linux-kernel - Re: [ckrm-tech] [PATCH 00/10] Containers(V10): Generic Process Containers

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 8 Jun 2007 11:13:41 -0700
From:	"Paul Menage" <menage@...gle.com>
To:	"Serge E. Hallyn" <serue@...ibm.com>
Cc:	"Serge E. Hallyn" <serge@...lyn.com>, "Paul Jackson" <pj@....com>,
	vatsa@...ibm.com, ckrm-tech@...ts.sourceforge.net,
	balbir@...ibm.com, rohitseth@...gle.com, haveblue@...ibm.com,
	xemul@...ru, dev@...ru, containers@...ts.osdl.org,
	devel@...nvz.org, ebiederm@...ssion.com, mbligh@...gle.com,
	cpw@....com, svaidy@...ux.vnet.ibm.com, akpm@...ux-foundation.org,
	linux-kernel@...r.kernel.org
Subject: Re: [ckrm-tech] [PATCH 00/10] Containers(V10): Generic Process Containers

On 6/8/07, Serge E. Hallyn <serue@...ibm.com> wrote:
>
> I do fear that that could become a maintenance nightmare.  For instance
> right now there's the call to fsnotify_mkdir().  Other such hooks might
> be placed at vfs_mkdir, which we'd then likely want to have placed in
> our container_mkdir() and container_clone() fns.  And of course
> may_create() is static inline in fs/namei.c.  It's trivial, but still if
> it changes we'd want to change the version in kernel/container.c as
> well.

Do we need to actually need to respect may_create() in
container_clone()? I guess it would provide a way for root to control
which processes could unshare namespaces.

>
> What would be the main advantage of doing it this way?  Do you consider
> the extra subys->auto_setup() hook to be avoidable bloat?
>

I was thinking that it would be nice to be able to atomically set up
the resources in the new container at the point when it's created
rather than later. But I guess this way can work too. Can we call it
something like "clone()" rather than "auto_setup()"?

Paul
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/