User namespace feature freeze lifted

User namespace feature freeze lifted

[Eric W. Biederman]

As of v4.3-rc1 all of the security issues I am aware of with the user
namespace have been addressed.  If someone knows of something I have
overlooked please let me know.

As much as humanly possible I want to avoid security bugs in the future
so I will endeavour to ensure any future user namespace patches receive
a close review.

As for merging features I expect I will likley start with Seth's code
for associating superblock with user namespaces, and then move on to
Lukasz's code for figuring out how to add namespace for smack.

Eric

Re: User namespace feature freeze lifted

[Serge Hallyn]

Quoting Eric W. Biederman (ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org):
> 
> As of v4.3-rc1 all of the security issues I am aware of with the user
> namespace have been addressed.  If someone knows of something I have
> overlooked please let me know.
> 
> As much as humanly possible I want to avoid security bugs in the future
> so I will endeavour to ensure any future user namespace patches receive
> a close review.
> 
> As for merging features I expect I will likley start with Seth's code
> for associating superblock with user namespaces, and then move on to
> Lukasz's code for figuring out how to add namespace for smack.

Should there be a User Namespace maintainer?

Re: User namespace feature freeze lifted

[Eric W. Biederman]

Serge Hallyn <serge.hallyn-GeWIH/nMZzLQT0dZR+AlfA@public.gmane.org> writes:

> Quoting Eric W. Biederman (ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org):
>> 
>> As of v4.3-rc1 all of the security issues I am aware of with the user
>> namespace have been addressed.  If someone knows of something I have
>> overlooked please let me know.
>> 
>> As much as humanly possible I want to avoid security bugs in the future
>> so I will endeavour to ensure any future user namespace patches receive
>> a close review.
>> 
>> As for merging features I expect I will likley start with Seth's code
>> for associating superblock with user namespaces, and then move on to
>> Lukasz's code for figuring out how to add namespace for smack.
>
> Should there be a User Namespace maintainer?

Do you mean documented in maintainers?  Last I cheked I am wearing
the user namespace maintainer hat.

Eric

Re: User namespace feature freeze lifted

[Serge E. Hallyn]

On Tue, Sep 15, 2015 at 01:05:38PM -0500, Eric W. Biederman wrote:
> Serge Hallyn <serge.hallyn-GeWIH/nMZzLQT0dZR+AlfA@public.gmane.org> writes:
> 
> > Quoting Eric W. Biederman (ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org):
> >> 
> >> As of v4.3-rc1 all of the security issues I am aware of with the user
> >> namespace have been addressed.  If someone knows of something I have
> >> overlooked please let me know.
> >> 
> >> As much as humanly possible I want to avoid security bugs in the future
> >> so I will endeavour to ensure any future user namespace patches receive
> >> a close review.
> >> 
> >> As for merging features I expect I will likley start with Seth's code
> >> for associating superblock with user namespaces, and then move on to
> >> Lukasz's code for figuring out how to add namespace for smack.
> >
> > Should there be a User Namespace maintainer?
> 
> Do you mean documented in maintainers?

Yup, to make sure people know to contact you about patches that affect
it.

Maybe it's not needed as you're pretty on top of any changes that affect
userns.  And while we could document kernel/user{,_namespace}.c as affecting
it, I don't know how we would describe changes outside of those files that
would relate to it.

So nm :)

>   Last I cheked I am wearing
> the user namespace maintainer hat.
> 
> Eric
> 
> _______________________________________________
> Containers mailing list
> Containers-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org
> https://lists.linuxfoundation.org/mailman/listinfo/containers

Re: User namespace feature freeze lifted

[Seth Forshee]

On Tue, Sep 15, 2015 at 12:27:46PM -0500, Eric W. Biederman wrote:
> 
> As of v4.3-rc1 all of the security issues I am aware of with the user
> namespace have been addressed.  If someone knows of something I have
> overlooked please let me know.
> 
> As much as humanly possible I want to avoid security bugs in the future
> so I will endeavour to ensure any future user namespace patches receive
> a close review.
> 
> As for merging features I expect I will likley start with Seth's code
> for associating superblock with user namespaces, and then move on to
> Lukasz's code for figuring out how to add namespace for smack.

As for my patches, I'm in the process of testing after rebasing onto
4.3-rc1. I should be sending an update in the next day or so, though
nothing will change except for resolving merge conflicts and fixing
that one inadvertent change I introduced in v2.

Seth