OpenVZ Forum: Devel » userns: targeted capabilities v5

Home » Mailing lists » Devel » userns: targeted capabilities v5

Show: Today's Messages :: Show Polls :: Message Navigator
E-mail to friend

userns: targeted capabilities v5 [message #41743]

Thu, 17 February 2011 15:02

serge
Messages: 72
Registered: January 2007

Member

Here is a repost of my previous user namespace patch, ported onto
last night's git head.

It fixes several things I was doing wrong in the last (v4)
posting, in particular:

1. don't set uts_ns->user_ns to current's when !CLONE_NEWUTS
2. add a ipc_ns->user_ns which owns ipc_ns, and use that to
decide CAP_IPC_OWNER
3. fix logic flaw caused by bad parantheses
4. allow do_prlimit to current
5. don't always give root full privs to init_user_ns

The expected course of development for user namespaces is laid out
at https://wiki.ubuntu.com/UserNamespace. Bugs aside, this
patchset is supposed to not at all affect systems which are not
actively using user namespaces, and only restrict what tasks in
child user namespace can do. They begin to limit privilege to
a user namespace, so that root in a container cannot kill or
ptrace tasks in the parent user namespace, and can only get
world access rights to files. Since all files currently belong
to the initila user namespace, that means that child user
namespaces can only get world access rights to *all* files.
While this temporarily makes user namespaces bad for system
containers, it starts to get useful for some sandboxing.

I've run the 'runltplite.sh' with and without this patchset and
found no difference. So all in all, this is the first version
of this patchset for which I feel comfortable asking: please
consider applying.

thanks,
-serge
_______________________________________________
Containers mailing list
Containers@lists.linux-foundation.org
https://lists.linux-foundation.org/mailman/listinfo/containe rs

Report message to a moderator

[Message index]

