OpenVZ Forum: Devel » [PATCH 0/7] containers (V7): Generic Process Containers

Home » Mailing lists » Devel » [PATCH 0/7] containers (V7): Generic Process Containers

Show: Today's Messages :: Show Polls :: Message Navigator
E-mail to friend

Re: [ckrm-tech] [PATCH 7/7] containers (V7): Container interface to nsproxy subsystem [message #11456 is a reply to message #10179]

Sat, 24 March 2007 04:58

Srivatsa Vaddagiri
Messages: 241
Registered: August 2006

Senior Member

On Mon, Feb 12, 2007 at 12:15:28AM -0800, menage@google.com wrote:
> +/*
> + * Rules: you can only create a container if
> + * 1. you are capable(CAP_SYS_ADMIN)
> + * 2. the target container is a descendant of your own container
> + */
> +static int ns_create(struct container_subsys *ss, struct container *cont)
> +{
> + struct nscont *ns;
> +
> + if (!capable(CAP_SYS_ADMIN))
> + return -EPERM;

Does this check break existing namespace semantics in a subtle way?
It now requires that unshare() of namespaces by any task requires
CAP_SYS_ADMIN capabilities.

clone(.., CLONE_NEWUTS, ..)->copy_namespaces()->ns_container_clone()->
->container_clone()-> .. -> container_create() -> ns_create()

Earlier, one could unshare his uts namespace w/o CAP_SYS_ADMIN
capabilities. Now it is required. Is that fine? Don't know.

I feel we can avoid this check totally and let the directory permissions
take care of these checks.

Serge, what do you think?

--
Regards,
vatsa

Report message to a moderator

[Message index]

