Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1439853

Re: [CRIU] Introspecting userns relationships to other namespaces?

From ebiederm@xmission.com (Eric W. Biederman)
Newsgroups linux.kernel
Subject Re: [CRIU] Introspecting userns relationships to other namespaces?
Date 2016-07-09 02:10 +0200
Message-ID <rSO0h-3Dw-3@gated-at.bofh.it> (permalink)
References (5 earlier) <rSyRz-1NP-5@gated-at.bofh.it> <rSyRz-1NP-3@gated-at.bofh.it> <rSF6G-60Q-47@gated-at.bofh.it> <rSL2p-1mP-11@gated-at.bofh.it> <rSMrw-2wN-9@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

James Bottomley <James.Bottomley@Hansenpartnership.com> writes:

> On July 8, 2016 1:38:19 PM PDT, Andrew Vagin <avagin@virtuozzo.com> wrote:

>>What do you think about the idea to mount nsfs and be able to look up
>>any alive namespace by inum:
>
> I think I like it.  It will give us a way to enter any extant
> namespace.  It will work for Eric's fs namespaces as well.  Perhaps a
> /process/ns/<inum> Directory?

*Shivers*

That makes it very easy to bypass any existing controls that exist for
getting at namespaces.  It is true that everything of that kind is
directory based but still.

Plus I think it would serve as information leak to information outside
of the container.

An operation to get a user namespace file descriptor from some kernel
object sounds reasonably sane.

A great big list of things sounds about as scary as it can get.  This is
not the time to be making it easier to escape from containers.

Eric

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Re: Introspecting userns relationships to other namespaces? "Michael Kerrisk (man-pages)" <mtk.manpages@gmail.com> - 2016-07-06 10:50 +0200
  Re: Introspecting userns relationships to other namespaces? "Serge E. Hallyn" <serge@hallyn.com> - 2016-07-06 16:20 +0200
    Re: Introspecting userns relationships to other namespaces? ebiederm@xmission.com (Eric W. Biederman) - 2016-07-06 18:00 +0200
      Re: [CRIU] Introspecting userns relationships to other namespaces? ebiederm@xmission.com (Eric W. Biederman) - 2016-07-08 10:00 +0200
        Re: [CRIU] Introspecting userns relationships to other namespaces? James Bottomley <James.Bottomley@HansenPartnership.com> - 2016-07-08 16:40 +0200
          Re: [CRIU] Introspecting userns relationships to other namespaces? "W. Trevor King" <wking@tremily.us> - 2016-07-08 23:00 +0200
          Re: [CRIU] Introspecting userns relationships to other namespaces? James Bottomley <James.Bottomley@Hansenpartnership.com> - 2016-07-09 00:30 +0200
          Re: [CRIU] Introspecting userns relationships to other namespaces? James Bottomley <James.Bottomley@Hansenpartnership.com> - 2016-07-09 00:30 +0200
            Re: [CRIU] Introspecting userns relationships to other namespaces? ebiederm@xmission.com (Eric W. Biederman) - 2016-07-09 02:10 +0200
              Re: [CRIU] Introspecting userns relationships to other namespaces? James Bottomley <James.Bottomley@HansenPartnership.com> - 2016-07-09 02:20 +0200
                Re: [CRIU] Introspecting userns relationships to other namespaces? ebiederm@xmission.com (Eric W. Biederman) - 2016-07-09 05:20 +0200
                Re: [CRIU] Introspecting userns relationships to other namespaces? James Bottomley <James.Bottomley@Hansenpartnership.com> - 2016-07-09 12:40 +0200
                Re: [CRIU] Introspecting userns relationships to other namespaces? James Bottomley <James.Bottomley@Hansenpartnership.com> - 2016-07-09 12:40 +0200
                Re: [CRIU] Introspecting userns relationships to other namespaces? ebiederm@xmission.com (Eric W. Biederman) - 2016-07-09 20:30 +0200
                Re: [CRIU] Introspecting userns relationships to other namespaces? ebiederm@xmission.com (Eric W. Biederman) - 2016-07-09 20:50 +0200
                Re: [CRIU] Introspecting userns relationships to other namespaces? "W. Trevor King" <wking@tremily.us> - 2016-07-13 06:10 +0200
    Re: Introspecting userns relationships to other namespaces? "Michael Kerrisk (man-pages)" <mtk.manpages@gmail.com> - 2016-07-07 10:20 +0200
      Re: Introspecting userns relationships to other namespaces? "Serge E. Hallyn" <serge@hallyn.com> - 2016-07-07 15:40 +0200
        Re: Introspecting userns relationships to other namespaces? James Bottomley <James.Bottomley@HansenPartnership.com> - 2016-07-07 17:10 +0200
          Re: Introspecting userns relationships to other namespaces? "Michael Kerrisk (man-pages)" <mtk.manpages@gmail.com> - 2016-07-07 20:30 +0200
            Re: Introspecting userns relationships to other namespaces? "Serge E. Hallyn" <serge@hallyn.com> - 2016-07-07 20:30 +0200
            Re: Introspecting userns relationships to other namespaces? James Bottomley <James.Bottomley@HansenPartnership.com> - 2016-07-07 21:20 +0200
              Re: [CRIU] Introspecting userns relationships to other namespaces? James Bottomley <James.Bottomley@HansenPartnership.com> - 2016-07-08 05:30 +0200
                Re: Introspecting userns relationships to other namespaces? "W. Trevor King" <wking@tremily.us> - 2016-07-08 07:40 +0200
                Re: Introspecting userns relationships to other namespaces? "W. Trevor King" <wking@tremily.us> - 2016-07-08 08:20 +0200
                Re: Introspecting userns relationships to other namespaces? "W. Trevor King" <wking@tremily.us> - 2016-07-08 09:20 +0200
                Re: [CRIU] Introspecting userns relationships to other namespaces? Andrei Vagin <avagin@gmail.com> - 2016-07-08 07:50 +0200
                Re: [CRIU] Introspecting userns relationships to other namespaces? Andrei Vagin <avagin@gmail.com> - 2016-07-08 07:50 +0200
                Re: [CRIU] Introspecting userns relationships to other namespaces? James Bottomley <James.Bottomley@HansenPartnership.com> - 2016-07-08 08:20 +0200
                Re: [CRIU] Introspecting userns relationships to other namespaces? "Michael Kerrisk (man-pages)" <mtk.manpages@gmail.com> - 2016-07-08 13:20 +0200
              Re: [CRIU] Introspecting userns relationships to other namespaces? James Bottomley <James.Bottomley@HansenPartnership.com> - 2016-07-08 05:30 +0200
              Re: Introspecting userns relationships to other namespaces? "Michael Kerrisk (man-pages)" <mtk.manpages@gmail.com> - 2016-07-08 13:20 +0200
          Re: Introspecting userns relationships to other namespaces? "W. Trevor King" <wking@tremily.us> - 2016-07-09 05:20 +0200
            Re: Introspecting userns relationships to other namespaces? ebiederm@xmission.com (Eric W. Biederman) - 2016-07-09 05:30 +0200
              Re: [CRIU] Introspecting userns relationships to other namespaces? ebiederm@xmission.com (Eric W. Biederman) - 2016-07-10 22:50 +0200
                Re: [CRIU] Introspecting userns relationships to other namespaces? James Bottomley <James.Bottomley@HansenPartnership.com> - 2016-07-10 23:10 +0200

csiph-web