		userns: targeted capabilities v5 By: serge on Thu, 17 February 2011 15:02
		[PATCH 2/9] security: Make capabilities relative to the user namespace. By: serge on Thu, 17 February 2011 15:03
		Re: [PATCH 2/9] security: Make capabilities relative to the user namespace. By: ebiederm on Fri, 18 February 2011 03:46
		Re: [PATCH 2/9] security: Make capabilities relative to the user namespace. By: Daniel Lezcano on Fri, 18 February 2011 23:44
		Re: [PATCH 2/9] security: Make capabilities relative to the user namespace. By: akpm on Fri, 18 February 2011 23:59
		Re: [PATCH 2/9] security: Make capabilities relative to the user namespace. By: David Howells on Wed, 23 February 2011 12:01
		Re: [PATCH 2/9] security: Make capabilities relative to the user namespace. By: serge on Wed, 23 February 2011 13:43
		Re: [PATCH 2/9] security: Make capabilities relative to the user namespace. By: David Howells on Wed, 23 February 2011 11:40
		Re: [PATCH 2/9] security: Make capabilities relative to the user namespace. By: David Howells on Wed, 23 February 2011 16:59
		[PATCH 9/9] userns: check user namespace for task->file uid equivalence checks By: serge on Thu, 17 February 2011 15:04
		Re: [PATCH 9/9] userns: check user namespace for task->file uid equivalence checks By: ebiederm on Fri, 18 February 2011 01:29
		Re: [PATCH 9/9] userns: check user namespace for task->file uid equivalence checks By: akpm on Fri, 18 February 2011 23:59
		Re: [PATCH 9/9] userns: check user namespace for task->file uid equivalence checks By: serge on Thu, 24 February 2011 03:24
		Re: [PATCH 9/9] userns: check user namespace for task->file uid equivalence checks By: akpm on Thu, 24 February 2011 05:08
		Re: [PATCH 9/9] userns: check user namespace for task->file uid equivalence checks By: Daniel Lezcano on Sat, 19 February 2011 19:22
		[PATCH 7/9] add a user namespace owner of ipc ns By: serge on Thu, 17 February 2011 15:03
		Re: [PATCH 7/9] add a user namespace owner of ipc ns By: ebiederm on Fri, 18 February 2011 03:19
		Re: [PATCH 7/9] add a user namespace owner of ipc ns By: akpm on Fri, 18 February 2011 23:59
		Re: [PATCH 7/9] add a user namespace owner of ipc ns By: Daniel Lezcano on Sat, 19 February 2011 17:57
		[PATCH 1/9] Add a user_namespace as creator/owner of uts_namespace By: serge on Thu, 17 February 2011 15:02
		Re: [PATCH 1/9] Add a user_namespace as creator/owner of uts_namespace By: ebiederm on Fri, 18 February 2011 03:31
		Re: [PATCH 1/9] Add a user_namespace as creator/owner of uts_namespace By: Daniel Lezcano on Fri, 18 February 2011 16:57
		Re: [PATCH 1/9] Add a user_namespace as creator/owner of uts_namespace By: akpm on Fri, 18 February 2011 23:59
		Re: [PATCH 1/9] Add a user_namespace as creator/owner of uts_namespace By: David Howells on Wed, 23 February 2011 17:16
		Re: [PATCH 1/9] Add a user_namespace as creator/owner of uts_namespace By: ebiederm on Wed, 23 February 2011 21:21
		Re: [PATCH 1/9] Add a user_namespace as creator/owner of uts_namespace By: David Howells on Wed, 23 February 2011 23:19
		Re: [PATCH 1/9] Add a user_namespace as creator/owner of uts_namespace By: ebiederm on Wed, 23 February 2011 23:54
		[PATCH 3/9] allow sethostname in a container By: serge on Thu, 17 February 2011 15:03
		Re: [PATCH 3/9] allow sethostname in a container By: ebiederm on Fri, 18 February 2011 03:05
		Re: [PATCH 3/9] allow sethostname in a container By: Daniel Lezcano on Fri, 18 February 2011 23:46
		[PATCH 4/9] allow killing tasks in your own or child userns By: serge on Thu, 17 February 2011 15:03
		Re: [PATCH 4/9] allow killing tasks in your own or child userns By: ebiederm on Fri, 18 February 2011 03:00
		Re: [PATCH 4/9] allow killing tasks in your own or child userns By: akpm on Fri, 18 February 2011 23:59
		Re: [PATCH 4/9] allow killing tasks in your own or child userns By: serge on Thu, 24 February 2011 00:48
		Re: [PATCH 4/9] allow killing tasks in your own or child userns By: akpm on Thu, 24 February 2011 00:54
		Re: [PATCH 4/9] allow killing tasks in your own or child userns By: Daniel Lezcano on Sat, 19 February 2011 10:55
		[PATCH 6/9] user namespaces: convert all capable checks in kernel/sys.c By: serge on Thu, 17 February 2011 15:03
		Re: [PATCH 6/9] user namespaces: convert all capable checks in kernel/sys.c By: ebiederm on Fri, 18 February 2011 01:57
		Re: [PATCH 6/9] user namespaces: convert all capable checks in kernel/sys.c By: akpm on Fri, 18 February 2011 23:59
		Re: [PATCH 6/9] user namespaces: convert all capable checks in kernel/sys.c By: akpm on Sat, 19 February 2011 00:01
		Re: [PATCH 6/9] user namespaces: convert all capable checks in kernel/sys.c By: Daniel Lezcano on Sat, 19 February 2011 17:52
		[PATCH 5/9] Allow ptrace from non-init user namespaces By: serge on Thu, 17 February 2011 15:03
		Re: [PATCH 5/9] Allow ptrace from non-init user namespaces By: ebiederm on Fri, 18 February 2011 02:59
		Re: [PATCH 5/9] Allow ptrace from non-init user namespaces By: serge on Fri, 18 February 2011 04:36
		[PATCH] userns: ptrace: incorporate feedback from Eric By: serge on Thu, 24 February 2011 00:49
		Re: [PATCH] userns: ptrace: incorporate feedback from Eric By: akpm on Thu, 24 February 2011 00:56
		Re: [PATCH] userns: ptrace: incorporate feedback from Eric By: serge on Thu, 24 February 2011 03:15
		Re: [PATCH 5/9] Allow ptrace from non-init user namespaces By: akpm on Fri, 18 February 2011 23:59
		Re: [PATCH 5/9] Allow ptrace from non-init user namespaces By: serge on Thu, 24 February 2011 00:43
		Re: [PATCH 5/9] Allow ptrace from non-init user namespaces By: Daniel Lezcano on Sat, 19 February 2011 17:49
		Re: [PATCH 5/9] Allow ptrace from non-init user namespaces By: David Howells on Wed, 23 February 2011 17:05
		Re: [PATCH 5/9] Allow ptrace from non-init user namespaces By: David Howells on Wed, 23 February 2011 17:11
		[PATCH 8/9] user namespaces: convert several capable() calls By: serge on Thu, 17 February 2011 15:03
		Re: [PATCH 8/9] user namespaces: convert several capable() calls By: ebiederm on Fri, 18 February 2011 01:51
		Re: [PATCH 8/9] user namespaces: convert several capable() calls By: Daniel Lezcano on Sat, 19 February 2011 19:07
		Re: userns: targeted capabilities v5 By: akpm on Fri, 18 February 2011 00:21
		Re: userns: targeted capabilities v5 By: ebiederm on Fri, 18 February 2011 03:53
		Re: userns: targeted capabilities v5 By: serge on Fri, 18 February 2011 04:28
		User namespaces and keys By: David Howells on Wed, 23 February 2011 12:05
		Re: User namespaces and keys By: serge on Wed, 23 February 2011 13:58
		Re: User namespaces and keys By: ebiederm on Wed, 23 February 2011 14:46
		Re: User namespaces and keys By: David Howells on Wed, 23 February 2011 15:06
		Re: User namespaces and keys By: ebiederm on Wed, 23 February 2011 15:45
		Re: User namespaces and keys By: Serge E. Hallyn on Wed, 23 February 2011 15:53
		Re: User namespaces and keys By: Casey Schaufler on Wed, 23 February 2011 19:24
		Re: User namespaces and keys By: ebiederm on Wed, 23 February 2011 20:55
		Re: User namespaces and keys By: Casey Schaufler on Wed, 23 February 2011 21:37
		Re: User namespaces and keys By: ebiederm on Thu, 24 February 2011 06:56

Previous Topic:	[PATCH 0/5] blk-throttle: writeback and swap IO control
Next Topic:	[PATCH 1/4] userns: let clone_uts_ns() handle setting uts->user_ns

Goto Forum:

-=] Back to Top [=-

[ Syndicate this forum (XML) ] [

] [

]

Current Time: Wed Jul 17 02:11:31 GMT 2024

Total time taken to generate the page: 0.02930 seconds