		[PATCH 0/7] containers (V7): Generic Process Containers By: Paul Menage on Mon, 12 February 2007 08:15
		[PATCH 2/7] containers (V7): Cpusets hooked into containers By: Paul Menage on Mon, 12 February 2007 08:15
		Re: [PATCH 2/7] containers (V7): Cpusets hooked into containers By: Paul Menage on Thu, 15 February 2007 20:49
		Re: [PATCH 2/7] containers (V7): Cpusets hooked into containers By: serue on Thu, 15 February 2007 20:35
		Re: [PATCH 2/7] containers (V7): Cpusets hooked into containers By: Srivatsa Vaddagiri on Wed, 07 March 2007 14:34
		Re: [PATCH 2/7] containers (V7): Cpusets hooked into containers By: Paul Menage on Wed, 07 March 2007 16:01
		Re: [ckrm-tech] [PATCH 2/7] containers (V7): Cpusets hooked into containers By: Srivatsa Vaddagiri on Wed, 07 March 2007 16:24
		Re: [ckrm-tech] [PATCH 2/7] containers (V7): Cpusets hooked into containers By: Paul Menage on Wed, 07 March 2007 16:31
		Re: [PATCH 2/7] containers (V7): Cpusets hooked into containers By: Srivatsa Vaddagiri on Wed, 07 March 2007 14:52
		Re: [PATCH 2/7] containers (V7): Cpusets hooked into containers By: Paul Menage on Wed, 07 March 2007 16:12
		[PATCH 4/7] containers (V7): Simple CPU accounting container subsystem By: Paul Menage on Mon, 12 February 2007 08:15
		[PATCH 7/7] containers (V7): Container interface to nsproxy subsystem By: Paul Menage on Mon, 12 February 2007 08:15
		Re: [ckrm-tech] [PATCH 7/7] containers (V7): Container interface to nsproxy subsystem By: Srivatsa Vaddagiri on Sat, 24 March 2007 04:58
		Re: [ckrm-tech] [PATCH 7/7] containers (V7): Container interface to nsproxy subsystem By: serue on Mon, 26 March 2007 21:55
		Re: [ckrm-tech] [PATCH 7/7] containers (V7): Container interface to nsproxy subsystem By: Srivatsa Vaddagiri on Sat, 24 March 2007 16:23
		Re: [ckrm-tech] [PATCH 7/7] containers (V7): Container interface to nsproxy subsystem By: serue on Mon, 26 March 2007 21:57
		Re: [ckrm-tech] [PATCH 7/7] containers (V7): Container interface to nsproxy subsystem By: Srivatsa Vaddagiri on Wed, 28 March 2007 14:55
		Re: [ckrm-tech] [PATCH 7/7] containers (V7): Container interface to nsproxy subsystem By: Srivatsa Vaddagiri on Sat, 31 March 2007 02:47
		Re: [ckrm-tech] [PATCH 7/7] containers (V7): Container interface to nsproxy subsystem By: serue on Mon, 02 April 2007 14:09
		[PATCH 6/7] containers (V7): BeanCounters over generic process containers By: Paul Menage on Mon, 12 February 2007 08:15
		Re: [PATCH 6/7] containers (V7): BeanCounters over generic process containers By: Srivatsa Vaddagiri on Mon, 12 February 2007 15:34
		Re: [PATCH 6/7] containers (V7): BeanCounters over generic process containers By: Paul Menage on Mon, 12 February 2007 18:49
		Re: [PATCH 6/7] containers (V7): BeanCounters over generic process containers By: xemul on Tue, 13 February 2007 08:52
		Re: [PATCH 6/7] containers (V7): BeanCounters over generic process containers By: Paul Menage on Tue, 13 February 2007 09:03
		Re: [PATCH 6/7] containers (V7): BeanCounters over generic process containers By: xemul on Tue, 13 February 2007 09:18
		Re: [PATCH 6/7] containers (V7): BeanCounters over generic process containers By: Paul Menage on Tue, 13 February 2007 09:37
		Re: [PATCH 6/7] containers (V7): BeanCounters over generic process containers By: xemul on Tue, 13 February 2007 09:49
		Re: [PATCH 6/7] containers (V7): BeanCounters over generic process containers By: Paul Menage on Thu, 15 February 2007 00:47
		[PATCH 5/7] containers (V7): Resource Groups over generic containers By: Paul Menage on Mon, 12 February 2007 08:15
		[PATCH 1/7] containers (V7): Generic container system abstracted from cpusets code By: Paul Menage on Mon, 12 February 2007 08:15
		Re: [PATCH 1/7] containers (V7): Generic container system abstracted from cpusets code By: Paul Menage on Mon, 12 February 2007 19:26
		Re: [PATCH 1/7] containers (V7): Generic container system abstracted from cpusets code By: Paul Menage on Mon, 12 February 2007 19:46
		Re: [PATCH 1/7] containers (V7): Generic container system abstracted from cpusets code By: Srivatsa Vaddagiri on Tue, 13 February 2007 05:48
		Re: [ckrm-tech] [PATCH 1/7] containers (V7): Generic container system abstracted from cpusets code By: Srivatsa Vaddagiri on Tue, 13 February 2007 08:16
		Re: [PATCH 1/7] containers (V7): Generic container system abstracted from cpusets code By: Srivatsa Vaddagiri on Wed, 07 March 2007 12:21
		Re: [ckrm-tech] [PATCH 1/7] containers (V7): Generic container system abstracted from cpusets code By: Srivatsa Vaddagiri on Wed, 07 March 2007 14:06
		Re: [PATCH 1/7] containers (V7): Generic container system abstracted from cpusets code By: Paul Menage on Wed, 07 March 2007 20:50
		Re: [ckrm-tech] [PATCH 1/7] containers (V7): Generic container system abstracted from cpusets code By: Srivatsa Vaddagiri on Thu, 08 March 2007 10:31
		Re: [ckrm-tech] [PATCH 1/7] containers (V7): Generic container system abstracted from cpusets code By: Paul Menage on Thu, 08 March 2007 10:40
		Re: [ckrm-tech] [PATCH 1/7] containers (V7): Generic container system abstracted from cpusets code By: Paul Jackson on Sun, 11 March 2007 19:38
