Re: [PATCH 1/3] Make cr_may_checkpoint_task() check each namespace individually

["Serge E. Hallyn" <serue-r/Jw6+rmf7HQT0dZR+AlfA@public.gmane.org>]

Quoting Dan Smith (danms-r/Jw6+rmf7HQT0dZR+AlfA@public.gmane.org):
> Cc: orenl-eQaUEPhvms7ENvBUuze7eA@public.gmane.org
> Signed-off-by: Dan Smith <danms-r/Jw6+rmf7HQT0dZR+AlfA@public.gmane.org>

Acked-by: Serge Hallyn <serue-r/Jw6+rmf7HQT0dZR+AlfA@public.gmane.org>

> ---
>  checkpoint/checkpoint.c |   15 +++++++++++++--
>  1 files changed, 13 insertions(+), 2 deletions(-)
> 
> diff --git a/checkpoint/checkpoint.c b/checkpoint/checkpoint.c
> index ef35754..c2f0e16 100644
> --- a/checkpoint/checkpoint.c
> +++ b/checkpoint/checkpoint.c
> @@ -302,8 +302,19 @@ static int cr_may_checkpoint_task(struct task_struct *t, struct cr_ctx *ctx)
>  	if (t != current && !frozen(t))
>  		return -EBUSY;
> 
> -	/* FIXME: change this for nested containers */
> -	if (task_nsproxy(t) != ctx->root_nsproxy)
> +	if (task_nsproxy(t)->uts_ns != ctx->root_nsproxy->uts_ns)
> +		return -EPERM;
> +
> +	if (task_nsproxy(t)->ipc_ns != ctx->root_nsproxy->ipc_ns)
> +		return -EPERM;
> +
> +	if (task_nsproxy(t)->mnt_ns != ctx->root_nsproxy->mnt_ns)
> +		return -EPERM;
> +
> +	if (task_nsproxy(t)->pid_ns != ctx->root_nsproxy->pid_ns)
> +		return -EPERM;
> +
> +	if (task_nsproxy(t)->net_ns != ctx->root_nsproxy->net_ns)
>  		return -EPERM;
> 
>  	return 0;
> -- 
> 1.5.6.3
> 
> _______________________________________________
> Containers mailing list
> Containers-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org
> https://lists.linux-foundation.org/mailman/listinfo/containers