OpenVZ Forum: Devel » userns: targeted capabilities v5

Home » Mailing lists » Devel » userns: targeted capabilities v5

Show: Today's Messages :: Show Polls :: Message Navigator
E-mail to friend

Re: User namespaces and keys [message #41852 is a reply to message #41851]

Wed, 23 February 2011 14:46

ebiederm
Messages: 1354
Registered: February 2006

Senior Member

"Serge E. Hallyn" <serge@hallyn.com> writes:

> Quoting David Howells (dhowells@redhat.com):
>>
>> I guess we need to look at how to mix keys and namespaces again.
>
>>From strictly kernel pov, at the moment, keys are strictly usable only
> by the user in your own user namespace.
>
> We may want to look at this again, but for now I think that would be a
> safe enough default. Later, we'll probably want the user creating a
> child_user_ns to allow his keys to be inherited by the child user_ns.
> Though, as I type that, it seems to me that that'll just become a
> maintenance pain, and it's just plain safer to have the user re-enter
> his keys, sharing them over a file if needed.
>
> I'm going to not consider the TPM at the moment :)
>
>> Possibly the trickiest problem with keys is how to upcall key construction to
>> /sbin/request-key when the keys may be of a different user namespace.
>
> Hm, jinkeys, yes.

Serge short term this is where I think we need to add a check or two so
that keys only work in the init_user_ns. When the rest of the details
are sorted out we can open up the use of keys some more.

As the first stage of converting the network stack we added patches
that turned off everything in non init namespaces. Those patches
were trivial and easy to review, and it made the conversion process
a lot easier. I suspect for keys and possibly security modules and
anything else that does is related we want to turn off by default.

Then once the core of user namespaces is safe to unshare without
privilege we can come back and get the more difficult bits.

Eric
_______________________________________________
Containers mailing list
Containers@lists.linux-foundation.org
https://lists.linux-foundation.org/mailman/listinfo/containe rs

Report message to a moderator

[Message index]

