lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <20121219204238.GA4390@hmsreliant.think-freely.org> Date: Wed, 19 Dec 2012 15:42:38 -0500 From: Neil Horman <nhorman@...driver.com> To: Oleg Nesterov <oleg@...hat.com> Cc: "Eric W. Biederman" <ebiederm@...ssion.com>, Pavel Emelyanov <xemul@...allels.com>, Daniel Berrange <berrange@...hat.com>, Alexander Viro <viro@...iv.linux.org.uk>, Serge Hallyn <serge.hallyn@...onical.com>, Andrew Morton <akpm@...ux-foundation.org>, linux-kernel@...r.kernel.org Subject: Re: + core_pattern-set-core-helpers-root-and-namespace-to-crashing-process .patch added to -mm tree On Wed, Dec 19, 2012 at 05:22:30PM +0100, Oleg Nesterov wrote: > On 12/18, Neil Horman wrote: > > > > On Tue, Dec 18, 2012 at 09:06:04PM +0100, Oleg Nesterov wrote: > > > > Perhaps its best just to restrict this patch to adjusting the root fs location > > > > for the chroot case. > > > > > > Probably... at least for the start. > > > > > > BTW. Of course this is subjective, but personally I think that "||" > > > looks strange. Perhaps it would be better to add something like > > > --croot argument? > > > > > The || is ambiguous with its simmilarity to a shell 'or' command, > > Ah, I didn't mean this. > > I meant, this is not flexible. We can implement --croot, then we can > (may be) add --switch_ns. If you use "||" now for chroot, what will you > do for switch_ns? > > > but I don't > > think the --croot argument is much better on that front, as that then becomes > > ambiguous with arguments supplied to the pipe reader directly. > > Not sure I understand... why? > > > The token should > > be leading the pipe_reader string in core_pattern to indicate a change in > > environment independent of the executable path. > > Do you mean that || at the front is more "visible" ? True, but I am > not sure this is that important. > All I really meant was that placing the token for croot at the front of the pattern would be more readable as it disambiguates its meaning from the rest of the command. > But I won't insist. > I wouldn't worry about it. After looking over the changes Eric just had merged for 3.8 I'm becomming more convinced that this isn't really needed anymore. With his changes, we can migrate a process between all available namespaces dynamically in user space. With that functionality we can just write a setns administrative utility to make this all work. I've started that work here: http://marc.info/?l=util-linux-ng&m=135594402801895&w=2 all thats arguably left after that is to make core_pattern a per-container (possibly per mount namespace?). My patch doesn't do that. But its something I can look into. Neil > Oleg. > > -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists