linux-kernel - Re: Variant symlink filesystem

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <alpine.DEB.2.02.1603111428530.1949@nftneq.ynat.uz>
Date:	Fri, 11 Mar 2016 14:38:56 -0800 (PST)
From:	David Lang <david@...g.hm>
To:	Cole <cole@...eqint.net>
cc:	Al Viro <viro@...iv.linux.org.uk>,
	LKML <linux-kernel@...r.kernel.org>,
	"Austin S. Hemmelgarn" <ahferroin7@...il.com>,
	Richard Weinberger <richard@....at>
Subject: Re: Variant symlink filesystem

On Sat, 12 Mar 2016, Cole wrote:

> On 11 March 2016 at 23:51, Al Viro <viro@...iv.linux.org.uk> wrote:
>> On Fri, Mar 11, 2016 at 10:52:52PM +0200, Cole wrote:
>>
>>> The implementation doesn't necessarily have to continue to work with
>>> env variables. On FreeBSD, the variant symlinks function by using
>>> variables stored in kernel memory, and have a hierarchical lookup,
>>> starting with user defined values and terminating with global entries.
>>> I am not aware of such functionality existing on linux, but if someone
>>> could point me at something similar to that, I would much prefer to
>>> use that, as there are issues with variables that are exported or
>>> modified during process execution.
>>
>> Put your processes into a separate namespace and use mount --bind in it...
>
> This was one of the first solutions we looked at, and using various
> namespaces. However we would like to be able to have multiple terminal
> sessions open, and be able to have each session using a different
> mount point, or be able to use the other terminals mount point, i.e.
> switching the mount point to that of the other terminals. We would
> also like the shell to be able to make use of these, and use shell
> commands such as 'ls'.

you should be able to have multiple sessions using the same namespace. There is 
the lwn.net series on namespaces at https://lwn.net/Articles/531114/

from what I'm looking at, this should be possible with the right mount options. 
It's not as trivial as setting an environment variable, but if it's all 
scripted, that shouldn't matter to the user.

you would need to use the setns() call to have one session join an existing 
namespace rather than creating a new one.

now, changing namespaces does require CAP_SYS_ADMIN, so if you are not running 
things as root, you may need to create a small daemon to run as root that 
reassigns your different sessions from one ns to another.

David Lang

> When we originally looked at namespaces and containers, we could not
> find a solution to achieve the above. Is this possible using
> namespaces?
>
> Regards
> /Cole
>