linux-kernel - Re: [PATCH 0/1][V3] Handle reboot in a child pid namespace

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 5 Dec 2011 21:50:35 +0100
From:	Oleg Nesterov <oleg@...hat.com>
To:	Daniel Lezcano <daniel.lezcano@...e.fr>
Cc:	Henrique de Moraes Holschuh <hmh@....eng.br>,
	akpm@...ux-foundation.org, serge.hallyn@...onical.com,
	containers@...ts.linux-foundation.org, gkurz@...ibm.com,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH 0/1][V3] Handle reboot in a child pid namespace

On 12/05, Daniel Lezcano wrote:
>
> On 12/04/2011 10:27 PM, Henrique de Moraes Holschuh wrote:
> > On Sun, 04 Dec 2011, Daniel Lezcano wrote:
> > Daniel, can you address Miquel's concern?  Is it a valid concern, or
> > not?  I assume CAP_REBOOT functionality is still in place inside the
> > container, so it really does look like userspace would need to know
> > whether it should drop CAP_REBOOT or not, in order to automatically use
> > the new feature.
>
> Hmm, I missed its email.

Me too... so I am not sure I really understand the problem.

> I would like to address this in a separate patch in order to discuss the
> best way to do that.

Agreed.

> Adding a fake 'reboot' parameter returning EINVAL
> or 0 seems a good solution to detect at runtime if the shutdown is
> correctly supported inside a container.

Or, perhaps, we can implement sys_reboot(REBOOT_SHOULD_NOT_WORK),
sub-init can call it to disable the shutdown ?

This needs the trivial modifications in zap_pid_ns_processes()
and reboot_pid_ns().

Oleg.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/