| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Thu, 28 Feb 2008 10:00:53 +1100 From: Nick Andrew <nick@...k-andrew.net> To: trivial@...nel.org Cc: linux-kernel@...r.kernel.org, Serge Hallyn <serue@...ibm.com>, Randy Dunlap <randy.dunlap@...cle.com>, Paul Menage <menage@...gle.com>, Paul Jackson <pj@....com>, Valdis Kletnieks <Valdis.Kletnieks@...edu>, Pavel Emelyanov <xemul@...nvz.org> Subject: [PATCH 2.6.25-rc2 3/9] Kconfig: Improve init/Kconfig help descriptions - NAMESPACES Modify the help descriptions of init/Kconfig for clarity, accuracy and consistency. Kernel config options affected: - NAMESPACES - UTS_NS - IPC_NS - USER_NS - PID_NS Add a brief description of what namespaces are and when you would want to use them. For the *_NS options, add a tiny bit of detail about what it is, and ensure each config option has an answer hint: Y for namespaces "if you will be using a container system", Y for the *_NS options except for the two labeled EXPERIMENTAL. Signed-off-by: Nick Andrew <nick@...k-andrew.net> --- Try #4 init/Kconfig | 65 +++++++++++++++++++++++++++++++++++++++++++++------------- 1 files changed, 50 insertions(+), 15 deletions(-) diff --git a/init/Kconfig b/init/Kconfig index cc7a341..0e6a084 100644 --- a/init/Kconfig +++ b/init/Kconfig @@ -487,31 +487,62 @@ config NAMESPACES bool "Namespaces support" if EMBEDDED default !EMBEDDED help - Provides the way to make tasks work with different objects using - the same id. For example same IPC id may refer to different objects - or same user id or pid may refer to different tasks when used in - different namespaces. + Select various namespace options. + + Namespaces allow different kernel objects (such as processes + or sockets) to have the same ID in different namespaces. + Identifiers like process IDs, which historically were globally + unique, will now be unique only within each PID namespace. + Each task can refer only to PIDs within the same namespace + as the task itself. + + Namespaces are used by container systems (e.g. vservers) + to provide isolation between the containers. + + This option does not affect any kernel code directly; it merely + allows you to select namespace options below. + + Answer Y if you will be using a container system, and you + will probably want to enable all the namespace options + below. config UTS_NS bool "UTS namespace" depends on NAMESPACES help - In this namespace tasks see different info provided with the - uname() system call + Enable support for multiple UTS system attributes. + + Each UTS namespace provides an individual view of the + information returned by the uname() system call including + hostname, kernel version and domain name. + + Answer Y if you will be using a container system. config IPC_NS bool "IPC namespace" depends on NAMESPACES && SYSVIPC help - In this namespace tasks work with IPC ids which correspond to - different IPC objects in different namespaces + Enable support for namespace-specific IPC IDs. + + IPC IDs will be unique only within each IPC namespace. + + Answer Y if you will be using a container system. config USER_NS bool "User namespace (EXPERIMENTAL)" depends on NAMESPACES && EXPERIMENTAL help - This allows containers, i.e. vservers, to use user namespaces - to provide different user info for different servers. + Enable experimental support for user namespaces. + + This is a function used by container-based virtualisation systems + (e.g. vservers). User namespaces are intended to ensure that + processes with the same uid which are in different containers are + isolated from each other. + + Currently user namespaces provide separate accounting, while + isolation must be provided using SELinux or a custom security + module. + If unsure, say N. config PID_NS @@ -519,12 +550,16 @@ config PID_NS default n depends on NAMESPACES && EXPERIMENTAL help - Suport process id namespaces. This allows having multiple - process with the same pid as long as they are in different - pid namespaces. This is a building block of containers. + Enable experimental support for hierarchical process id namespaces. + + This is a function used by container-based virtualisation + systems (e.g. vservers). Each process will have a distinct + Process ID in each PID namespace which the process is in. + A process can "see" other processes in the same PID namespace + and child PID namespaces, but cannot see processes in parent + PID namespaces. - Unless you want to work with an experimental feature - say N here. + If unsure, say N. config BLK_DEV_INITRD bool "Initial RAM filesystem and RAM disk (initramfs/initrd) support" -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists