Re: [RCF] [PATCH] unprivileged mount/umount

[Jamie Lokier <jamie@shareable.org>]

Eric Van Hensbergen wrote:
> I'm not sure passing directory file descriptors is the right semantic
> we want - but at least it provides a point of explicit control (in
> much the same way as a bind).  Are you sure the clone + open("/") +
> pass-to-parent scenario you allows the parent to traverse the child's
> private name space through that fd?

Pretty sure.

> That seems as bad as accessing pid name space via the /proc file
> system.

Or good, depending on your point of view :)

Don't think of "namespaces".  Think "set of mounts".
Then what Linux does makes more sense.

Don't forget that if you couldn't do this, you could still use ptrace
to traverse the child's namespace by tracing it.

> In Plan 9, file descriptors are passed between name spaces, but the
> only use of such a facility (described in fork(2) [plan9man]) is to
> pass channels to file servers which can then be mounted in a blank
> name space.  exportfs(4)[plan9man] seems to provide a much nicer
> semantic for this sort of name space sharing.

> c) Get the unshare system call adopted as it seems to be generally useful

I'm not convinced the functionality is all that useful.  It doesn't
address the need which arose in this thread, which is roughly
equivalent to per-user namespaces (the precise meaning determined by
userspace policy).  So what applicatins is it useful for?  Do we have
examples, or is it just a nice idea?

-- Jamie