From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Serge E. Hallyn" Subject: Re: [PATCH 0/3] keys: play nicely with user namespaces Date: Thu, 18 Dec 2008 19:45:55 -0600 Message-ID: <20081219014555.GA25688@us.ibm.com> References: <20081218174613.GA13968@us.ibm.com> <20081217235536.GA932@us.ibm.com> <20081212141707.GB9571@us.ibm.com> <20081211232323.GA8343@us.ibm.com> <3507.1229086294@redhat.com> <25987.1229097458@redhat.com> <3547.1229607983@redhat.com> <7376.1229648192@redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Content-Disposition: inline In-Reply-To: <7376.1229648192-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org Errors-To: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org To: David Howells Cc: Linux Containers , "Eric W. Biederman" List-Id: containers.vger.kernel.org Quoting David Howells (dhowells-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org): > Serge E. Hallyn wrote: > > > Cool, thanks. I needed the following change to toolbox.inc.sh.orig in > > order to be able to run with >1 user namespaces: > > > > 36c36 > > < maxsquota=`grep '^ *0': /proc/key-users | sed s@.*/@@` > > --- > > > maxsquota=`grep '^ *0': /proc/key-users | sed s@.*/@@ | head -1` > > > > since /proc/key-users then lists multiple entries. Otherwise, > > all tests pass when running the testsuite in a child-user-ns. > > Should you only get key-users from the set of users in your namespace, I > wonder? > > David Yup - patch coming (probably next week) for that, but there's the question, given that user namespaces are hierarchical, of whether, if pidns B is a child of pidns A created by userid 500, a task in pidns A should see keys in userns B (listed as belonging to userid 500). -serge