Dave Hansen <[email protected]> writes: > From: Dave Hansen <[email protected]> > > Changes from v1: > * Do not allow a child pid namespace to unset paranoid > when its parent had it set. > * Update description text to clarify the options we > have to solve this problem.
Again. Nacked-by: "Eric W. Biederman" <[email protected]> The option name "paranoid" is entirely too general. Who knows what it referrs to. A mount option is not an appropriate place to control one small bit of policy like this. Proc mount options are a real pain in the butt to deal with and to maintain. Further a per pid namespace decision does not actually work, for having restricted policy only for a small set of processes because it is only with very careful container setup that you would expose this policy. If you really need a subset of processes with a restricted policy make it a prctl, and bloat struct task. Then disallow a process with the prctl set from reading the file. Eric -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
