From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754246AbcEDQi5 (ORCPT ); Wed, 4 May 2016 12:38:57 -0400 Received: from relay2-d.mail.gandi.net ([217.70.183.194]:37721 "EHLO relay2-d.mail.gandi.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753520AbcEDQi4 (ORCPT ); Wed, 4 May 2016 12:38:56 -0400 X-Originating-IP: 50.39.163.18 Date: Wed, 4 May 2016 09:38:45 -0700 From: Josh Triplett To: Djalal Harouni Cc: Djalal Harouni , Alexander Viro , Chris Mason , tytso@mit.edu, Serge Hallyn , "Eric W. Biederman" , Andy Lutomirski , Seth Forshee , Dongsu Park , David Herrmann , Miklos Szeredi , AlbanCrequy , linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org Subject: Re: [RFC PATCH 0/0] VFS:userns: support portable root filesystems Message-ID: <20160504163845.GB13196@x> References: <1462317714-27360-1-git-send-email-tixxdz@opendz.org> <20160504004107.GA31692@x> <20160504100842.GA13318@dztty.fritz.box> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20160504100842.GA13318@dztty.fritz.box> User-Agent: Mutt/1.6.0 (2016-04-01) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Wed, May 04, 2016 at 11:08:42AM +0100, Djalal Harouni wrote: > On Tue, May 03, 2016 at 05:41:07PM -0700, Josh Triplett wrote: > > The main design constraint with a full mapping would be passing that > > through "mount". There have been discussions on and off for years about > > replacing the mount() system call with something either two-phase (get > > filesystem driver FD, send it a series of parameters ending with mount; > > the VFS would interpret many of those parameters) or three-phase (get > > filesystem driver FD, send it parameters ending with getting a directory > > FD, bind the directory FD). Given an interface like that, providing a > > UID/GID map at mount time seems plausible. > Could you please provide some links for these discussions ? > > I'll get back to it. I don't know of a good example of those discussions occurring in public; they've occurred at Kernel Summit for years. Al Viro would know if they've been discusssed publically. Al? > > Alternatively, a much simpler approach that could potentially be > > expanded in the future would be to add *two* parameters each for UID and > > GID: a base and a max. That would define a range, which doesn't > > necessarily need to be exactly 2**16; thus, if you had a big enough > > range, that approach would nest as well. > Hm, I can see but I'm not sure if it will make sense, since this > will hardcode the mapping during mount ? where maybe that mount can be > used later for another mapping configuration ? I think we should just > get a user namespace reference and that's it. Now we just allow the > current user namespace interface to do the job for us, and as said above > the 2**16 is just an example. Please ignore this last paragraph; it was based on my misunderstanding the approach you took. - Josh Triplett