		Re: [ckrm-tech] [PATCH 1/7] containers (V7): Generic container system abstracted from cpusets code By: Srivatsa Vaddagiri on Mon, 12 March 2007 14:19
		Re: [ckrm-tech] [PATCH 1/7] containers (V7): Generic container system abstracted from cpusets code By: Srivatsa Vaddagiri on Thu, 22 March 2007 09:56
		Re: [ckrm-tech] [PATCH 1/7] containers (V7): Generic container system abstracted from cpusets code By: Srivatsa Vaddagiri on Thu, 22 March 2007 10:20
		Re: [ckrm-tech] [PATCH 1/7] containers (V7): Generic container system abstracted from cpusets code By: Srivatsa Vaddagiri on Sat, 24 March 2007 14:58
		Re: [ckrm-tech] [PATCH 1/7] containers (V7): Generic container system abstracted from cpusets code By: Paul Jackson on Sat, 24 March 2007 19:25
		Re: [ckrm-tech] [PATCH 1/7] containers (V7): Generic container system abstracted from cpusets code By: Srivatsa Vaddagiri on Sun, 25 March 2007 00:38
		Re: [ckrm-tech] [PATCH 1/7] containers (V7): Generic container system abstracted from cpusets code By: Paul Jackson on Sun, 25 March 2007 01:41
		Re: [ckrm-tech] [PATCH 1/7] containers (V7): Generic container system abstracted from cpusets code By: Srivatsa Vaddagiri on Sun, 25 March 2007 02:21
		Re: [ckrm-tech] [PATCH 1/7] containers (V7): Generic container system abstracted from cpusets code By: Srivatsa Vaddagiri on Sun, 25 March 2007 04:16
		Re: [ckrm-tech] [PATCH 1/7] containers (V7): Generic container system abstracted from cpusets code By: Paul Jackson on Sun, 25 March 2007 05:43
		Re: [ckrm-tech] [PATCH 1/7] containers (V7): Generic container system abstracted from cpusets code By: Srivatsa Vaddagiri on Sun, 25 March 2007 08:14
		Re: [ckrm-tech] [PATCH 1/7] containers (V7): Generic container system abstracted from cpusets code By: Paul Jackson on Sun, 25 March 2007 04:45
		Re: [ckrm-tech] [PATCH 1/7] containers (V7): Generic container system abstracted from cpusets code By: Srivatsa Vaddagiri on Sun, 25 March 2007 04:57
		Re: [ckrm-tech] [PATCH 1/7] containers (V7): Generic container system abstracted from cpusets code By: Paul Jackson on Sun, 25 March 2007 04:59
		Re: [PATCH 0/7] containers (V7): Generic Process Containers By: Paul Jackson on Mon, 12 February 2007 09:18
		Re: [PATCH 0/7] containers (V7): Generic Process Containers By: Paul Menage on Mon, 12 February 2007 09:32
		Re: [PATCH 0/7] containers (V7): Generic Process Containers By: Paul Jackson on Mon, 12 February 2007 09:52
		[PATCH 3/7] containers (V7): Add generic multi-subsystem API to containers By: Paul Menage on Mon, 12 February 2007 08:15
		Re: [PATCH 3/7] containers (V7): Add generic multi-subsystem API to containers By: Paul Menage on Mon, 12 February 2007 18:31
		Re: [PATCH 3/7] containers (V7): Add generic multi-subsystem API to containers By: Cedric Le Goater on Mon, 12 February 2007 15:56
		Re: [PATCH 3/7] containers (V7): Add generic multi-subsystem API to containers By: Balbir Singh on Wed, 14 February 2007 08:49
		Re: [PATCH 0/7] containers (V7): Generic Process Containers By: Paul Menage on Mon, 12 February 2007 23:15
		Re: [PATCH 0/7] containers (V7): Generic Process Containers By: Sam Vilain on Tue, 13 February 2007 00:30
		Re: [PATCH 0/7] containers (V7): Generic Process Containers By: ebiederm on Tue, 20 February 2007 17:34
		Re: [PATCH 0/7] containers (V7): Generic Process Containers By: Paul Menage on Mon, 12 February 2007 23:18
		Re: [PATCH 0/7] containers (V7): Generic Process Containers By: serue on Mon, 12 February 2007 22:47
		Re: [PATCH 0/7] containers (V7): Generic Process Containers By: Sam Vilain on Mon, 12 February 2007 22:38
		Re: [PATCH 0/7] containers (V7): Generic Process Containers By: Paul Menage on Tue, 20 February 2007 17:55
		Re: [PATCH 0/7] containers (V7): Generic Process Containers By: ebiederm on Tue, 20 February 2007 19:29
		Re: [PATCH 0/7] containers (V7): Generic Process Containers By: Paul Menage on Tue, 20 February 2007 22:47
		Re: [PATCH 0/7] containers (V7): Generic Process Containers By: serue on Tue, 20 February 2007 23:32
		Re: [PATCH 0/7] containers (V7): Generic Process Containers By: Sam Vilain on Tue, 20 February 2007 23:08
		Re: [PATCH 0/7] containers (V7): Generic Process Containers By: Sam Vilain on Tue, 20 February 2007 21:58
		Re: [PATCH 0/7] containers (V7): Generic Process Containers By: Paul Menage on Tue, 20 February 2007 22:19
		Re: [PATCH 0/7] containers (V7): Generic Process Containers By: Sam Vilain on Tue, 20 February 2007 22:58
		Re: [PATCH 0/7] containers (V7): Generic Process Containers By: Paul Menage on Tue, 20 February 2007 23:28
		Re: [PATCH 0/7] containers (V7): Generic Process Containers By: Paul Menage on Tue, 20 February 2007 23:36
		Re: [PATCH 0/7] containers (V7): Generic Process Containers By: serue on Tue, 20 February 2007 23:37

Previous Topic:	[PATCH 2/3] powernow-k8: switch to *_on_cpu() functions
Next Topic:	aufs on 64 bit nodes: warnings on compilation

Goto Forum:

-=] Back to Top [=-

[ Syndicate this forum (XML) ] [

] [

]

Current Time: Sun Sep 07 22:16:13 GMT 2025

Total time taken to generate the page: 0.11155 seconds