016-07-06 18:12         ` [PATCH review 09/12] quota: Handle quota data stored in s_user_ns in quota_setxquota Eric W. Biederman
     [not found]         ` <20160706181212.16267-1-ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org>
2016-07-06 18:12           ` [PATCH review 02/12] userns: Handle -1 in k[ug]id_has_mapping when !CONFIG_USER_NS Eric W. Biederman
2016-07-06 18:12           ` [PATCH review 03/12] vfs: Verify acls are valid within superblock's s_user_ns Eric W. Biederman
2016-07-06 18:12           ` [PATCH review 04/12] fs: Check for invalid i_uid in may_follow_link() Eric W. Biederman
2016-07-06 18:12           ` [PATCH review 05/12] cred: Reject inodes with invalid ids in set_create_file_as() Eric W. Biederman
2016-07-06 18:12           ` [PATCH review 06/12] vfs: Don't modify inodes with a uid or gid unknown to the vfs Eric W. Biederman
2016-07-06 18:12           ` Eric W. Biederman
2016-07-06 18:12             ` Eric W. Biederman
2016-07-06 18:12           ` [PATCH review 07/12] vfs: Don't create " Eric W. Biederman
2016-07-06 18:12             ` Eric W. Biederman
2016-07-06 18:12           ` Eric W. Biederman
2016-07-06 18:12           ` [PATCH review 08/12] quota: Ensure qids map to the filesystem Eric W. Biederman
2016-07-06 18:12           ` [PATCH review 09/12] quota: Handle quota data stored in s_user_ns in quota_setxquota Eric W. Biederman
2016-07-06 18:12           ` [PATCH review 10/12] dquot: For now explicitly don't support filesystems outside of init_user_ns Eric W. Biederman
2016-07-06 18:12             ` Eric W. Biederman
2016-07-11 10:09             ` Jan Kara
     [not found]             ` <20160706181212.16267-10-ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org>
2016-07-11 10:09               ` Jan Kara
2016-07-06 18:12           ` Eric W. Biederman
2016-07-06 18:12           ` [PATCH review 11/12] evm: Translate user/group ids relative to s_user_ns when computing HMAC Eric W. Biederman
2016-07-06 18:12             ` Eric W. Biederman
2016-07-06 18:12           ` Eric W. Biederman
2016-07-06 18:12           ` [PATCH review 12/12] fs: Update i_[ug]id_(read|write) to translate relative to s_user_ns Eric W. Biederman
2016-07-06 18:12         ` Eric W. Biederman
  -- strict thread matches above, loose matches on Subject: below --
2016-07-02 17:18 [PATCH review 0/11] General unprivileged mount support Eric W. Biederman

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=87poqqlrmp.fsf@x220.int.ebiederm.org \
    --to=ebiederm-as9lmozglivwk0htik3j/w@public.gmane.org \
    --cc=James.Bottomley-JuX6DAaQMKPCXq6kfMZ53/egYHeGw8Jk@public.gmane.org \
    --cc=containers-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org \
    --cc=jack-AlSwsSmVLrQ@public.gmane.org \
    --cc=jannh-hpIqsD4AKlfQT0dZR+AlfA@public.gmane.org \
    --cc=linux-api-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \
    --cc=linux-fsdevel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \
    --cc=luto-kltTT9wpgjJwATOyAt5JVQ@public.gmane.org \
    --cc=mtk.manpages-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org \
    --cc=seth.forshee-Z7WLFzj8eWMS+FvcfC7Uqw@public.gmane.org \
    --cc=tixxdz-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.