From mboxrd@z Thu Jan 1 00:00:00 1970 From: ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org (Eric W. Biederman) Subject: Re: [RFC][PATCH] ns: Syscalls for better namespace sharing control. Date: Mon, 08 Mar 2010 14:24:30 -0800 Message-ID: References: <4B92C886.9020507@free.fr> <4B952BBE.6070507@free.fr> <4B9556A9.60206@free.fr> <4B95611C.5060403@free.fr> <4B956852.7050804@free.fr> <20100308214945.GA26617@us.ibm.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <20100308214945.GA26617-r/Jw6+rmf7HQT0dZR+AlfA@public.gmane.org> (Serge E. Hallyn's message of "Mon\, 8 Mar 2010 15\:49\:45 -0600") List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org Errors-To: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org To: "Serge E. Hallyn" Cc: Pavel Emelyanov , Linux Netdev List , containers-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org, Netfilter Development Mailinglist , Ben Greear , Sukadev Bhattiprolu List-Id: containers.vger.kernel.org "Serge E. Hallyn" writes: > Quoting Eric W. Biederman (ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org): >> Daniel Lezcano writes: >> I guess my meaning is I was expecting. >> child = fork(); >> if (child == 0) { >> execve(...); >> } >> waitpid(child); >> >> This puts /bin/sh in the container as well. >> >> I'm not certain about the /proc/self thing I have never encountered that. >> But I guess if your pid is outside of the pid namespace of that instance >> of proc /proc/self will be a broken symlink. >> >> Eric > > Hmm, worse than a broken symlink, will it be a wrong symlink if just > the right pid is created in the container? It won't happen. readlink and followlink are both based on task_tgid_nr_ns(current, ns_of_proc). Which fails if your process is not known in that pid namespace. Eric