From mboxrd@z Thu Jan 1 00:00:00 1970 From: Pavel Emelyanov Subject: Re: [PATCH 3/4] autofs4 - track uid and gid of last mount requestor Date: Fri, 29 Feb 2008 19:20:09 +0300 Message-ID: <47C830B9.20505@openvz.org> References: <20080227204546.72e16e8d.akpm@linux-foundation.org> <1204179747.3501.21.camel@raven.themaw.net> <20080227223734.caab0165.akpm@linux-foundation.org> <1204182500.3501.49.camel@raven.themaw.net> <20080227232339.af6e904a.akpm@linux-foundation.org> <1204185623.3501.84.camel@raven.themaw.net> <20080228195118.GA16634@sergelap.austin.ibm.com> <1204255932.3969.86.camel@raven.themaw.net> <20080229160921.GA24296@sergelap.ibm.com> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Cc: Ian Kent , Jeff Moyer , Andrew Morton , Kernel Mailing List , autofs mailing list , linux-fsdevel , "Eric W. Biederman" To: "Serge E. Hallyn" Return-path: Received: from sacred.ru ([62.205.161.221]:57971 "EHLO sacred.ru" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751980AbYB2QVc (ORCPT ); Fri, 29 Feb 2008 11:21:32 -0500 In-Reply-To: <20080229160921.GA24296@sergelap.ibm.com> Sender: linux-fsdevel-owner@vger.kernel.org List-ID: > The way the user namespaces work right now is similar to say the IPC > namespace - a task belongs to one user, that user belongs to precisely > one user namespace. > > Even in my additional userns patches, I was changing uid to store the > (uid, userns) so a struct user still belonged to just one user > namespace. > > In contrast, with pid namespaces a task is associated with a 'struct > pid' which links it to multiple process ids, one in each pid namespace > to which it belongs. > > Perhaps we should be treating user namespaces like pid namespaces? I'm afraid, that I'm just starting a new thread of discussion in a wrong place, but I can't refrain from asking "what for?" > So if I'm user 500 in what I think is the initial user namespace, I can > create a container with a new user namespace, the init task of which is > both uid 0 in the child userns, and uid 500 in the higher level, > automatically giving the container access to any files I own. So do you mean that I can become a root, by calling clone()? Thanks, Pavel