linux-kernel - Re: [PATCH review 52/85] sunrpc: Properly encode kuids and kgids in auth.unix.gid rpc pipe upcalls.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 15 Feb 2013 10:47:28 -0800
From:	ebiederm@...ssion.com (Eric W. Biederman)
To:	"J. Bruce Fields" <bfields@...ldses.org>
Cc:	linux-fsdevel@...r.kernel.org,
	Linux Containers <containers@...ts.linux-foundation.org>,
	linux-kernel@...r.kernel.org, "Serge E. Hallyn" <serge@...lyn.com>,
	Trond Myklebust <Trond.Myklebust@...app.com>,
	Stanislav Kinsbursky <skinsbursky@...allels.com>
Subject: Re: [PATCH review 52/85] sunrpc: Properly encode kuids and kgids in auth.unix.gid rpc pipe upcalls.

"J. Bruce Fields" <bfields@...ldses.org> writes:

> On Wed, Feb 13, 2013 at 03:22:32PM -0800, Eric W. Biederman wrote:
>
> I've committed his patches to
>
> 	git://linux-nfs.org/~bfields/linux.git for-3.9
>
> which should also get pulled into next.  Let me know if there's another
> patch I should take.

I don't currently see any problems.

My changes are now in:

        git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace.git for-next

So we will get whatever linux-next testing there is.

>> I am a touch concerned about /proc/fs/nfsd/exports after my patches
>> and Stanislavs patches both come in.  As I think that will allow for
>> cases where net->user_ns != &init_userns.  But we can cross that bridge
>> when we come to it.
>
> OK, let me know of anything I can do to make your life easier....

/proc/fs/nfsd/exports is read-only so it turns out not be be a problem.

That we can not mount nfs or the nfsd control filesystem outside of
init_userns prevents any other problems.  Details are in my conversation
with Stanislav.

Eric

p.s. It would be nice if /proc/fs/nfsd/exports became a symlink to
/proc/net/nfsd/exports so the code didn't have to use current to figure
out how to do the right thing.

p.p.s Full user namespace support probably isn't much more than using
net->user_ns and adding the FS_USERNS_MOUNT flag. 
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/