Date: Mon, 8 Jan 2018 00:24:52 -0600 From: "Serge E. Hallyn" <serge@...lyn.com> To: James Morris <james.l.morris@...cle.com> Cc: Mahesh Bandewar (महेश बंडेवार) <maheshb@...gle.com>, LKML <linux-kernel@...r.kernel.org>, Netdev <netdev@...r.kernel.org>, Kernel-hardening <kernel-hardening@...ts.openwall.com>, Linux API <linux-api@...r.kernel.org>, Kees Cook <keescook@...omium.org>, Serge Hallyn <serge@...lyn.com>, "Eric W . Biederman" <ebiederm@...ssion.com>, Eric Dumazet <edumazet@...gle.com>, David Miller <davem@...emloft.net>, Mahesh Bandewar <mahesh@...dewar.net> Subject: Re: [PATCHv3 0/2] capability controlled user-namespaces On Mon, Jan 08, 2018 at 11:35:26AM +1100, James Morris wrote: > On Tue, 2 Jan 2018, Mahesh Bandewar (महेश बंडेवार) wrote: > > > On Sat, Dec 30, 2017 at 12:31 AM, James Morris > > <james.l.morris@...cle.com> wrote: > > > On Wed, 27 Dec 2017, Mahesh Bandewar (महेश बंडेवार) wrote: > > > > > >> Hello James, > > >> > > >> Seems like I missed your name to be added into the review of this > > >> patch series. Would you be willing be pull this into the security > > >> tree? Serge Hallyn has already ACKed it. > > > > > > Sure! > > > > > Thank you James. > > I'd like to see what Eric Biederman thinks of this. > > Also, why do we need the concept of a controlled user-ns at all, if the > default whitelist maintains existing behavior? In past discussions two uses have been brought up: 1. if an 0-day is discovered which is exacerbated by a specific privilege in user namespaces, that privilege could be turned off until a reboot with a fixed kernel is scheduled, without fully disabling all containers. 2. some systems may be specifically designed to run software which only requires a few capabilities in a userns. In that case all others could be disabled.
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.