From mboxrd@z Thu Jan 1 00:00:00 1970 From: ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org (Eric W. Biederman) Subject: Re: [PATCH] userns,pidns: Verify the userns for new pid namespaces Date: Sat, 29 Apr 2017 23:42:17 -0500 Message-ID: <8737cqsdzq.fsf@xmission.com> References: <149329634856.21195.14196911999722279118.stgit@localhost.localdomain> <87mvb16fv7.fsf@xmission.com> <12a73543-79ea-4bac-7e96-6ab237534af2@virtuozzo.com> <877f254yx0.fsf@xmission.com> <8737crt4dz.fsf@xmission.com> <87vapnrp7f.fsf_-_@xmission.com> <20170429205325.GB1119@mail.hallyn.com> <87a86yseej.fsf@xmission.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <87a86yseej.fsf-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org> (Eric W. Biederman's message of "Sat, 29 Apr 2017 23:33:24 -0500") List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org Errors-To: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org To: "Serge E. Hallyn" Cc: paul-r2n+y4ga6xFZroRs9YW3xA@public.gmane.org, keescook-F7+t8E8rja9g9hUCZPvPmw@public.gmane.org, gregkh-hQyY1W1yCW8ekmWlsbkhG0B+6BGkLq7r@public.gmane.org, Linux Containers , oleg-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org, linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, gorcunov-GEFAQzZX7r8dnm+yROfE0A@public.gmane.org, Kirill Tkhai , viro-RmSDqhL/yNMiFSDQTTA3OLVCufUGDwFn@public.gmane.org, avagin-GEFAQzZX7r8dnm+yROfE0A@public.gmane.org, linux-api-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, linux-fsdevel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, mtk.manpages-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org, akpm-de/tnXTf+JLsfHDXvbKv3WD2FQJk+8+b@public.gmane.org, luto-kltTT9wpgjJwATOyAt5JVQ@public.gmane.org, mingo-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org, agruenba-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org List-Id: linux-api@vger.kernel.org ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org (Eric W. Biederman) writes: > "Serge E. Hallyn" writes: > >> Quoting Eric W. Biederman (ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org): >>> >>> It is pointless and confusing to allow a pid namespace hierarchy and >>> the user namespace hierarchy to get out of sync. The owner of a child >>> pid namespace should be the owner of the parent pid namespace or >>> a descendant of the owner of the parent pid namespace. >>> >>> Otherwise it is possible to construct scenarios where it is legal to >>> do something in a parent pid namespace but in a child pid namespace. >> >> Hi, >> >> did you mean 'but not in a child...' above? > > Actually I believe I meant: > >>> Otherwise it is possible to construct scenarios where it is not legal >>> to do something in a parent pid namespace but it is legal a child pid >>> namespace. > > I definitely need to fix that wording thank you. Looking at some more I mean: Otherwise it is possible to construct scenarios where a process has a capability in a over a parent pid namespace but does not have the capability over a child pid namespace. Which confusingly makes permission checks non-transitive. Eric