Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1270836

Re: CGroup Namespaces (v4)

Show all headers | View raw

On Mon, Nov 16, 2015 at 07:40:26PM -0600, Serge E. Hallyn wrote:
> On Mon, Nov 16, 2015 at 07:13:49PM -0600, Serge E. Hallyn wrote:
> > On Mon, Nov 16, 2015 at 04:24:27PM -0600, Eric W. Biederman wrote:
...
> > > Similary have you considered what it required to be able to safely set
> > > FS_USERNS_MOUNT?
> > 
> > I think the only thing we need to do is
> > 
> > 1. go through and make sure that any ability to change mount flags is under
> > capable() (which I have not yet done).  The cgroup_mount() itself checks that
> > flags are not changed, but there may be some subtle way to effect a change
> > that I'm not aware of yet.
> > 
> 
> At least the ability to change the clone_children and release agent through
> remount need to be restricted to init_user_ns root.

No, they can only be changed on a new mount, so these are fine.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

CGroup Namespaces (v4) serge@hallyn.com - 2015-11-16 21:00 +0100
  [PATCH 4/8] cgroup: export cgroup_get() and cgroup_put() serge@hallyn.com - 2015-11-16 21:00 +0100
    Re: [PATCH 4/8] cgroup: export cgroup_get() and cgroup_put() Tejun Heo <tj@kernel.org> - 2015-11-24 17:40 +0100
      Re: [PATCH 4/8] cgroup: export cgroup_get() and cgroup_put() "Serge E. Hallyn" <serge.hallyn@ubuntu.com> - 2015-11-24 23:40 +0100
  [PATCH 6/8] cgroup: cgroup namespace setns support serge@hallyn.com - 2015-11-16 21:00 +0100
    Re: [PATCH 6/8] cgroup: cgroup namespace setns support Tejun Heo <tj@kernel.org> - 2015-11-24 18:00 +0100
  [PATCH 1/8] kernfs: Add API to generate relative kernfs path serge@hallyn.com - 2015-11-16 21:00 +0100
    Re: [PATCH 1/8] kernfs: Add API to generate relative kernfs path Tejun Heo <tj@kernel.org> - 2015-11-24 17:20 +0100
      Re: [PATCH 1/8] kernfs: Add API to generate relative kernfs path "Serge E. Hallyn" <serge.hallyn@ubuntu.com> - 2015-11-24 18:50 +0100
    Re: [PATCH 1/8] kernfs: Add API to generate relative kernfs path Tejun Heo <tj@kernel.org> - 2015-11-24 17:20 +0100
      Re: [PATCH 1/8] kernfs: Add API to generate relative kernfs path "Serge E. Hallyn" <serge.hallyn@ubuntu.com> - 2015-11-27 06:30 +0100
        Re: [PATCH 1/8] kernfs: Add API to generate relative kernfs path Tejun Heo <tj@kernel.org> - 2015-11-30 16:20 +0100
  Re: CGroup Namespaces (v4) "Serge E. Hallyn" <serge@hallyn.com> - 2015-11-16 21:50 +0100
    Re: CGroup Namespaces (v4) Richard Weinberger <richard@nod.at> - 2015-11-16 22:00 +0100
      Re: CGroup Namespaces (v4) "Serge E. Hallyn" <serge@hallyn.com> - 2015-11-16 22:00 +0100
        Re: CGroup Namespaces (v4) ebiederm@xmission.com (Eric W. Biederman) - 2015-11-16 23:40 +0100
          Re: CGroup Namespaces (v4) Tejun Heo <tj@kernel.org> - 2015-11-16 23:40 +0100
          Re: CGroup Namespaces (v4) "Serge E. Hallyn" <serge@hallyn.com> - 2015-11-17 02:20 +0100
            Re: CGroup Namespaces (v4) "Serge E. Hallyn" <serge@hallyn.com> - 2015-11-17 02:50 +0100
              Re: CGroup Namespaces (v4) "Serge E. Hallyn" <serge@hallyn.com> - 2015-11-17 05:00 +0100
          Re: CGroup Namespaces (v4) "Serge E. Hallyn" <serge@hallyn.com> - 2015-11-18 03:40 +0100
            Re: CGroup Namespaces (v4) ebiederm@xmission.com (Eric W. Biederman) - 2015-11-18 10:30 +0100
              Re: CGroup Namespaces (v4) "Serge E. Hallyn" <serge.hallyn@ubuntu.com> - 2015-11-18 16:50 +0100
  Re: CGroup Namespaces (v4) Richard Weinberger <richard.weinberger@gmail.com> - 2015-11-16 21:50 +0100

csiph-web