From mboxrd@z Thu Jan 1 00:00:00 1970 From: Andi Kleen Subject: Re: [PATCH][RFC] v2 exec: move core_pattern pipe helper into the crashing namespace Date: Mon, 20 Sep 2010 21:12:14 +0200 Message-ID: <20100920191214.GB7496@one.firstfloor.org> References: <20100918012939.GA25046@redhat.com> <1284779629-15273-1-git-send-email-wad@chromium.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: Will Drewry , Andi Kleen , linux-kernel@vger.kernel.org, Alexander Viro , Andrew Morton , Oleg Nesterov , KOSAKI Motohiro , Roland McGrath , Neil Horman , containers@lists.linux-foundation.org, Eugene Teo , Tejun Heo , Serge Hallyn , Alexey Dobriyan , linux-fsdevel@vger.kernel.org To: "Eric W. Biederman" Return-path: Content-Disposition: inline In-Reply-To: Sender: linux-kernel-owner@vger.kernel.org List-Id: linux-fsdevel.vger.kernel.org > The pipe process needs to run in the namespaces of the process who set > the core pattern, not in the namespaces of the dumping process. > Otherwise it is possible to trigger a privileged process to run in a > context where it's reality that it expected, causing it to misuse > it's privileges. Even if we don't have a privilege problem I think > we will have a case of mismatched functionality where the core pattern > will not work as expected. For me it seems rather the other way around: running the helper in some highly priviledged namespace is more dangerous. If it runs in the same context as the crasher it can do the least amount of damage relative to the crash process. And as Will pointed out it's the only sane way to deal with net namespaces. -Andi -- ak@linux.intel.com -- Speaking for myself only.