From mboxrd@z Thu Jan 1 00:00:00 1970 From: Serge Hallyn Subject: Re: [CFT] Can I get some Tested-By's on this series? Date: Mon, 15 Dec 2014 19:38:38 +0000 Message-ID: <20141215193838.GB28375@ubuntumail> References: <87ppbtn4mv.fsf@x220.int.ebiederm.org> <87a92xn2io.fsf@x220.int.ebiederm.org> <87r3w8liw4.fsf@x220.int.ebiederm.org> <87iohklfvj.fsf_-_@x220.int.ebiederm.org> <87mw6vh31e.fsf_-_@x220.int.ebiederm.org> <20141210224822.GG20012@ubuntumail> <87lhmcy2et.fsf@x220.int.ebiederm.org> <20141212220840.GF22091@castiana.ipv6.teksavvy.com> <8761dgze56.fsf@x220.int.ebiederm.org> Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Return-path: Content-Disposition: inline In-Reply-To: <8761dgze56.fsf-JOvCrm2gF+uungPnsOpG7nhyD016LWXt@public.gmane.org> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org Errors-To: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org To: "Eric W. Biederman" Cc: linux-man , Kees Cook , Richard Weinberger , Linux Containers , Serge Hallyn , Josh Triplett , stable , Andy Lutomirski , Kenton Varda , LSM , Michael Kerrisk-manpages , Linux API , Casey Schaufler , Andrew Morton , "linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org" List-Id: linux-api@vger.kernel.org Quoting Eric W. Biederman (ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org): > St=E9phane Graber writes: > = > > On Fri, Dec 12, 2014 at 03:38:18PM -0600, Eric W. Biederman wrote: > >> Serge Hallyn writes: > >> = > >> > Quoting Eric W. Biederman (ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org): > >> >> = > >> >> Will people please test these patches with their container project? > >> >> = > >> >> These changes break container userspace (hopefully in a minimal way= ) if > >> >> I could have that confirmed by testing I would really appreciate it= . I > >> >> really don't want to send out a bug fix that accidentally breaks > >> >> userspace again. > >> >> = > >> >> The only issue sort of under discussion is if there is a better nam= e for > >> >> /proc//setgroups, and the name of the file will not affect the > >> >> functionality of the patchset. > >> >> = > >> >> With the code reviewed and written in simple obviously correct, eas= ily > >> >> reviewable ways I am hoping/planning to send this to Linus ASAP. > >> >> = > >> >> Eric > >> > > >> > Is there a git tree we can clone? > >> = > >> Have either of you been able to check to see if any of my changes > >> affects lxc? > >> = > >> I am trying to gauge how hard and how fast I should push to Linus. lxc > >> being the largest adopter of unprivileged user namespaces for general > >> purpose containers. > >> = > >> I expect you just call newuidmap and newgidmap and don't actually care > >> about not being able to set gid_map without privilege. But I really > >> want to avoid pushing a security fix and then being surprised that > >> things like lxc break. > >> = > >> Eric > > > > Hi Eric, > > > > I've unfortunately been pretty busy this week as I was (well, still am) > > travelling to South Africa for a meeting. I don't have a full kernel > > tree around here and a full git clone isn't really doable over the kind > > of Internet I've got here :) > > > > Hopefully Serge can give it a quick try, otherwise I should be able to > > do some tests on Tuesday when I'm back home. > = > I thought Serge was going to but I haven't heard yet so I am prodding ;-) Ok, thanks - yes, unprivileged lxc is working fine with your kernels. Just to be sure I was testing the right thing I also tested using my unprivileged nsexec testcases, and they failed on setgroup/setgid as now expected, and succeeded there without your patches. thanks, -serge