From mboxrd@z Thu Jan 1 00:00:00 1970 From: ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org (Eric W. Biederman) Subject: Re: [PATCH 0/9] Multiple devpts instances Date: Thu, 19 Feb 2009 15:59:11 -0800 Message-ID: References: <20081015053000.GA2039@us.ibm.com> <499D7E13.10601@free.fr> <499D97B1.1090902@zytor.com> <499DA069.3040603@free.fr> <499DB9DA.2070301@zytor.com> <499DE06E.4030108@free.fr> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <499DE06E.4030108-GANU6spQydw@public.gmane.org> (Daniel Lezcano's message of "Thu\, 19 Feb 2009 23\:42\:54 +0100") List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org Errors-To: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org To: Daniel Lezcano Cc: kyle-hoO6YkzgTuCM0SS3m2neIg@public.gmane.org, "David C. Hansen" , bastian-yyjItF7Rl6lg9hUCZPvPmw@public.gmane.org, "H. Peter Anvin" , containers-qjLDD68F18O7TbgM5vRIOg@public.gmane.org, sukadev-23VcF4HTsmIX0ybBhKVfKdBPR1lH4CV8@public.gmane.org, alan-qBU/x9rampVanCEyBjwyrvXRex20P6io@public.gmane.org, xemul-GEFAQzZX7r8dnm+yROfE0A@public.gmane.org List-Id: containers.vger.kernel.org Daniel Lezcano writes: > But if I am able to create a new instance of devpts for a container and modify > the configuration of another devpts from this container, is it acceptable ? Can > we convince people to use the containers for security and have anybody able to > make a pty starvation from one container to another ? I hardly how that is significant. Anyone can allocate the rest of the possible pty's today. The situation does not get worse with devpts. If you want security and permission arguments get with Serge and finish the uid namespace. The you will have a user that looks like root but does not have permissions to do most things. > If it is too much complicated to handle one value per new devpts instance, IMHO > /proc/sys/kernel/pty/max should be, at least, read-only for the new instance, no? No. Either we add a pty_max value to the filesystem like we did with ptmx or we forget it. Eric