Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1272035

Re: CGroup Namespaces (v4)

Show all headers | View raw

"Serge E. Hallyn" <serge@hallyn.com> writes:

> On Mon, Nov 16, 2015 at 04:24:27PM -0600, Eric W. Biederman wrote:
>> Similary have you considered what it required to be able to safely set
>> FS_USERNS_MOUNT?
>
> I pushed the one patch which I feel is needed to my branch (it's also
> included in another reply).  Aditya had already added FS_USERNS_MOUNT to
> the cgroup fs flags, so I think we're now all set.  I can start
> unprivileged containers which mount cgroupfs (which make systemd happy).

In principle that sounds very good, and I am glad to see that.

Let's hold off on merging the unprivileged part until everything else is
reviewed and merged and we have performed an extra hard look at the
security implications as it can be easy to overlook something when
relaxing the permissions.

Eric

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

CGroup Namespaces (v4) serge@hallyn.com - 2015-11-16 21:00 +0100
  [PATCH 4/8] cgroup: export cgroup_get() and cgroup_put() serge@hallyn.com - 2015-11-16 21:00 +0100
    Re: [PATCH 4/8] cgroup: export cgroup_get() and cgroup_put() Tejun Heo <tj@kernel.org> - 2015-11-24 17:40 +0100
      Re: [PATCH 4/8] cgroup: export cgroup_get() and cgroup_put() "Serge E. Hallyn" <serge.hallyn@ubuntu.com> - 2015-11-24 23:40 +0100
  [PATCH 6/8] cgroup: cgroup namespace setns support serge@hallyn.com - 2015-11-16 21:00 +0100
    Re: [PATCH 6/8] cgroup: cgroup namespace setns support Tejun Heo <tj@kernel.org> - 2015-11-24 18:00 +0100
  [PATCH 1/8] kernfs: Add API to generate relative kernfs path serge@hallyn.com - 2015-11-16 21:00 +0100
    Re: [PATCH 1/8] kernfs: Add API to generate relative kernfs path Tejun Heo <tj@kernel.org> - 2015-11-24 17:20 +0100
      Re: [PATCH 1/8] kernfs: Add API to generate relative kernfs path "Serge E. Hallyn" <serge.hallyn@ubuntu.com> - 2015-11-24 18:50 +0100
    Re: [PATCH 1/8] kernfs: Add API to generate relative kernfs path Tejun Heo <tj@kernel.org> - 2015-11-24 17:20 +0100
      Re: [PATCH 1/8] kernfs: Add API to generate relative kernfs path "Serge E. Hallyn" <serge.hallyn@ubuntu.com> - 2015-11-27 06:30 +0100
        Re: [PATCH 1/8] kernfs: Add API to generate relative kernfs path Tejun Heo <tj@kernel.org> - 2015-11-30 16:20 +0100
  Re: CGroup Namespaces (v4) "Serge E. Hallyn" <serge@hallyn.com> - 2015-11-16 21:50 +0100
    Re: CGroup Namespaces (v4) Richard Weinberger <richard@nod.at> - 2015-11-16 22:00 +0100
      Re: CGroup Namespaces (v4) "Serge E. Hallyn" <serge@hallyn.com> - 2015-11-16 22:00 +0100
        Re: CGroup Namespaces (v4) ebiederm@xmission.com (Eric W. Biederman) - 2015-11-16 23:40 +0100
          Re: CGroup Namespaces (v4) Tejun Heo <tj@kernel.org> - 2015-11-16 23:40 +0100
          Re: CGroup Namespaces (v4) "Serge E. Hallyn" <serge@hallyn.com> - 2015-11-17 02:20 +0100
            Re: CGroup Namespaces (v4) "Serge E. Hallyn" <serge@hallyn.com> - 2015-11-17 02:50 +0100
              Re: CGroup Namespaces (v4) "Serge E. Hallyn" <serge@hallyn.com> - 2015-11-17 05:00 +0100
          Re: CGroup Namespaces (v4) "Serge E. Hallyn" <serge@hallyn.com> - 2015-11-18 03:40 +0100
            Re: CGroup Namespaces (v4) ebiederm@xmission.com (Eric W. Biederman) - 2015-11-18 10:30 +0100
              Re: CGroup Namespaces (v4) "Serge E. Hallyn" <serge.hallyn@ubuntu.com> - 2015-11-18 16:50 +0100
  Re: CGroup Namespaces (v4) Richard Weinberger <richard.weinberger@gmail.com> - 2015-11-16 21:50 +0100

csiph-web