From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
	id S1754738AbbE1UXw (ORCPT <rfc822;w@1wt.eu>);
	Thu, 28 May 2015 16:23:52 -0400
Received: from o1.smtp.sandstorm.io ([50.31.58.214]:6094 "EHLO
	o1.smtp.sandstorm.io" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
	with ESMTP id S1754006AbbE1UXo (ORCPT
	<rfc822;linux-kernel@vger.kernel.org>);
	Thu, 28 May 2015 16:23:44 -0400
X-Greylist: delayed 347 seconds by postgrey-1.27 at vger.kernel.org; Thu, 28 May 2015 16:23:44 EDT
MIME-Version: 1.0
In-Reply-To: <1432843577.9873.1.camel@redhat.com>
References: <b321c0c2729d1c2a72aea319b077dce7afd79698.1424480579.git.luto@amacapital.net>
 <CALCETrVtGE8LdBCFTe1_cqpLf=SxPNX5iCe5wa-hZ0pe8ps_jA@mail.gmail.com>
 <1427447013.2250.9.camel@HansenPartnership.com> <1427788642.4411.12.camel@redhat.com>
 <1427807248.2117.117.camel@HansenPartnership.com> <CALCETrWKA4ZdHfdLuW0_W5xxJOSCJdt_fiRWs6vDk+8ZQ9n9iA@mail.gmail.com>
 <1427808184.2117.122.camel@HansenPartnership.com> <CALCETrW8v1NFa7fcJbyJKXk9Msudht5BJ7Zy1Rg7ZC_TS-2Y-Q@mail.gmail.com>
 <1427810118.2117.126.camel@HansenPartnership.com> <CALCETrU1vKf3fXPt8nS-ABDgfp8NxrFjHwTc68rA0rtvg2Lufg@mail.gmail.com>
 <1427810886.2117.129.camel@HansenPartnership.com> <1427811444.4411.20.camel@redhat.com>
 <1427969525.3559.120.camel@HansenPartnership.com> <CALCETrWyUYgHY53O451AdJUs9Mcjsqmr4fUzoNmYsTP1HLq+VA@mail.gmail.com>
 <1427984969.13651.11.camel@redhat.com> <CALCETrWYit+WiAM6DFm0enGeJN==uWNC63zXp_zRSsSJg2YGPg@mail.gmail.com>
 <87zj6qs7v8.fsf@x220.int.ebiederm.org> <CALCETrVGcCA2SMiDT8JN=AWiSFCXWSaMeKBQmkbKynKfiPJCwA@mail.gmail.com>
 <87oal4odne.fsf@x220.int.ebiederm.org> <1432832511.21304.6.camel@redhat.com>
 <87mw0omxp0.fsf@x220.int.ebiederm.org> <1432843577.9873.1.camel@redhat.com>
From: Kenton Varda <kenton@sandstorm.io>
Date: Thu, 28 May 2015 13:17:30 -0700
Message-ID: <CAOP=4wggpXOC4qLWgNAdw7Ws4vtYR=hscNYzDCfby+-VUxhoQg@mail.gmail.com>
Subject: Re: [PATCH] devpts: Add ptmx_uid and ptmx_gid options
To: Alexander Larsson <alexl@redhat.com>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>, gnome-os-list@gnome.org,
        Linux Containers <containers@lists.linux-foundation.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        Andy Lutomirski <luto@amacapital.net>,
        James Bottomley <James.Bottomley@hansenpartnership.com>,
        mclasen@redhat.com, Linux FS Devel <linux-fsdevel@vger.kernel.org>
Content-Type: text/plain; charset=UTF-8
X-SG-EID: UsLXQ589HNP4HLBydmD9pgHURQozLYm9XliudupI8YtVaQd8NQ8/+UQTiXu8ZoPGOD6PBCeGtM/R9F
 R5U6P90sgm/7wbza13GlWzgztY1znNyyt4WVLiwr/QiBOmvcsAxXP+JNIvmXFIkMrK2R8eZEbu0QMv
 ++mztxBqpnODz7jqH0nu0e8UcZgWvnVgXDcA
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Thu, May 28, 2015 at 1:06 PM, Alexander Larsson <alexl@redhat.com> wrote:
> On Thu, 2015-05-28 at 12:14 -0500, Eric W. Biederman wrote:
>>
>> > Where does the second namespace enter into this?
>>
>> Step a.  Create create a user namespace where uid 0 is mapped to your
>> real uid, and set up your sandbox (aka mount /dev/pts and everything
>> else).
>>
>> Step b.  Create a nested user namespace where your uid is identity
>> mapped and run your desktop application.  You can even drop all caps
>> in
>> your namespace.
>
> Just tried this. Its not the nicest, and it doubles the number of
> namespaces in action for each sandbox, but it does work.

How much overhead is involved in each user namespace? Is there any
system-wide limit on total namespaces, other than RAM? Is there
(non-negligible) CPU overhead for each syscall seeking permissions in
the namespace?

-Kenton