* Re: [PATCH 0/5] RFC: connector: Add network namespace awareness
[not found] ` <87lfjn9s3v.fsf@x220.int.ebiederm.org>
@ 2020-09-10 15:04 ` Evgeniy Polyakov
0 siblings, 0 replies; only message in thread
From: Evgeniy Polyakov @ 2020-09-10 15:04 UTC (permalink / raw)
To: ebiederm, Matt Bennett; +Cc: netdev, containers, linux-kernel
Hi everyone
Â
13.07.2020, 21:42, "Eric W. Biederman" <ebiederm@xmission.com>:
Â
 Which means an unprivileged user can create a user namespace and
get
 connector to report whichever ids they want to users in another
 namespace. AKA lie.
Â
 So this appears to make connector completely unreliable.
Â
Â
My sense is that there are few enough uses of connector that if
don't
mind changing your code so that it works in a container (and the
pidfd
support appears to already provide what you need) that is probably
the
past of least resistance.
I don't think it maintaining connector support would be much more
work
than it is now, if someone went through and did the work to
carefully
convert the code. So if someone really wants to use connector we can
namespace the code.
Otherwise it is probably makes sense to let the few users gradually
stop
using connector so the code can eventually be removed.
Â
Such a nice bright future for connector you depict here disregarding
others work
and this contribution Eric :)
Â
If we can overcome showed above issue with invalid ids, connector still
can get a few more years to live,
don't you want to give it a chance?
Â
Please checkout out the pidfd support and tell us how it meets your
needs. If there is something that connector really does better it
would
be good to know.
_______________________________________________
Containers mailing list
Containers@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/containers
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2020-09-10 15:06 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
[not found] <20200702002635.8169-1-matt.bennett@alliedtelesis.co.nz>
[not found] ` <87k0zlspxs.fsf@x220.int.ebiederm.org>
[not found] ` <94defa61204731d7dce37edeb98069c8647722c2.camel@alliedtelesis.co.nz>
[not found] ` <87lfjn9s3v.fsf@x220.int.ebiederm.org>
2020-09-10 15:04 ` [PATCH 0/5] RFC: connector: Add network namespace awareness Evgeniy Polyakov
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).