OpenVZ Forum: Devel » [RFC][PATCH 0/15] Pid namespaces

Home » Mailing lists » Devel » [RFC][PATCH 0/15] Pid namespaces

Show: Today's Messages :: Show Polls :: Message Navigator
E-mail to friend

Re: [PATCH 14/15] Destroy pid namespace on init's death [message #15512 is a reply to message #15510]

Thu, 02 August 2007 18:49

Oleg Nesterov
Messages: 143
Registered: August 2006

Senior Member

On 08/02, sukadev@us.ibm.com wrote:
>
> Oleg Nesterov [oleg@tv-sign.ru] wrote:
> | 
> | This means that we should take care about multi-thread init exit,
> | otherwise the non-root user can crash the kernel.
> | 
> | >From reply to Kirill's message:
> | 
> | 	> Still. A non-root user does clone(CLONE_PIDNS), then clone(CLONE_THREAD),
> 
> Agree we should fix the crash. But we need CAP_SYS_ADMIN to clone
> pid or other namespaces - this is enforced in copy_namespaces() and
> unshare_nsproxy_namespaces()

Hmm. sys_unshare(CLONE_PIDNS) doesn't (and shouldn't) work anyway, but
I don't see the CAP_SYS_ADMIN check in copy_process()->copy_namespaces()
path.

Perhaps I just missed it (sorry, I already cleared my mbox, so I can't
look at theses patches), but is it a good idea to require CAP_SYS_ADMIN?
I think it would be nice if a normal user can create containers, no?

Oleg.

Report message to a moderator

[Message index]

