From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-3.8 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7BDCBC433E9 for ; Fri, 15 Jan 2021 17:53:28 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 4094023A6C for ; Fri, 15 Jan 2021 17:53:28 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726765AbhAORxM (ORCPT ); Fri, 15 Jan 2021 12:53:12 -0500 Received: from outgoing-auth-1.mit.edu ([18.9.28.11]:33202 "EHLO outgoing.mit.edu" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1726402AbhAORxL (ORCPT ); Fri, 15 Jan 2021 12:53:11 -0500 Received: from cwcc.thunk.org (pool-72-74-133-215.bstnma.fios.verizon.net [72.74.133.215]) (authenticated bits=0) (User authenticated as tytso@ATHENA.MIT.EDU) by outgoing.mit.edu (8.14.7/8.12.4) with ESMTP id 10FHpKnV022119 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 15 Jan 2021 12:51:21 -0500 Received: by cwcc.thunk.org (Postfix, from userid 15806) id 3494715C399F; Fri, 15 Jan 2021 12:51:20 -0500 (EST) Date: Fri, 15 Jan 2021 12:51:20 -0500 From: "Theodore Ts'o" To: Christoph Hellwig Cc: Dave Chinner , "Darrick J. Wong" , Christian Brauner , Alexander Viro , linux-fsdevel@vger.kernel.org, John Johansen , James Morris , Mimi Zohar , Dmitry Kasatkin , Stephen Smalley , Casey Schaufler , Arnd Bergmann , Andreas Dilger , OGAWA Hirofumi , Geoffrey Thomas , Mrunal Patel , Josh Triplett , Andy Lutomirski , Alban Crequy , Tycho Andersen , David Howells , James Bottomley , Seth Forshee , St?phane Graber , Linus Torvalds , Aleksa Sarai , Lennart Poettering , "Eric W. Biederman" , smbarber@chromium.org, Phil Estes , Serge Hallyn , Kees Cook , Todd Kjos , Paul Moore , Jonathan Corbet , containers@lists.linux-foundation.org, linux-security-module@vger.kernel.org, linux-api@vger.kernel.org, linux-ext4@vger.kernel.org, linux-xfs@vger.kernel.org, linux-integrity@vger.kernel.org, selinux@vger.kernel.org Subject: Re: [PATCH v5 00/42] idmapped mounts Message-ID: References: <20210112220124.837960-1-christian.brauner@ubuntu.com> <20210114171241.GA1164240@magnolia> <20210114204334.GK331610@dread.disaster.area> <20210115162423.GB2179337@infradead.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20210115162423.GB2179337@infradead.org> Precedence: bulk List-ID: X-Mailing-List: linux-xfs@vger.kernel.org On Fri, Jan 15, 2021 at 04:24:23PM +0000, Christoph Hellwig wrote: > > That is what the capabilities are designed for and we already check > for them. So perhaps I'm confused, but my understanding is that in the containers world, capabilities are a lot more complicated. There is: 1) The initial namespace capability set 2) The container's user-namespace capability set 3) The namespace in which the file system is mounted --- which is "usually, but not necessarily the initial namespace" and presumably could potentially not necessarily be the current container's user name space, is namespaces can be hierarchically arranged. Is that correct? If so, how does this patch set change things (if any), and and how does this interact with quota administration operations? On a related note, ext4 specifies a "reserved user" or "reserved group" which can access the reserved blocks. If we have a file system which is mounted in a namespace running a container which is running RHEL or SLES, and in that container, we have a file system mounted (so it was not mounted in the initial namespace), with id-mapping --- and then there is a further sub-container created with its own user sub-namespace further mapping uids/gids --- will the right thing happen? For that matter, how *is* the "right thing" defined? Sorry if this is a potentially stupid question, but I find user namespaces and id and capability mapping to be hopefully confusing for my tiny brain. :-) - Ted