From mboxrd@z Thu Jan 1 00:00:00 1970 From: Jan Engelhardt Subject: Re: [RFC][PATCH] ns: Syscalls for better namespace sharing control. Date: Thu, 4 Mar 2010 23:55:14 +0100 (CET) Message-ID: References: <4B894564.7080104@parallels.com> <4B89727C.9040602@parallels.com> <4B8AE8C1.1030305@free.fr> <4B8D28CF.8060304@parallels.com> <20100302211942.GA17816@us.ibm.com> <20100303000743.GA13744@us.ibm.com> <20100303153800.GA937@us.ibm.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org Errors-To: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org To: "Eric W. Biederman" Cc: Pavel Emelyanov , Linux Netdev List , containers-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org, Netfilter Development Mailinglist , Ben Greear , Sukadev Bhattiprolu List-Id: containers.vger.kernel.org On Thursday 2010-03-04 22:45, Eric W. Biederman wrote: > >So an unshare of the pid namespace that doesn't really take effect >until we fork may actually be usable from pam, and in fact is probably >the preferred implementation. It looks like neither openssh nor login >from util-linux-ng will cope properly with getting any pid back from >wait() except the pid of their child. Correct; I can tell from experience with pam_mount. GDM for example is very unhappy if you fork/exit processes in PAM modules and don't hide the fact by bending SIGCHLD from gdm_handler to mypam_handler (which itself is racy, suppose GDM re-set the SIGCHLD handler midway through). (In this particular case however, I'd prefer if login programs like GDM just ignored any PIDs they did not spawn in the first place instead of moaning around.)