From: Tejun Heo <tj@kernel.org>
To: serge.hallyn@ubuntu.com
Cc: linux-kernel@vger.kernel.org, adityakali@google.com,
linux-api@vger.kernel.org, containers@lists.linux-foundation.org,
cgroups@vger.kernel.org, lxc-devel@lists.linuxcontainers.org,
akpm@linux-foundation.org, ebiederm@xmission.com,
gregkh@linuxfoundation.org, lizefan@huawei.com,
hannes@cmpxchg.org, Serge Hallyn <serge.hallyn@canonical.com>
Subject: Re: [PATCH 8/8] Add FS_USERNS_FLAG to cgroup fs
Date: Tue, 16 Feb 2016 13:05:51 -0500 [thread overview]
Message-ID: <20160216180551.GN3741@mtj.duckdns.org> (raw)
In-Reply-To: <1454057651-23959-9-git-send-email-serge.hallyn@ubuntu.com>
On Fri, Jan 29, 2016 at 02:54:11AM -0600, serge.hallyn@ubuntu.com wrote:
> From: Serge Hallyn <serge.hallyn@ubuntu.com>
>
> allowing root in a non-init user namespace to mount it. This should
> now be safe, because
>
> 1. non-init-root cannot mount a previously unbound subsystem
> 2. the task doing the mount must be privileged with respect to the
> user namespace owning the cgroup namespace
> 3. the mounted subsystem will have its current cgroup as the root dentry.
> the permissions will be unchanged, so tasks will receive no new
> privilege over the cgroups which they did not have on the original
> mounts.
>
> Signed-off-by: Serge Hallyn <serge.hallyn@canonical.com>
Applied 1-8 to cgroup/for-4.6-ns w/ trivial stylistic updates.
Thanks.
--
tejun
next prev parent reply other threads:[~2016-02-16 18:05 UTC|newest]
Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-01-29 8:54 CGroup Namespaces (v10) serge.hallyn
2016-01-29 8:54 ` [PATCH 1/8] kernfs: Add API to generate relative kernfs path serge.hallyn
2016-01-29 8:54 ` [PATCH 2/8] sched: new clone flag CLONE_NEWCGROUP for cgroup namespace serge.hallyn
2016-01-29 8:54 ` [PATCH 3/8] cgroup: introduce cgroup namespaces serge.hallyn
2016-01-29 8:54 ` [PATCH 4/8] cgroup: cgroup namespace setns support serge.hallyn
2016-01-29 8:54 ` [PATCH 5/8] kernfs: define kernfs_node_dentry serge.hallyn
2016-01-29 8:54 ` [PATCH 6/8] cgroup: mount cgroupns-root when inside non-init cgroupns serge.hallyn
2016-01-29 8:54 ` [PATCH 7/8] cgroup: Add documentation for cgroup namespaces serge.hallyn
2016-01-29 8:54 ` [PATCH 8/8] Add FS_USERNS_FLAG to cgroup fs serge.hallyn
2016-02-16 18:05 ` Tejun Heo [this message]
2016-01-31 17:48 ` [PATCH] selftests/cgroupns: new test for cgroup namespaces Alban Crequy
2016-02-10 17:48 ` Serge E. Hallyn
2016-02-11 23:18 ` [lxc-devel] CGroup Namespaces (v10) Alban Crequy
2016-02-12 16:09 ` Tejun Heo
2016-02-12 23:22 ` Serge E. Hallyn
2016-02-15 21:17 ` Tejun Heo
2016-02-15 21:20 ` Tejun Heo
2016-02-26 13:18 ` Alban Crequy
2016-02-26 22:47 ` Serge Hallyn
-- strict thread matches above, loose matches on Subject: below --
2016-01-04 19:54 CGroup Namespaces (v9) serge.hallyn
2016-01-04 19:54 ` [PATCH 8/8] Add FS_USERNS_FLAG to cgroup fs serge.hallyn
2015-12-23 4:23 CGroup Namespaces (v8) serge.hallyn
2015-12-23 4:23 ` [PATCH 8/8] Add FS_USERNS_FLAG to cgroup fs serge.hallyn
2015-12-09 19:28 CGroup Namespaces (v7) serge.hallyn
2015-12-09 19:29 ` [PATCH 8/8] Add FS_USERNS_FLAG to cgroup fs serge.hallyn
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20160216180551.GN3741@mtj.duckdns.org \
--to=tj@kernel.org \
--cc=adityakali@google.com \
--cc=akpm@linux-foundation.org \
--cc=cgroups@vger.kernel.org \
--cc=containers@lists.linux-foundation.org \
--cc=ebiederm@xmission.com \
--cc=gregkh@linuxfoundation.org \
--cc=hannes@cmpxchg.org \
--cc=linux-api@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=lizefan@huawei.com \
--cc=lxc-devel@lists.linuxcontainers.org \
--cc=serge.hallyn@canonical.com \
--cc=serge.hallyn@ubuntu.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).