		userns: targeted capabilities v5 By: serge on Thu, 17 February 2011 15:02
		[PATCH 2/9] security: Make capabilities relative to the user namespace. By: serge on Thu, 17 February 2011 15:03
		Re: [PATCH 2/9] security: Make capabilities relative to the user namespace. By: ebiederm on Fri, 18 February 2011 03:46
		Re: [PATCH 2/9] security: Make capabilities relative to the user namespace. By: Daniel Lezcano on Fri, 18 February 2011 23:44
		Re: [PATCH 2/9] security: Make capabilities relative to the user namespace. By: akpm on Fri, 18 February 2011 23:59
		Re: [PATCH 2/9] security: Make capabilities relative to the user namespace. By: David Howells on Wed, 23 February 2011 12:01
		Re: [PATCH 2/9] security: Make capabilities relative to the user namespace. By: serge on Wed, 23 February 2011 13:43
		Re: [PATCH 2/9] security: Make capabilities relative to the user namespace. By: David Howells on Wed, 23 February 2011 11:40
		Re: [PATCH 2/9] security: Make capabilities relative to the user namespace. By: David Howells on Wed, 23 February 2011 16:59
		[PATCH 9/9] userns: check user namespace for task->file uid equivalence checks By: serge on Thu, 17 February 2011 15:04
		Re: [PATCH 9/9] userns: check user namespace for task->file uid equivalence checks By: ebiederm on Fri, 18 February 2011 01:29
		Re: [PATCH 9/9] userns: check user namespace for task->file uid equivalence checks By: akpm on Fri, 18 February 2011 23:59
		Re: [PATCH 9/9] userns: check user namespace for task->file uid equivalence checks By: serge on Thu, 24 February 2011 03:24
		Re: [PATCH 9/9] userns: check user namespace for task->file uid equivalence checks By: akpm on Thu, 24 February 2011 05:08
		Re: [PATCH 9/9] userns: check user namespace for task->file uid equivalence checks By: Daniel Lezcano on Sat, 19 February 2011 19:22
		[PATCH 7/9] add a user namespace owner of ipc ns By: serge on Thu, 17 February 2011 15:03
		Re: [PATCH 7/9] add a user namespace owner of ipc ns By: ebiederm on Fri, 18 February 2011 03:19
		Re: [PATCH 7/9] add a user namespace owner of ipc ns By: akpm on Fri, 18 February 2011 23:59
		Re: [PATCH 7/9] add a user namespace owner of ipc ns By: Daniel Lezcano on Sat, 19 February 2011 17:57
		[PATCH 1/9] Add a user_namespace as creator/owner of uts_namespace By: serge on Thu, 17 February 2011 15:02
		Re: [PATCH 1/9] Add a user_namespace as creator/owner of uts_namespace By: ebiederm on Fri, 18 February 2011 03:31
		Re: [PATCH 1/9] Add a user_namespace as creator/owner of uts_namespace By: Daniel Lezcano on Fri, 18 February 2011 16:57
		Re: [PATCH 1/9] Add a user_namespace as creator/owner of uts_namespace By: akpm on Fri, 18 February 2011 23:59
		Re: [PATCH 1/9] Add a user_namespace as creator/owner of uts_namespace By: David Howells on Wed, 23 February 2011 17:16
		Re: [PATCH 1/9] Add a user_namespace as creator/owner of uts_namespace By: ebiederm on Wed, 23 February 2011 21:21
		Re: [PATCH 1/9] Add a user_namespace as creator/owner of uts_namespace By: David Howells on Wed, 23 February 2011 23:19
		Re: [PATCH 1/9] Add a user_namespace as creator/owner of uts_namespace By: ebiederm on Wed, 23 February 2011 23:54
		[PATCH 3/9] allow sethostname in a container By: serge on Thu, 17 February 2011 15:03
		Re: [PATCH 3/9] allow sethostname in a container By: ebiederm on Fri, 18 February 2011 03:05
		Re: [PATCH 3/9] allow sethostname in a container By: Daniel Lezcano on Fri, 18 February 2011 23:46
		[PATCH 4/9] allow killing tasks in your own or child userns By: serge on Thu, 17 February 2011 15:03
		Re: [PATCH 4/9] allow killing tasks in your own or child userns By: ebiederm on Fri, 18 February 2011 03:00
		Re: [PATCH 4/9] allow killing tasks in your own or child userns By: akpm on Fri, 18 February 2011 23:59
		Re: [PATCH 4/9] allow killing tasks in your own or child userns By: serge on Thu, 24 February 2011 00:48
		Re: [PATCH 4/9] allow killing tasks in your own or child userns By: akpm on Thu, 24 February 2011 00:54
		Re: [PATCH 4/9] allow killing tasks in your own or child userns By: Daniel Lezcano on Sat, 19 February 2011 10:55
		[PATCH 6/9] user namespaces: convert all capable checks in kernel/sys.c By: serge on Thu, 17 February 2011 15:03
		Re: [PATCH 6/9] user namespaces: convert all capable checks in kernel/sys.c By: ebiederm on Fri, 18 February 2011 01:57
		Re: [PATCH 6/9] user namespaces: convert all capable checks in kernel/sys.c By: akpm on Fri, 18 February 2011 23:59
		Re: [PATCH 6/9] user namespaces: convert all capable checks in kernel/sys.c By: akpm on Sat, 19 February 2011 00:01
		Re: [PATCH 6/9] user namespaces: convert all capable checks in kernel/sys.c By: Daniel Lezcano on Sat, 19 February 2011 17:52
		[PATCH 5/9] Allow ptrace from non-init user namespaces By: serge on Thu, 17 February 2011 15:03
		Re: [PATCH 5/9] Allow ptrace from non-init user namespaces By: ebiederm on Fri, 18 February 2011 02:59
		Re: [PATCH 5/9] Allow ptrace from non-init user namespaces By: serge on Fri, 18 February 2011 04:36
		[PATCH] userns: ptrace: incorporate feedback from Eric By: serge on Thu, 24 February 2011 00:49
		Re: [PATCH] userns: ptrace: incorporate feedback from Eric By: akpm on Thu, 24 February 2011 00:56
		Re: [PATCH] userns: ptrace: incorporate feedback from Eric By: serge on Thu, 24 February 2011 03:15
		Re: [PATCH 5/9] Allow ptrace from non-init user namespaces By: akpm on Fri, 18 February 2011 23:59
		Re: [PATCH 5/9] Allow ptrace from non-init user namespaces By: serge on Thu, 24 February 2011 00:43
		Re: [PATCH 5/9] Allow ptrace from non-init user namespaces By: Daniel Lezcano on Sat, 19 February 2011 17:49
		Re: [PATCH 5/9] Allow ptrace from non-init user namespaces By: David Howells on Wed, 23 February 2011 17:05
		Re: [PATCH 5/9] Allow ptrace from non-init user namespaces By: David Howells on Wed, 23 February 2011 17:11
		[PATCH 8/9] user namespaces: convert several capable() calls By: serge on Thu, 17 February 2011 15:03
		Re: [PATCH 8/9] user namespaces: convert several capable() calls By: ebiederm on Fri, 18 February 2011 01:51
		Re: [PATCH 8/9] user namespaces: convert several capable() calls By: Daniel Lezcano on Sat, 19 February 2011 19:07
		Re: userns: targeted capabilities v5 By: akpm on Fri, 18 February 2011 00:21
		Re: userns: targeted capabilities v5 By: ebiederm on Fri, 18 February 2011 03:53
		Re: userns: targeted capabilities v5 By: serge on Fri, 18 February 2011 04:28
		User namespaces and keys By: David Howells on Wed, 23 February 2011 12:05
		Re: User namespaces and keys By: serge on Wed, 23 February 2011 13:58
		Re: User namespaces and keys By: ebiederm on Wed, 23 February 2011 14:46
		Re: User namespaces and keys By: David Howells on Wed, 23 February 2011 15:06
		Re: User namespaces and keys By: ebiederm on Wed, 23 February 2011 15:45
		Re: User namespaces and keys By: Serge E. Hallyn on Wed, 23 February 2011 15:53
		Re: User namespaces and keys By: Casey Schaufler on Wed, 23 February 2011 19:24
		Re: User namespaces and keys By: ebiederm on Wed, 23 February 2011 20:55
		Re: User namespaces and keys By: Casey Schaufler on Wed, 23 February 2011 21:37
		Re: User namespaces and keys By: ebiederm on Thu, 24 February 2011 06:56

Previous Topic:	[PATCH 0/5] blk-throttle: writeback and swap IO control
Next Topic:	[PATCH 1/4] userns: let clone_uts_ns() handle setting uts->user_ns

Goto Forum:

-=] Back to Top [=-

[ Syndicate this forum (XML) ] [

] [

]

Current Time: Sat Jun 21 15:58:51 GMT 2025

Total time taken to generate the page: 0.10046 seconds