From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Michael Kerrisk (man-pages)" Subject: Re: [PATCH v2 00/10] userns: sysctl limits for namespaces Date: Tue, 26 Jul 2016 19:29:02 +0200 Message-ID: References: <8737n5dscy.fsf@x220.int.ebiederm.org> <87d1m754jc.fsf@x220.int.ebiederm.org> <6be70177-a81d-7ed8-d2c9-a596d4d6a165@gmail.com> <87shuwtp4c.fsf@x220.int.ebiederm.org> Reply-To: mtk.manpages-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org Errors-To: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org To: Kees Cook Cc: Network Development , Linux Containers , LKML , Andy Lutomirski , Seth Forshee , Nikolay Borisov , "Eric W. Biederman" , Linux API , "linux-fsdevel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org" , Jann Horn List-Id: containers.vger.kernel.org On 26 July 2016 at 18:52, Kees Cook wrote: > On Tue, Jul 26, 2016 at 8:06 AM, Eric W. Biederman > wrote: >> "Michael Kerrisk (man-pages)" writes: >> >>> Hello Eric, >>> >>> I realized I had a question after the last mail. >>> >>> On 07/21/2016 06:39 PM, Eric W. Biederman wrote: >>>> >>>> This patchset addresses two use cases: >>>> - Implement a sane upper bound on the number of namespaces. >>>> - Provide a way for sandboxes to limit the attack surface from >>>> namespaces. >>> >>> Can you say more about the second point? What exactly is the >>> problem that is being addressed, and how does the patch series >>> address it? (It would be good to have those details in the >>> revised commit message...) >> >> At some point it was reported that seccomp was not sufficient to disable >> namespace creation. I need to go back and look at that claim to see >> which set of circumstances that was referring to. Seccomp doesn't stack >> so I can see why it is an issue. > > seccomp does stack. The trouble usually comes from a perception that > seccomp overhead is not trivial, so setting a system-wide policy is a > bit of a large hammer for such a limitiation. Also, at the time, > seccomp could be bypasses with ptrace, but this (as of v4.8) is no > longer true. Sounds like someone needs to send me a patch for the seccomp.2 man page? Cheers, Michael -- Michael Kerrisk Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/ Linux/UNIX System Programming Training: http://man7.org/training/