linux-kernel - Remaining work for userns (WAS Re: [PATCH 3/3] cgroup : remove the ns

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20100729230052.GB2785@count0.beaverton.ibm.com>
Date:	Thu, 29 Jul 2010 16:00:52 -0700
From:	Matt Helsley <matthltc@...ibm.com>
To:	"Serge E. Hallyn" <serge.hallyn@...onical.com>
Cc:	Matt Helsley <matthltc@...ibm.com>, linux-kernel@...r.kernel.org,
	containers@...ts.linux-foundation.org,
	Paul Menage <menage@...gle.com>,
	Daniel Lezcano <dlezcano@...e.fr>,
	"Eric W. Biederman" <ebiederm@...ssion.com>
Subject: Remaining work for userns (WAS Re: [PATCH 3/3] cgroup : remove the
 ns_cgroup)

On Thu, Jul 29, 2010 at 05:39:57PM -0500, Serge E. Hallyn wrote:
> Quoting Matt Helsley (matthltc@...ibm.com):
> > On Thu, Jul 29, 2010 at 02:58:12PM -0500, Serge E. Hallyn wrote:

<snip>

> 
> BTW in the past the only reason I saw for keeping ns cgroup was
> to lock tasks into a devices cgroup.  Until that lazy guy who was
> going to do it gets off his butt and implements user namespaces,
> you'll just have to use LSMs, which is the right way.

And the only missing piece of userns is replacing the cred checks
right? If so, it might be possible to come up with a coccinelle semantic
patch which would do all/most of the hard work -- depends on whether the
all the checks fit a small number of semantic patterns.

Cheers,
	-Matt Helsley
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/