Received-SPF: pass (google.com: domain of linux-kernel+bounces-181533-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.199.223 as permitted sender) client-ip=147.75.199.223;
Precedence: bulk
Mime-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset=UTF-8
Date: Thu, 16 May 2024 22:31:54 +0300
Message-Id: <D1BBI1LX2FMW.3MTQAHW0MA1IH@kernel.org>
Cc: <containers@lists.linux.dev>, <linux-kernel@vger.kernel.org>,
 <linux-fsdevel@vger.kernel.org>, <linux-security-module@vger.kernel.org>,
 <keyrings@vger.kernel.org>
Subject: Re: [PATCH 0/3] Introduce user namespace capabilities
From: "Jarkko Sakkinen" <jarkko@kernel.org>
To: "Jarkko Sakkinen" <jarkko@kernel.org>, "Casey Schaufler"
 <casey@schaufler-ca.com>, "Jonathan Calmels" <jcalmels@3xx0.net>,
 <brauner@kernel.org>, <ebiederm@xmission.com>, "Luis Chamberlain"
 <mcgrof@kernel.org>, "Kees Cook" <keescook@chromium.org>, "Joel Granados"
 <j.granados@samsung.com>, "Serge Hallyn" <serge@hallyn.com>, "Paul Moore"
 <paul@paul-moore.com>, "James Morris" <jmorris@namei.org>, "David Howells"
 <dhowells@redhat.com>
References: <20240516092213.6799-1-jcalmels@3xx0.net>
 <2804dd75-50fd-481c-8867-bc6cea7ab986@schaufler-ca.com>
 <D1BBFWKGIA94.JP53QNURY3J4@kernel.org>
In-Reply-To: <D1BBFWKGIA94.JP53QNURY3J4@kernel.org>

On Thu May 16, 2024 at 10:29 PM EEST, Jarkko Sakkinen wrote:
> On Thu May 16, 2024 at 10:07 PM EEST, Casey Schaufler wrote:
> > I suggest that adding a capability set for user namespaces is a bad ide=
a:
> > 	- It is in no way obvious what problem it solves
> > 	- It is not obvious how it solves any problem
> > 	- The capability mechanism has not been popular, and relying on a
> > 	  community (e.g. container developers) to embrace it based on this
> > 	  enhancement is a recipe for failure
> > 	- Capabilities are already more complicated than modern developers
> > 	  want to deal with. Adding another, special purpose set, is going
> > 	  to make them even more difficult to use.
>
> What Inh, Prm, Eff, Bnd and Amb is not dead obvious to you? ;-)
> One UNs cannot hurt...
>
> I'm not following containers that much but didn't seccomp profiles
> supposed to be the silver bullet?

Also, I think Kata Containers style way of doing containers is pretty
solid. I've heard that some video streaming service at least in recent
past did launch VM per stream so it's not like VM's cannot be made to
scale I guess.

BR, Jarkko