		[RFC][PATCH 0/15] Pid namespaces By: Pavel Emelianov on Thu, 26 July 2007 14:45
		[PATCH 1/15] Move exit_task_namespaces() By: Pavel Emelianov on Thu, 26 July 2007 14:46
		Re: [PATCH 1/15] Move exit_task_namespaces() By: Oleg Nesterov on Thu, 26 July 2007 16:47
		Re: [PATCH 1/15] Move exit_task_namespaces() By: Oleg Nesterov on Fri, 27 July 2007 08:07
		Re: [PATCH 1/15] Move exit_task_namespaces() By: Pavel Emelianov on Fri, 27 July 2007 08:24
		Re: [PATCH 1/15] Move exit_task_namespaces() By: Oleg Nesterov on Fri, 27 July 2007 08:35
		Re: [PATCH 1/15] Move exit_task_namespaces() By: Pavel Emelianov on Fri, 27 July 2007 08:37
		Re: [PATCH 1/15] Move exit_task_namespaces() By: dev on Thu, 26 July 2007 16:59
		Re: [PATCH 1/15] Move exit_task_namespaces() By: Dave Hansen on Thu, 26 July 2007 16:10
		Re: [PATCH 1/15] Move exit_task_namespaces() By: xemul on Fri, 27 July 2007 06:38
		Re: [PATCH 1/15] Move exit_task_namespaces() By: Oleg Nesterov on Thu, 02 August 2007 16:18
		Re: [PATCH 1/15] Move exit_task_namespaces() By: Pavel Emelianov on Mon, 06 August 2007 08:00
		Re: [PATCH 1/15] Move exit_task_namespaces() By: Oleg Nesterov on Mon, 06 August 2007 09:54
		Re: [PATCH 1/15] Move exit_task_namespaces() By: Pavel Emelianov on Mon, 06 August 2007 09:58
		Re: [PATCH 1/15] Move exit_task_namespaces() By: Oleg Nesterov on Mon, 06 August 2007 10:38
		Re: [PATCH 1/15] Move exit_task_namespaces() By: Pavel Emelianov on Mon, 06 August 2007 11:21
		Re: [PATCH 1/15] Move exit_task_namespaces() By: Oleg Nesterov on Mon, 06 August 2007 12:52
		Re: [PATCH 1/15] Move exit_task_namespaces() By: Pavel Emelianov on Mon, 06 August 2007 13:38
		Re: [PATCH 1/15] Move exit_task_namespaces() By: Pavel Emelianov on Mon, 06 August 2007 11:29
		Re: [PATCH 1/15] Move exit_task_namespaces() By: Oleg Nesterov on Mon, 06 August 2007 12:48
		Re: [PATCH 1/15] Move exit_task_namespaces() By: Pavel Emelianov on Mon, 06 August 2007 13:36
		Re: [PATCH 1/15] Move exit_task_namespaces() By: Oleg Nesterov on Mon, 06 August 2007 13:55
		[PATCH 2/15] Introduce MS_KERNMOUNT flag By: Pavel Emelianov on Thu, 26 July 2007 14:47
		[PATCH 3/15] kern_siginfo helper By: Pavel Emelianov on Thu, 26 July 2007 14:48
		Re: [PATCH 3/15] kern_siginfo helper By: Oleg Nesterov on Sun, 29 July 2007 11:40
		Re: [PATCH 3/15] kern_siginfo helper By: Pavel Emelianov on Mon, 30 July 2007 06:07
		Re: [PATCH 3/15] kern_siginfo helper By: Sukadev Bhattiprolu on Tue, 31 July 2007 00:21
		[PATCH 4/15] Make proc_flust_task() flush entries from multiple proc trees By: Pavel Emelianov on Thu, 26 July 2007 14:48
		[PATCH 5/15] Introduce struct upid By: Pavel Emelianov on Thu, 26 July 2007 14:49
		Re: [PATCH 5/15] Introduce struct upid By: Oleg Nesterov on Sun, 29 July 2007 09:50
		Re: [PATCH 5/15] Introduce struct upid By: Pavel Emelianov on Mon, 30 July 2007 05:58
		[PATCH 6/15] Make alloc_pid(), free_pid() and put_pid() work with struct upid By: Pavel Emelianov on Thu, 26 July 2007 14:50
		Re: [PATCH 6/15] Make alloc_pid(), free_pid() and put_pid() work with struct upid By: Oleg Nesterov on Sun, 29 July 2007 10:14
		Re: [PATCH 6/15] Make alloc_pid(), free_pid() and put_pid() work with struct upid By: Pavel Emelianov on Mon, 30 July 2007 06:03
		[PATCH 7/15] Helpers to obtain pid numbers By: Pavel Emelianov on Thu, 26 July 2007 14:51
		Re: [PATCH 7/15] Helpers to obtain pid numbers By: Dave Hansen on Thu, 26 July 2007 19:03
