linux-kernel - Re: CLONE_NEWIPC documentation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <46B6C17D.4050201@gmx.net>
Date:	Mon, 06 Aug 2007 08:36:45 +0200
From:	Michael Kerrisk <mtk-manpages@....net>
To:	"Eric W. Biederman" <ebiederm@...ssion.com>
CC:	Kirill Korotaev <dev@...nvz.org>,
	lkml <linux-kernel@...r.kernel.org>,
	Pavel Emelianov <xemul@...nvz.org>,
	Cedric Le Goater <clg@...ibm.com>
Subject: Re: CLONE_NEWIPC documentation



Eric W. Biederman wrote:
> Michael Kerrisk <mtk-manpages@....net> writes:
> 
>> Hello Kirill,
>>
>> In 2.6.19, your patch to add support for CLONE_NEWIPC was included.  Is
>> there there some for-userland-programmers documentation of this flag
>> somewhere?  Would you be able to send some documentation to me (ideally as
>> a patch to the clone.2 man page, but otherwise some plain text will do).
>>
>> If this flag is also supported for unshare(), then could you please send me
>> a patch/text for that too?
> 
> In case someone else doesn't do better here is a short summary.

Thanks Eric.  That looks to cover a lot of the essentials.  Anyone else see
something important that should be documented?

And a further question: is CLONE_NEWIPC implemented for unshare()?

Cheers,

Michael


> CLONE_NEWIPC creates a new ipc namespace for the new child and all
> of it's children.  So far CAP_SYS_ADMIN is required.
> 
> An IPC namespace creates a new context for looking up and listing
> SYSV IPC shared memory, message queues, and semaphores.  Only allowing
> finding of SYSV IPC objects in this namespace.
> 
> For most practical purposes two processes in different SYSV IPC
> namespaces might as well be on different machines.  As they cannot
> find each others SYSV IPC resources, and so cannot interact with
> each other that way.
> 
> The implementation is essentially just a lookup of the objects
> in a different table when doing name to object translation so
> there should be no measurable overhead.
> 
> When the last process in a SYSV IPC namespace exits any remaining
> objects in that SYSV IPC namespace are destroyed.
> 
> Eric
> 

-- 
Michael Kerrisk
maintainer of Linux man pages Sections 2, 3, 4, 5, and 7

Want to help with man page maintenance?  Grab the latest tarball at
http://www.kernel.org/pub/linux/docs/manpages/
read the HOWTOHELP file and grep the source files for 'FIXME'.
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/