Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1185735

Re: [PATCH 0/7] Initial support for user namespace owned mounts

Show all headers | View raw

On śro, 2015-07-15 at 16:06 -0500, Eric W. Biederman wrote:
> 
> I am on the fence with Lukasz Pawelczyk's patches.  Some parts I 
> liked
> some parts I had issues with.  As I recall one of my issues was that
> those patches conflicted in detail if not in principle with this
> appropach.
> 
> If these patches do not do a good job of laying the ground work for
> supporting security labels that unprivileged users can set than Seth
> could really use some feedback.  Figuring out how to properly deal 
> with
> the LSMs has been one of his challenges.

I fail to see how those 2 are in any conflict. Smack namespace is just
a mean of limiting the view of Smack labels within user namespace, to
be able to give some limited capabilities to processes in the namespace
to make it possible to partially administer Smack there. It doesn't
change Smack behaviour or mode of operation in any way.

If your approach here is to treat user ns mounted filesystem as if they
didn't support xattrs at all then my patches don't conflict here any
more than Smack itself already does.

If the filesystem will get a default (e.g. by smack* mount options)
label then this label will co-work with Smack namespaces.


-- 
Lukasz Pawelczyk
Samsung R&D Institute Poland
Samsung Electronics



--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Re: [PATCH 0/7] Initial support for user namespace owned mounts Casey Schaufler <casey@schaufler-ca.com> - 2015-07-15 22:40 +0200
  Re: [PATCH 0/7] Initial support for user namespace owned mounts ebiederm@xmission.com (Eric W. Biederman) - 2015-07-15 23:20 +0200
    Re: [PATCH 0/7] Initial support for user namespace owned mounts Seth Forshee <seth.forshee@canonical.com> - 2015-07-15 23:50 +0200
      Re: [PATCH 0/7] Initial support for user namespace owned mounts Andy Lutomirski <luto@amacapital.net> - 2015-07-16 03:10 +0200
        Re: [PATCH 0/7] Initial support for user namespace owned mounts ebiederm@xmission.com (Eric W. Biederman) - 2015-07-16 04:30 +0200
    Re: [PATCH 0/7] Initial support for user namespace owned mounts Andy Lutomirski <luto@amacapital.net> - 2015-07-16 03:10 +0200
      Re: [PATCH 0/7] Initial support for user namespace owned mounts Casey Schaufler <casey@schaufler-ca.com> - 2015-07-16 05:00 +0200
        Re: [PATCH 0/7] Initial support for user namespace owned mounts Dave Chinner <david@fromorbit.com> - 2015-07-17 02:20 +0200
          Re: [PATCH 0/7] Initial support for user namespace owned mounts ebiederm@xmission.com (Eric W. Biederman) - 2015-07-17 02:50 +0200
            Re: [PATCH 0/7] Initial support for user namespace owned mounts Dave Chinner <david@fromorbit.com> - 2015-07-22 10:00 +0200
              Re: [PATCH 0/7] Initial support for user namespace owned mounts "J. Bruce Fields" <bfields@fieldses.org> - 2015-07-22 16:10 +0200
        Re: [PATCH 0/7] Initial support for user namespace owned mounts Colin Walters <walters@verbum.org> - 2015-07-20 20:00 +0200
    Re: [PATCH 0/7] Initial support for user namespace owned mounts Lukasz Pawelczyk <l.pawelczyk@samsung.com> - 2015-07-16 13:20 +0200
      Re: [PATCH 0/7] Initial support for user namespace owned mounts ebiederm@xmission.com (Eric W. Biederman) - 2015-07-17 02:20 +0200
        Re: [PATCH 0/7] Initial support for user namespace owned mounts Lukasz Pawelczyk <l.pawelczyk@samsung.com> - 2015-07-17 12:20 +0200

csiph-web