		Re: [PATCH 7/15] Helpers to obtain pid numbers By: Pavel Emelianov on Fri, 27 July 2007 06:40
		Re: [PATCH 7/15] Helpers to obtain pid numbers By: Oleg Nesterov on Sun, 29 July 2007 12:08
		Re: [PATCH 7/15] Helpers to obtain pid numbers By: Pavel Emelianov on Mon, 30 July 2007 06:11
		[PATCH 8/15] Helpers to find the task by its numerical ids By: Pavel Emelianov on Thu, 26 July 2007 14:51
		Re: [PATCH 8/15] Helpers to find the task by its numerical ids By: Dave Hansen on Thu, 26 July 2007 19:05
		Re: [PATCH 8/15] Helpers to find the task by its numerical ids By: Pavel Emelianov on Fri, 27 July 2007 06:43
		Re: [PATCH 8/15] Helpers to find the task by its numerical ids By: Oleg Nesterov on Sun, 29 July 2007 12:39
		Re: [PATCH 8/15] Helpers to find the task by its numerical ids By: Pavel Emelianov on Mon, 30 July 2007 06:15
		[PATCH 9/15] Move alloc_pid() after the namespace is cloned By: Pavel Emelianov on Thu, 26 July 2007 14:52
		Re: [PATCH 9/15] Move alloc_pid() after the namespace is cloned By: Oleg Nesterov on Fri, 27 July 2007 15:10
		Re: [PATCH 9/15] Move alloc_pid() after the namespace is cloned By: Pavel Emelianov on Mon, 30 July 2007 06:17
		Re: [PATCH 9/15] Move alloc_pid() after the namespace is cloned By: Sukadev Bhattiprolu on Mon, 30 July 2007 23:43
		Re: [PATCH 9/15] Move alloc_pid() after the namespace is cloned By: Sukadev Bhattiprolu on Tue, 31 July 2007 05:49
		[PATCH 10/15] Make each namespace has its own proc tree By: Pavel Emelianov on Thu, 26 July 2007 14:54
		Re: [PATCH 10/15] Make each namespace has its own proc tree By: Oleg Nesterov on Sun, 29 July 2007 15:56
		Re: [PATCH 10/15] Make each namespace has its own proc tree By: Oleg Nesterov on Sun, 29 July 2007 17:02
		Re: [PATCH 10/15] Make each namespace has its own proc tree By: Pavel Emelianov on Mon, 30 July 2007 06:45
		Re: [PATCH 10/15] Make each namespace has its own proc tree By: Pavel Emelianov on Mon, 30 July 2007 06:43
		[PATCH 11/15] Signal semantics By: Pavel Emelianov on Thu, 26 July 2007 14:55
		Re: [PATCH 11/15] Signal semantics By: Oleg Nesterov on Fri, 27 July 2007 12:30
		Re: [PATCH 11/15] Signal semantics By: Pavel Emelianov on Fri, 27 July 2007 13:38
		Re: [PATCH 11/15] Signal semantics By: serue on Fri, 27 July 2007 19:59
		Re: [PATCH 11/15] Signal semantics By: Sukadev Bhattiprolu on Fri, 27 July 2007 20:23
		Re: [PATCH 11/15] Signal semantics By: Pavel Emelianov on Mon, 30 July 2007 09:34
		Re: [PATCH 11/15] Signal semantics By: Pavel Emelianov on Mon, 30 July 2007 09:31
		Re: [PATCH 11/15] Signal semantics By: serue on Wed, 01 August 2007 16:13
		Re: [PATCH 11/15] Signal semantics By: dev on Thu, 02 August 2007 08:35
		Re: [PATCH 11/15] Signal semantics By: serue on Thu, 02 August 2007 20:09
		Re: [PATCH 11/15] Signal semantics By: Oleg Nesterov on Sun, 29 July 2007 11:23
		[PATCH 12/15] Miscelaneous stuff for pid namespaces By: Pavel Emelianov on Thu, 26 July 2007 14:56
		Re: [PATCH 12/15] Miscelaneous stuff for pid namespaces By: Pavel Emelianov on Fri, 27 July 2007 06:53
		Re: [PATCH 12/15] Miscelaneous stuff for pid namespaces By: Sukadev Bhattiprolu on Fri, 27 July 2007 06:22
		[PATCH 13/15] Clone the pid namespace By: Pavel Emelianov on Thu, 26 July 2007 14:56
		[PATCH 14/15] Destroy pid namespace on init's death By: Pavel Emelianov on Thu, 26 July 2007 14:57
		Re: [PATCH 14/15] Destroy pid namespace on init's death By: Oleg Nesterov on Sun, 29 July 2007 10:39
