linux-kernel - Re: CLONE_NEWIPC documentation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <m1ejiikw4a.fsf@ebiederm.dsl.xmission.com>
Date:	Sun, 05 Aug 2007 06:24:05 -0600
From:	ebiederm@...ssion.com (Eric W. Biederman)
To:	Michael Kerrisk <mtk-manpages@....net>
Cc:	Kirill Korotaev <dev@...nvz.org>,
	lkml <linux-kernel@...r.kernel.org>,
	Pavel Emelianov <xemul@...nvz.org>,
	Cedric Le Goater <clg@...ibm.com>
Subject: Re: CLONE_NEWIPC documentation

Michael Kerrisk <mtk-manpages@....net> writes:

> Hello Kirill,
>
> In 2.6.19, your patch to add support for CLONE_NEWIPC was included.  Is
> there there some for-userland-programmers documentation of this flag
> somewhere?  Would you be able to send some documentation to me (ideally as
> a patch to the clone.2 man page, but otherwise some plain text will do).
>
> If this flag is also supported for unshare(), then could you please send me
> a patch/text for that too?

In case someone else doesn't do better here is a short summary.

CLONE_NEWIPC creates a new ipc namespace for the new child and all
of it's children.  So far CAP_SYS_ADMIN is required.

An IPC namespace creates a new context for looking up and listing
SYSV IPC shared memory, message queues, and semaphores.  Only allowing
finding of SYSV IPC objects in this namespace.

For most practical purposes two processes in different SYSV IPC
namespaces might as well be on different machines.  As they cannot
find each others SYSV IPC resources, and so cannot interact with
each other that way.

The implementation is essentially just a lookup of the objects
in a different table when doing name to object translation so
there should be no measurable overhead.

When the last process in a SYSV IPC namespace exits any remaining
objects in that SYSV IPC namespace are destroyed.

Eric
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/