Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1586452

Re: [PATCH] Add pidfs filesystem

From Richard Weinberger <richard.weinberger@gmail.com>
Newsgroups linux.kernel
Subject Re: [PATCH] Add pidfs filesystem
Date 2017-02-22 21:20 +0100
Message-ID <tdLyh-77a-21@gated-at.bofh.it> (permalink)
References <tcm8W-7QL-9@gated-at.bofh.it> <tcNC9-8cN-1@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

On Mon, Feb 20, 2017 at 5:05 AM, Eric W. Biederman
<ebiederm@xmission.com> wrote:
> Alexey Gladkov <gladkov.alexey@gmail.com> writes:
>
>> The pidfs filesystem contains a subset of the /proc file system which
>> contains only information about the processes.
>
> My summary of your motivation.
>
> It hurts when I create a container with a processes with uid 0 inside of
> it.  This generates lots of hacks to attempt to limit uid 0.
>
>   My answer:  Don't run a container with a real uid 0 inside of it.

I agree. Unless I miss something I'd say use a user namespace
to get decent permission checks in /proc (and /sys).

-- 
Thanks,
//richard

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH] Add pidfs filesystem Alexey Gladkov <gladkov.alexey@gmail.com> - 2017-02-19 00:00 +0100
  Re: [PATCH] Add pidfs filesystem ebiederm@xmission.com (Eric W. Biederman) - 2017-02-20 05:20 +0100
    Re: [PATCH] Add pidfs filesystem Alexey Gladkov <gladkov.alexey@gmail.com> - 2017-02-20 11:40 +0100
    Re: [PATCH] Add pidfs filesystem Richard Weinberger <richard.weinberger@gmail.com> - 2017-02-22 21:20 +0100
  Re: [PATCH] Add pidfs filesystem Oleg Nesterov <oleg@redhat.com> - 2017-02-21 16:00 +0100
    Re: [PATCH] Add pidfs filesystem Alexey Gladkov <gladkov.alexey@gmail.com> - 2017-02-22 12:50 +0100
    Re: [PATCH] Add pidfs filesystem Alexey Gladkov <gladkov.alexey@gmail.com> - 2017-02-22 13:00 +0100
    Re: [PATCH] Add pidfs filesystem "Dmitry V. Levin" <ldv@altlinux.org> - 2017-02-22 16:50 +0100
      Re: [PATCH] Add pidfs filesystem Oleg Nesterov <oleg@redhat.com> - 2017-02-22 18:50 +0100
        Re: [PATCH] Add pidfs filesystem Alexey Gladkov <gladkov.alexey@gmail.com> - 2017-02-22 20:50 +0100
  Re: [PATCH] Add pidfs filesystem Michael Kerrisk <mtk.manpages@gmail.com> - 2017-02-27 20:00 +0100

csiph-web