On 09/24/2010 03:02 PM, Andrew Lutomirski wrote:
> Eric W. Biederman wrote:
>> Introduce file for manipulating namespaces and related syscalls.
>> files:
>> /proc/self/ns/<nstype>
>>
>> syscalls:
>> int setns(unsigned long nstype, int fd);
>> socketat(int nsfd, int family, int type, int protocol);
>>
>
> How does security work? Are there different kinds of fd that give (say)
> pin-the-namespace permission, socketat permission, and setns permission?
AFAICS, socketat, setns and "set netns by fd" only accept fd from
/proc/<pid>/ns/<ns>.
setns does :
file = proc_ns_fget(fd);
if (IS_ERR(file))
return PTR_ERR(file);
proc_ns_fget checks if (file->f_op != &ns_file_operations)
socketat and get_net_ns_by_fd:
net = get_net_ns_by_fd(fd);
this one calls proc_ns_fget.
We have the guarantee here, the fd is resulting from an open of the file
with the right permissions.
Another way to pin the namespace, would be to mount --bind
/proc/<pid>/ns/<ns> but we have to be root to do that ...
_______________________________________________
Containers mailing list
[email protected]
https://lists.linux-foundation.org/mailman/listinfo/containers
_______________________________________________
Devel mailing list
[email protected]
https://openvz.org/mailman/listinfo/devel
