linux-kernel - Re: pid ns feature request

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CALCETrUPCXmfJFs71T4jLSMS6XOBEb15SdQDz37t_6Whf2DWWA@mail.gmail.com>
Date:	Tue, 29 Apr 2014 09:32:24 -0700
From:	Andy Lutomirski <luto@...capital.net>
To:	Serge Hallyn <serge.hallyn@...ntu.com>
Cc:	"Eric W. Biederman" <ebiederm@...ssion.com>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"Serge E. Hallyn" <serge@...onical.com>,
	Linux Containers <containers@...ts.linux-foundation.org>
Subject: Re: pid ns feature request

On Mon, Apr 28, 2014 at 6:39 AM, Serge Hallyn <serge.hallyn@...ntu.com> wrote:
> Quoting Andy Lutomirski (luto@...capital.net):
>> On Fri, Apr 25, 2014 at 12:37 PM, Eric W. Biederman
>> <ebiederm@...ssion.com> wrote:
>> > Andy Lutomirski <luto@...capital.net> writes:
>> >
>> >> Unless I'm missing some trick, it's currently rather painful to mount
>> >> a namespace /proc.  You have to actually be in the pid namespace to
>> >> mount the correct /proc instance, and you can't unmount the old /proc
>> >> until you've mounted the new /proc.  This means that you have to fork
>> >> into the new pid namespace before you can finish setting it up.
>> >
>> > Yes.  You have to be inside just about all namespaces before you can
>> > finish setting them up.
>> >
>> > I don't know the context in which needed to be inside the pid namespace
>> > is a burden.
>>
>> I'm trying to sandbox myself.  I unshare everything, setup up new
>> mounts, pivot_root, umount the old stuff, fork, and wait around for
>> the child to finish.
>>
>> This doesn't work: the parent can't mount the new /proc, and the child
>> can't either because it's too late.
>
> I'm probably not thinking it through enough...  But can't the parent, before
> forking, do
>
>         mkdir -p /childproc/proc
>         mount --bind /childproc /childproc
>         mount --make-rshared /childproc
>
> then the child mounts its proc under /childproc/proc and have that show
> up in the parent's tree?

Yes, and the --make-rshared /childproc isn't necessary.  This is still
a bit annoying, since the parent now needs to wait for the child to
set up mounts if it wants to do anything that requires all the mounts
to be fully set up.

This issue certainly isn't a show-stopper, but it might be nice to
address if anyone ever adds options to proc to do other sensible
namespacy things (e.g. turning off sysctls).

--Andy
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/