On Thursday 24 May 2007 20:40, Al Viro wrote:
> On Thu, May 24, 2007 at 08:10:00PM +0200, Andreas Gruenbacher wrote:
>
> > Read it like this: we don't have a good idea how to support multiple
> > namespaces so far. Currently, we interpret all pathnames relative to the
> > namespace a process is in. Confined processes don't have the privilege to
> > create or manipulate namespaces, which makes this safe. We may find a
> > better future solution.
>
> You also don't have a solution for multiple chroot jails, since they
> often have the same fs mounted in many places on given box *and* since
> the pathnames from the confined processes' POVs have fsck-all to do
> with each other.
>
> It's really not kinder than multiple namespaces as far as your approach
> is concerned.
Well, the pathnames we check against are namespace relative, so no matter what
pathnames the chrooted processes think they are looking at, we always know
the actual pathnames up to ``outside the chroot''. Having the same filesystem
mounted in multiple chroots or in multiple locations in the same chroot
doesn't matter.
The main problem I see when it comes to defining per-namespace policy is that
namespaces are inherently anonymous, and there is no obvious way of
associating different sets of profiles with different namespaces.
Implementing something to also handle multiple namespaces doesn't seem
hard -- after all, it's not such a difficult concept -- but I don't have a
good enough idea what would work best.
Thanks,
Andreas
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[Index of Archives]
[Kernel Newbies]
[Netfilter]
[Bugtraq]
[Photo]
[Stuff]
[Gimp]
[Yosemite News]
[MIPS Linux]
[ARM Linux]
[Linux Security]
[Linux RAID]
[Video 4 Linux]
[Linux for the blind]
[Linux Resources]
