Re: [PATCH] fs: Make /proc/sys inodes be owned by global root.

2018-12-01 Thread Eric W. Biederman
Radoslaw Burny writes: > On Tue, Nov 27, 2018 at 6:29 AM Eric W. Biederman > wrote: > > Luis Chamberlain writes: > > > On Mon, Nov 26, 2018 at 06:26:07PM +0100, Radoslaw Burny wrote: > >> Due to a recent commit (d151ddc00498 - fs: Update i_[ug]id_(read|write) > >> to translate relative to

Re: [PATCH] fs: Make /proc/sys inodes be owned by global root.

2018-12-01 Thread Eric W. Biederman
Radoslaw Burny writes: > On Tue, Nov 27, 2018 at 6:29 AM Eric W. Biederman > wrote: > > Luis Chamberlain writes: > > > On Mon, Nov 26, 2018 at 06:26:07PM +0100, Radoslaw Burny wrote: > >> Due to a recent commit (d151ddc00498 - fs: Update i_[ug]id_(read|write) > >> to translate relative to

Re: [PATCH] fs: Make /proc/sys inodes be owned by global root.

2018-11-30 Thread Luis Chamberlain
On Fri, Nov 30, 2018 at 08:48:11AM -0600, Eric W. Biederman wrote: > Luis Chamberlain writes: > > > The logic seems sensible then, but are we implicating what a container > > does with its sysctl values onto the entire system? If so, sure, it > > seems you want this for networking purposes as

Re: [PATCH] fs: Make /proc/sys inodes be owned by global root.

2018-11-30 Thread Luis Chamberlain
On Fri, Nov 30, 2018 at 08:48:11AM -0600, Eric W. Biederman wrote: > Luis Chamberlain writes: > > > The logic seems sensible then, but are we implicating what a container > > does with its sysctl values onto the entire system? If so, sure, it > > seems you want this for networking purposes as

Re: [PATCH] fs: Make /proc/sys inodes be owned by global root.

2018-11-30 Thread Eric W. Biederman
Luis Chamberlain writes: > On Mon, Nov 26, 2018 at 11:29:40PM -0600, Eric W. Biederman wrote: >> Luis Chamberlain writes: >> > Thanks for the description of how to run into the issue described but >> > is there also a practical use case today where this is happening? I ask >> > as it would be

Re: [PATCH] fs: Make /proc/sys inodes be owned by global root.

2018-11-30 Thread Eric W. Biederman
Luis Chamberlain writes: > On Mon, Nov 26, 2018 at 11:29:40PM -0600, Eric W. Biederman wrote: >> Luis Chamberlain writes: >> > Thanks for the description of how to run into the issue described but >> > is there also a practical use case today where this is happening? I ask >> > as it would be

Re: [PATCH] fs: Make /proc/sys inodes be owned by global root.

2018-11-30 Thread Radoslaw Burny
On Fri, Nov 30, 2018 at 2:09 AM Luis Chamberlain wrote: > > On Mon, Nov 26, 2018 at 11:29:40PM -0600, Eric W. Biederman wrote: > > Luis Chamberlain writes: > > > Thanks for the description of how to run into the issue described but > > > is there also a practical use case today where this is

Re: [PATCH] fs: Make /proc/sys inodes be owned by global root.

2018-11-30 Thread Radoslaw Burny
On Fri, Nov 30, 2018 at 2:09 AM Luis Chamberlain wrote: > > On Mon, Nov 26, 2018 at 11:29:40PM -0600, Eric W. Biederman wrote: > > Luis Chamberlain writes: > > > Thanks for the description of how to run into the issue described but > > > is there also a practical use case today where this is

Re: [PATCH] fs: Make /proc/sys inodes be owned by global root.

2018-11-29 Thread Luis Chamberlain
On Mon, Nov 26, 2018 at 11:29:40PM -0600, Eric W. Biederman wrote: > Luis Chamberlain writes: > > Thanks for the description of how to run into the issue described but > > is there also a practical use case today where this is happening? I ask > > as it would be good to know the severity of the

Re: [PATCH] fs: Make /proc/sys inodes be owned by global root.

2018-11-29 Thread Luis Chamberlain
On Mon, Nov 26, 2018 at 11:29:40PM -0600, Eric W. Biederman wrote: > Luis Chamberlain writes: > > Thanks for the description of how to run into the issue described but > > is there also a practical use case today where this is happening? I ask > > as it would be good to know the severity of the

Re: [PATCH] fs: Make /proc/sys inodes be owned by global root.

2018-11-26 Thread Eric W. Biederman
Luis Chamberlain writes: > On Mon, Nov 26, 2018 at 06:26:07PM +0100, Radoslaw Burny wrote: >> Due to a recent commit (d151ddc00498 - fs: Update i_[ug]id_(read|write) >> to translate relative to s_user_ns), > > Recent? This is commit is from 2014 and present upstream since v4.8. > And the commit

Re: [PATCH] fs: Make /proc/sys inodes be owned by global root.

2018-11-26 Thread Eric W. Biederman
Luis Chamberlain writes: > On Mon, Nov 26, 2018 at 06:26:07PM +0100, Radoslaw Burny wrote: >> Due to a recent commit (d151ddc00498 - fs: Update i_[ug]id_(read|write) >> to translate relative to s_user_ns), > > Recent? This is commit is from 2014 and present upstream since v4.8. > And the commit

Re: [PATCH] fs: Make /proc/sys inodes be owned by global root.

2018-11-26 Thread Luis Chamberlain
On Mon, Nov 26, 2018 at 06:26:07PM +0100, Radoslaw Burny wrote: > Due to a recent commit (d151ddc00498 - fs: Update i_[ug]id_(read|write) > to translate relative to s_user_ns), Recent? This is commit is from 2014 and present upstream since v4.8. And the commit ID you mentioned in your commit log

Re: [PATCH] fs: Make /proc/sys inodes be owned by global root.

2018-11-26 Thread Luis Chamberlain
On Mon, Nov 26, 2018 at 06:26:07PM +0100, Radoslaw Burny wrote: > Due to a recent commit (d151ddc00498 - fs: Update i_[ug]id_(read|write) > to translate relative to s_user_ns), Recent? This is commit is from 2014 and present upstream since v4.8. And the commit ID you mentioned in your commit log

[PATCH] fs: Make /proc/sys inodes be owned by global root.

2018-11-26 Thread Radoslaw Burny
Due to a recent commit (d151ddc00498 - fs: Update i_[ug]id_(read|write) to translate relative to s_user_ns), inodes under /proc/sys have -1 written to their i_uid/i_gid members if a containing userns does not have entries for root in the uid/gid_map. This wouldn't normally matter, because these

[PATCH] fs: Make /proc/sys inodes be owned by global root.

2018-11-26 Thread Radoslaw Burny
Due to a recent commit (d151ddc00498 - fs: Update i_[ug]id_(read|write) to translate relative to s_user_ns), inodes under /proc/sys have -1 written to their i_uid/i_gid members if a containing userns does not have entries for root in the uid/gid_map. This wouldn't normally matter, because these