From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Daniel P. Berrange" Subject: Re: [systemd-devel] [PATCH] netns: unix: only allow to find out unix socket in same net namespace Date: Wed, 21 Aug 2013 10:56:24 +0100 Message-ID: <20130821095624.GJ10012@redhat.com> References: <1377059473-25526-1-git-send-email-gaofeng@cn.fujitsu.com> <87d2p7vcdx.fsf@xmission.com> <5214641C.9030902@cn.fujitsu.com> <87wqnfttdf.fsf@xmission.com> <52146AC2.5070409@cn.fujitsu.com> Reply-To: "Daniel P. Berrange" Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Cc: systemd-devel-PD4FTy7X32lNgt0PjOBp9y5qC8QIuHrW@public.gmane.org, "libvir-list-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org" , netdev-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, Linux Containers , lxc-devel-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org, davem-fT/PcQaiUtIeIZ0/mPfg9Q@public.gmane.org, "Eric W. Biederman" To: Kay Sievers Return-path: Content-Disposition: inline In-Reply-To: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org Errors-To: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org List-Id: netdev.vger.kernel.org On Wed, Aug 21, 2013 at 11:51:53AM +0200, Kay Sievers wrote: > On Wed, Aug 21, 2013 at 9:22 AM, Gao feng wrote: > > On 08/21/2013 03:06 PM, Eric W. Biederman wrote: > > >> I suspect libvirt should simply not share /run or any other normally > >> writable directory with the host. Sharing /run /var/run or even /tmp > >> seems extremely dubious if you want some kind of containment, and > >> without strange things spilling through. > > Right, /run or /var cannot be shared. It's not only about sockets, > many other things will also go really wrong that way. Libvirt already allows the app defining the container config to set private mounts for any directory including /run and /var. If an admin or app wants to run systemd inside a container, it is their responsibility to ensure they setup the filesystem in a suitable manner. Libvirt is not going to enforce use of a private /run or /var, since that's a policy decision for a specific use case. Daniel -- |: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :| |: http://libvirt.org -o- http://virt-manager.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|