From: Richard Weinberger <richard@nod.at>
To: Yves-Alexis Perez <corsac@debian.org>,
"Serge E. Hallyn" <serge@hallyn.com>,
Tobias Markus <tobias@miglix.eu>
Cc: linux-kernel@vger.kernel.org,
"Eric W. Biederman" <ebiederm@xmission.com>,
Al Viro <viro@ZenIV.linux.org.uk>,
Serge Hallyn <serge.hallyn@canonical.com>,
Andrew Morton <akpm@linuxfoundation.org>,
Andy Lutomirski <luto@amacapital.net>,
Christoph Lameter <cl@linux.com>,
"Michael Kerrisk (man-pages)" <mtk.manpages@gmail.com>,
linux-security-module@vger.kernel.org, linux-api@vger.kernel.org,
linux-man@vger.kernel.org,
Richard Weinberger <richard.weinberger@gmail.com>
Subject: Re: [PATCH] userns/capability: Add user namespace capability
Date: Mon, 19 Oct 2015 14:48:04 +0200 [thread overview]
Message-ID: <5624E684.8000302@nod.at> (raw)
In-Reply-To: <1445258180.4099.18.camel@debian.org>
Am 19.10.2015 um 14:36 schrieb Yves-Alexis Perez:
> On dim., 2015-10-18 at 20:41 -0500, Serge E. Hallyn wrote:
>> We shouldn't need a long-term solution. Your concern is bugs. After
>> some time surely we'll feel that we have achieved a stable solution?
>
> But this is actually the whole point: we need a long term solution, because
> they will always be bug, whether in user namespaces or in others parts exposed
> by user namespaces. It's fine to fix them when we find them, but that still
> means they're exploitable even before we know about them. We still find bugs
> in code written years ago, it's quite certain there are bugs in current code.
You can replace the term "user namespace" with any other non-trivial kernel subsystem.
There will always be bugs.
Thanks,
//richard
next prev parent reply other threads:[~2015-10-19 12:48 UTC|newest]
Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-10-17 15:58 [PATCH] userns/capability: Add user namespace capability Tobias Markus
2015-10-17 20:17 ` Richard Weinberger
2015-10-18 20:13 ` Tobias Markus
2015-10-18 20:21 ` Richard Weinberger
2015-10-18 20:41 ` Tobias Markus
2015-10-18 20:48 ` Richard Weinberger
2015-10-18 21:49 ` Tobias Markus
2015-10-18 22:06 ` Richard Weinberger
2015-10-19 0:28 ` Mike Frysinger
2015-10-17 21:55 ` Serge E. Hallyn
2015-10-18 20:13 ` Tobias Markus
2015-10-19 1:41 ` Serge E. Hallyn
2015-10-19 12:36 ` Yves-Alexis Perez
2015-10-19 12:48 ` Richard Weinberger [this message]
2015-10-22 20:45 ` Eric W. Biederman
2015-10-22 21:02 ` Andy Lutomirski
2015-10-22 21:44 ` Eric W. Biederman
2015-10-19 14:24 ` Austin S Hemmelgarn
2015-10-21 18:53 ` Andy Lutomirski
2015-10-21 19:13 ` Austin S Hemmelgarn
2015-10-22 17:10 ` Andy Lutomirski
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=5624E684.8000302@nod.at \
--to=richard@nod.at \
--cc=akpm@linuxfoundation.org \
--cc=cl@linux.com \
--cc=corsac@debian.org \
--cc=ebiederm@xmission.com \
--cc=linux-api@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-man@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=luto@amacapital.net \
--cc=mtk.manpages@gmail.com \
--cc=richard.weinberger@gmail.com \
--cc=serge.hallyn@canonical.com \
--cc=serge@hallyn.com \
--cc=tobias@miglix.eu \
--cc=viro@ZenIV.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).