Message-ID: <1423187245.3299.37.camel@pluto.fritz.box>
Subject: Re: [RFC PATCH 5/8] KEYS: exec request-key within the requesting
 task's init namespace
From: Ian Kent <ikent@redhat.com>
To: David Howells <dhowells@redhat.com>
Cc: Kernel Mailing List <linux-kernel@vger.kernel.org>,
        Oleg Nesterov <onestero@redhat.com>,
        Trond Myklebust <trond.myklebust@primarydata.com>,
        "J. Bruce Fields" <bfields@fieldses.org>,
        Benjamin Coddington <bcodding@redhat.com>,
        Al Viro <viro@ZenIV.linux.org.uk>,
        Jeff Layton <jeff.layton@primarydata.com>,
        "Eric W. Biederman" <ebiederm@xmission.com>
Date: Fri, 06 Feb 2015 09:47:25 +0800
In-Reply-To: <12365.1423149270@warthog.procyon.org.uk>
References: <20150205023423.8382.69433.stgit@pluto.fritz.box>
	 <20150205021553.8382.16297.stgit@pluto.fritz.box>
	 <12365.1423149270@warthog.procyon.org.uk>
Content-Type: text/plain; charset="UTF-8"
Mime-Version: 1.0
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 1466
Lines: 39

On Thu, 2015-02-05 at 15:14 +0000, David Howells wrote:
> 
> > +	/* If running within a container use the container namespace */
> > +	if (current->nsproxy->net_ns != &init_net)
> 
> Is that a viable check?  Is it possible to have a container that shares
> networking details?

That's up for discussion.

I thought about it and concluded that the check is probably not
sufficient for any of the cases.

I left it like that because I'm not sure exactly what the use cases are,
hoping it promote discussion and here we are.

I also think the current container environments don't share net
namespace with the root init net namspace, necessarily, because thy are
containers, ;)

TBH I haven't looked at the user space container creation code but I
expect it could be done that way if it was needed, so the answer is yes
and no, ;)

The questions then are do we need to check anything else, and what
environment should the callback use in the different cases, and what
other cases might break if we change it?

For example, should the fs namespace also be checked for all of these
cases, since we're executing a callback, or is whatever that's set to in
the container always what's required for locating the executable.

Ian

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/