From mboxrd@z Thu Jan 1 00:00:00 1970 From: Lukasz Pawelczyk Subject: Re: [RFC] lsm: namespace hooks Date: Thu, 27 Nov 2014 17:07:19 +0100 Message-ID: <1417104439.1805.25.camel@samsung.com> References: <1417096866-25563-1-git-send-email-l.pawelczyk@samsung.com> <1417096866-25563-2-git-send-email-l.pawelczyk@samsung.com> <1417098928.1805.15.camel@samsung.com> <54773757.8090905@nod.at> <1417099455.1805.17.camel@samsung.com> <54773CE7.5040303@nod.at> <1417101060.1805.21.camel@samsung.com> <87d288zm3a.fsf@x220.int.ebiederm.org> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-reply-to: <87d288zm3a.fsf-JOvCrm2gF+uungPnsOpG7nhyD016LWXt@public.gmane.org> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org Errors-To: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org To: "Eric W. Biederman" Cc: Vladimir Davydov , Miklos Szeredi , Lukasz Pawelczyk , LKML , David Howells , Mark Rustad , Matthew Dempsky , Richard Weinberger , Daeseok Youn , Ingo Molnar , Jeff Kirsher , David Rientjes , Alex Thorlton , Juri Lelli , Kees Cook , Nikolay Aleksandrov , Dario Faggioli , Al Viro , James Morris , "open list:ABI/API" , Linux Containers , Oleg Nesterov , Paul Moore List-Id: linux-api@vger.kernel.org On czw, 2014-11-27 at 09:42 -0600, Eric W. Biederman wrote: > Lukasz Pawelczyk writes: > > > On czw, 2014-11-27 at 16:01 +0100, Richard Weinberger wrote: > >> Am 27.11.2014 um 15:44 schrieb Lukasz Pawelczyk: > >> > True, the last one is 0x80000000. I did not notice that. Thanks for > >> > pointing out. > >> > >> Isn't this CLONE_IO? > > > > Yes, I was merely noticing out loud that it's the last bit of 32bit. > > > > After close look though the 0x00001000 appears to be unused > > > >> > Any suggestion on what can be done here? New syscal with flags2? > >> > >> I'm not sure. But a new syscall would be a candidate. > > We are probably going to need to go a couple rounds with this but at > first approximation I think this functionality needs to be tied to the > user namespace. This functionality already looks half tied to it. > > When mounting filesystems with user namespaces priveleges matures a > little more you should be able to use unmapped labels. In the near term > we are looking at filesystems such as tmpfs, fuse and posibly extN. I presume you are referring to the Smack namespace readme where I mentioned mounts with specifying smack labels in the mount options, not to the quote above? I was referring the to the check here that has been changed to smack_ns_privileged() using ns_capable(): http://lxr.free-electrons.com/source/security/smack/smack_lsm.c#L462 And you can't use an unmapped Smack label inside the namespace, this would be completely against its idea. Anyway, at this point I'm more interested in the LSM namespace. I'll be doing an RFC for Smack namespace later. Unless I misunderstood your mail. -- Lukasz Pawelczyk Samsung R&D Institute Poland Samsung Electronics