From: ebiederm@xmission.com (Eric W. Biederman)
To: Andy Lutomirski <luto@kernel.org>
Cc: laurent@vivier.eu, LKML <linux-kernel@vger.kernel.org>,
Linux FS Devel <linux-fsdevel@vger.kernel.org>,
James Bottomley <James.Bottomley@hansenpartnership.com>,
Al Viro <viro@zeniv.linux.org.uk>,
Linux API <linux-api@vger.kernel.org>,
Dmitry Safonov <dima@arista.com>,
Andrey Vagin <avagin@openvz.org>,
Linux Containers <containers@lists.linux-foundation.org>
Subject: Re: [RFC 0/2] ns: introduce binfmt_misc namespace
Date: Mon, 01 Oct 2018 09:21:41 +0200 [thread overview]
Message-ID: <874le63zei.fsf@xmission.com> (raw)
In-Reply-To: <CALCETrWcQtLTVJU14ytWxu_gqoLuAYZJpyAvRsKwwgYZz7FEFg@mail.gmail.com> (Andy Lutomirski's message of "Sun, 30 Sep 2018 21:45:44 -0700")
Andy Lutomirski <luto@kernel.org> writes:
> On Sun, Sep 30, 2018 at 4:47 PM Laurent Vivier <laurent@vivier.eu> wrote:
>>
>> This series introduces a new namespace for binfmt_misc.
>>
>
> This seems conceptually quite reasonable, but I'm wondering if the
> number of namespace types is getting out of hand given the current
> API. Should we be considering whether we need a new set of namespace
> creation APIs that scale better to larger numbers of namespace types?
I would rather encourage a way to make this part of an existing
namespace or find a way to make a mount of binfmt_misc control this.
Hmm. This looks like something that can be very straight forwardly be
made part of the user namespace. If you ever mount binfmt_misc in the
user namespace you get the new behavior. Otherwise you get the existing
behavior.
A user namespace will definitely be required, as otherwise you run the
risk of confusing root (and suid root exectuables0 by being able to
change the behavior of executables.
What is the motivation for this? My impression is that very few people
tweak binfmt_misc.
I also don't think this raises to the level where it makes sense to
create a new namespace for this.
Eric
next prev parent reply other threads:[~2018-10-01 7:21 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-09-30 23:46 [RFC 0/2] ns: introduce binfmt_misc namespace Laurent Vivier
2018-09-30 23:46 ` [RFC 1/2] " Laurent Vivier
2018-10-01 1:21 ` Greg KH
2018-10-01 7:00 ` Laurent Vivier
2018-09-30 23:46 ` [RFC 2/2] binfmt_misc: move data to binfmt_namespace Laurent Vivier
2018-10-01 8:54 ` Jann Horn
2018-10-01 4:45 ` [RFC 0/2] ns: introduce binfmt_misc namespace Andy Lutomirski
2018-10-01 7:13 ` Laurent Vivier
2018-10-01 12:26 ` Dmitry Safonov
2018-10-01 7:21 ` Eric W. Biederman [this message]
2018-10-01 8:45 ` Laurent Vivier
2018-10-01 8:56 ` Eric W. Biederman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=874le63zei.fsf@xmission.com \
--to=ebiederm@xmission.com \
--cc=James.Bottomley@hansenpartnership.com \
--cc=avagin@openvz.org \
--cc=containers@lists.linux-foundation.org \
--cc=dima@arista.com \
--cc=laurent@vivier.eu \
--cc=linux-api@vger.kernel.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=luto@kernel.org \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.