		Re: [PATCH 14/15] Destroy pid namespace on init's death By: Pavel Emelianov on Mon, 30 July 2007 11:56
		Re: [PATCH 14/15] Destroy pid namespace on init's death By: Oleg Nesterov on Mon, 30 July 2007 15:44
		Re: [PATCH 14/15] Destroy pid namespace on init's death By: Oleg Nesterov on Tue, 31 July 2007 09:07
		Re: [PATCH 14/15] Destroy pid namespace on init's death By: Sukadev Bhattiprolu on Wed, 01 August 2007 06:16
		Re: [PATCH 14/15] Destroy pid namespace on init's death By: Dave Hansen on Wed, 01 August 2007 16:00
		Re: [PATCH 14/15] Destroy pid namespace on init's death By: Oleg Nesterov on Wed, 01 August 2007 19:51
		Re: [PATCH 14/15] Destroy pid namespace on init's death By: dev on Thu, 02 August 2007 08:37
		Re: [PATCH 14/15] Destroy pid namespace on init's death By: Oleg Nesterov on Thu, 02 August 2007 16:08
		Re: [PATCH 14/15] Destroy pid namespace on init's death By: Oleg Nesterov on Thu, 02 August 2007 17:08
		Re: [PATCH 14/15] Destroy pid namespace on init's death By: Sukadev Bhattiprolu on Fri, 03 August 2007 06:22
		Re: [PATCH 14/15] Destroy pid namespace on init's death By: Oleg Nesterov on Fri, 03 August 2007 10:55
		Re: [PATCH 14/15] Destroy pid namespace on init's death By: Sukadev Bhattiprolu on Thu, 02 August 2007 07:37
		Re: [PATCH 14/15] Destroy pid namespace on init's death By: Oleg Nesterov on Wed, 01 August 2007 19:48
		Re: [PATCH 14/15] Destroy pid namespace on init's death By: Sukadev Bhattiprolu on Thu, 02 August 2007 07:29
		Re: [PATCH 14/15] Destroy pid namespace on init's death By: Oleg Nesterov on Thu, 02 August 2007 15:39
		Re: [PATCH 14/15] Destroy pid namespace on init's death By: Sukadev Bhattiprolu on Thu, 02 August 2007 17:20
		Re: [PATCH 14/15] Destroy pid namespace on init's death By: Oleg Nesterov on Thu, 02 August 2007 17:29
		Re: [PATCH 14/15] Destroy pid namespace on init's death By: Sukadev Bhattiprolu on Thu, 02 August 2007 18:36
		Re: [PATCH 14/15] Destroy pid namespace on init's death By: Oleg Nesterov on Thu, 02 August 2007 18:49
		Re: [PATCH 14/15] Destroy pid namespace on init's death By: serue on Thu, 02 August 2007 19:13
		Re: [PATCH 14/15] Destroy pid namespace on init's death By: Sukadev Bhattiprolu on Fri, 03 August 2007 21:36
		[PATCH 15/15] Hooks over the code to show correct values to user By: Pavel Emelianov on Thu, 26 July 2007 14:58
		Re: [PATCH 15/15] Hooks over the code to show correct values to user By: Sukadev Bhattiprolu on Fri, 27 July 2007 05:57
		Re: [PATCH 15/15] Hooks over the code to show correct values to user By: Pavel Emelianov on Fri, 27 July 2007 06:44
		Re: [PATCH 15/15] Hooks over the code to show correct values to user By: Oleg Nesterov on Sun, 29 July 2007 14:29
		Re: [PATCH 15/15] Hooks over the code to show correct values to user By: Pavel Emelianov on Mon, 30 July 2007 06:49
		Re: [PATCH 15/15] Hooks over the code to show correct values to user By: Oleg Nesterov on Tue, 31 July 2007 10:04
		Re: [RFC][PATCH 0/15] Pid namespaces By: Sukadev Bhattiprolu on Fri, 27 July 2007 04:22
		Re: [RFC][PATCH 0/15] Pid namespaces By: Sukadev Bhattiprolu on Fri, 27 July 2007 06:08
		Re: [RFC][PATCH 0/15] Pid namespaces By: Pavel Emelianov on Fri, 27 July 2007 06:47

Previous Topic:	Re: [RFC, PATCH] handle the multi-threaded init's exit() properly
Next Topic:	[PATCH 0/14] sysfs cleanups

Goto Forum:

-=] Back to Top [=-

[ Syndicate this forum (XML) ] [

] [

]

Current Time: Sat Sep 06 12:18:59 GMT 2025

Total time taken to generate the page: 0.10155 seconds