Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752407AbbKQDzB (ORCPT ); Mon, 16 Nov 2015 22:55:01 -0500 Received: from h2.hallyn.com ([78.46.35.8]:55311 "EHLO h2.hallyn.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751639AbbKQDzA (ORCPT ); Mon, 16 Nov 2015 22:55:00 -0500 Date: Mon, 16 Nov 2015 21:54:58 -0600 From: "Serge E. Hallyn" To: "Serge E. Hallyn" Cc: "Eric W. Biederman" , Richard Weinberger , Richard Weinberger , LKML , "open list:ABI/API" , Linux Containers , LXC development mailing-list , Tejun Heo , cgroups mailinglist , Andrew Morton Subject: Re: CGroup Namespaces (v4) Message-ID: <20151117035458.GA3158@mail.hallyn.com> References: <1447703505-29672-1-git-send-email-serge@hallyn.com> <20151116204606.GA30681@mail.hallyn.com> <564A41AF.4040208@nod.at> <20151116205452.GA30975@mail.hallyn.com> <87y4dxh9b8.fsf@x220.int.ebiederm.org> <20151117011349.GA1958@mail.hallyn.com> <20151117014026.GA2331@mail.hallyn.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20151117014026.GA2331@mail.hallyn.com> User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1083 Lines: 24 On Mon, Nov 16, 2015 at 07:40:26PM -0600, Serge E. Hallyn wrote: > On Mon, Nov 16, 2015 at 07:13:49PM -0600, Serge E. Hallyn wrote: > > On Mon, Nov 16, 2015 at 04:24:27PM -0600, Eric W. Biederman wrote: ... > > > Similary have you considered what it required to be able to safely set > > > FS_USERNS_MOUNT? > > > > I think the only thing we need to do is > > > > 1. go through and make sure that any ability to change mount flags is under > > capable() (which I have not yet done). The cgroup_mount() itself checks that > > flags are not changed, but there may be some subtle way to effect a change > > that I'm not aware of yet. > > > > At least the ability to change the clone_children and release agent through > remount need to be restricted to init_user_ns root. No, they can only be changed on a new mount, so these are fine. -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/