Re: [PATCHv3 0/2] capability controlled user-namespaces

On Tue, Jan 9, 2018 at 2:28 PM, Serge E. Hallyn wrote: > Quoting Mahesh Bandewar (महेश बंडेवार) (mahe...@google.com): >> On Mon, Jan 8, 2018 at 10:36 AM, Serge E. Hallyn wrote: >> > Quoting Mahesh Bandewar (महेश बंडेवार) (mahe...@google.com): >> >> On Mon, Jan

Re: [PATCHv3 0/2] capability controlled user-namespaces

On Tue, Jan 9, 2018 at 2:28 PM, Serge E. Hallyn wrote: > Quoting Mahesh Bandewar (महेश बंडेवार) (mahe...@google.com): >> On Mon, Jan 8, 2018 at 10:36 AM, Serge E. Hallyn wrote: >> > Quoting Mahesh Bandewar (महेश बंडेवार) (mahe...@google.com): >> >> On Mon, Jan 8, 2018 at 10:11 AM, Serge E.

Re: [PATCHv3 0/2] capability controlled user-namespaces

Quoting Mahesh Bandewar (महेश बंडेवार) (mahe...@google.com): > On Mon, Jan 8, 2018 at 10:36 AM, Serge E. Hallyn wrote: > > Quoting Mahesh Bandewar (महेश बंडेवार) (mahe...@google.com): > >> On Mon, Jan 8, 2018 at 10:11 AM, Serge E. Hallyn wrote: > >> > Quoting

Re: [PATCHv3 0/2] capability controlled user-namespaces

Quoting Mahesh Bandewar (महेश बंडेवार) (mahe...@google.com): > On Mon, Jan 8, 2018 at 10:36 AM, Serge E. Hallyn wrote: > > Quoting Mahesh Bandewar (महेश बंडेवार) (mahe...@google.com): > >> On Mon, Jan 8, 2018 at 10:11 AM, Serge E. Hallyn wrote: > >> > Quoting Mahesh Bandewar (महेश बंडेवार)

Re: [PATCHv3 0/2] capability controlled user-namespaces

On Mon, Jan 8, 2018 at 10:36 AM, Serge E. Hallyn wrote: > Quoting Mahesh Bandewar (महेश बंडेवार) (mahe...@google.com): >> On Mon, Jan 8, 2018 at 10:11 AM, Serge E. Hallyn wrote: >> > Quoting Mahesh Bandewar (महेश बंडेवार) (mahe...@google.com): >> >> On Mon,

Re: [PATCHv3 0/2] capability controlled user-namespaces

On Mon, Jan 8, 2018 at 10:36 AM, Serge E. Hallyn wrote: > Quoting Mahesh Bandewar (महेश बंडेवार) (mahe...@google.com): >> On Mon, Jan 8, 2018 at 10:11 AM, Serge E. Hallyn wrote: >> > Quoting Mahesh Bandewar (महेश बंडेवार) (mahe...@google.com): >> >> On Mon, Jan 8, 2018 at 7:47 AM, Serge E.

Re: [PATCHv3 0/2] capability controlled user-namespaces

Quoting Mahesh Bandewar (महेश बंडेवार) (mahe...@google.com): > On Mon, Jan 8, 2018 at 10:11 AM, Serge E. Hallyn wrote: > > Quoting Mahesh Bandewar (महेश बंडेवार) (mahe...@google.com): > >> On Mon, Jan 8, 2018 at 7:47 AM, Serge E. Hallyn wrote: > >> > Quoting

Re: [PATCHv3 0/2] capability controlled user-namespaces

Quoting Mahesh Bandewar (महेश बंडेवार) (mahe...@google.com): > On Mon, Jan 8, 2018 at 10:11 AM, Serge E. Hallyn wrote: > > Quoting Mahesh Bandewar (महेश बंडेवार) (mahe...@google.com): > >> On Mon, Jan 8, 2018 at 7:47 AM, Serge E. Hallyn wrote: > >> > Quoting James Morris

Re: [PATCHv3 0/2] capability controlled user-namespaces

On Mon, Jan 8, 2018 at 10:11 AM, Serge E. Hallyn wrote: > Quoting Mahesh Bandewar (महेश बंडेवार) (mahe...@google.com): >> On Mon, Jan 8, 2018 at 7:47 AM, Serge E. Hallyn wrote: >> > Quoting James Morris (james.l.mor...@oracle.com): >> >> On Mon, 8 Jan 2018,

Re: [PATCHv3 0/2] capability controlled user-namespaces

On Mon, Jan 8, 2018 at 10:11 AM, Serge E. Hallyn wrote: > Quoting Mahesh Bandewar (महेश बंडेवार) (mahe...@google.com): >> On Mon, Jan 8, 2018 at 7:47 AM, Serge E. Hallyn wrote: >> > Quoting James Morris (james.l.mor...@oracle.com): >> >> On Mon, 8 Jan 2018, Serge E. Hallyn wrote: >> >> I meant

Re: [PATCHv3 0/2] capability controlled user-namespaces

Quoting Mahesh Bandewar (महेश बंडेवार) (mahe...@google.com): > On Mon, Jan 8, 2018 at 7:47 AM, Serge E. Hallyn wrote: > > Quoting James Morris (james.l.mor...@oracle.com): > >> On Mon, 8 Jan 2018, Serge E. Hallyn wrote: > >> I meant in terms of "marking" a user ns as

Re: [PATCHv3 0/2] capability controlled user-namespaces

Quoting Mahesh Bandewar (महेश बंडेवार) (mahe...@google.com): > On Mon, Jan 8, 2018 at 7:47 AM, Serge E. Hallyn wrote: > > Quoting James Morris (james.l.mor...@oracle.com): > >> On Mon, 8 Jan 2018, Serge E. Hallyn wrote: > >> I meant in terms of "marking" a user ns as "controlled" type -- it's >

Re: [PATCHv3 0/2] capability controlled user-namespaces

On Mon, Jan 8, 2018 at 7:47 AM, Serge E. Hallyn wrote: > Quoting James Morris (james.l.mor...@oracle.com): >> On Mon, 8 Jan 2018, Serge E. Hallyn wrote: >> >> > > Also, why do we need the concept of a controlled user-ns at all, if the >> > > default whitelist maintains existing

Re: [PATCHv3 0/2] capability controlled user-namespaces

On Mon, Jan 8, 2018 at 7:47 AM, Serge E. Hallyn wrote: > Quoting James Morris (james.l.mor...@oracle.com): >> On Mon, 8 Jan 2018, Serge E. Hallyn wrote: >> >> > > Also, why do we need the concept of a controlled user-ns at all, if the >> > > default whitelist maintains existing behavior? >> > >>

Re: [PATCHv3 0/2] capability controlled user-namespaces

Quoting James Morris (james.l.mor...@oracle.com): > On Mon, 8 Jan 2018, Serge E. Hallyn wrote: > > > > Also, why do we need the concept of a controlled user-ns at all, if the > > > default whitelist maintains existing behavior? > > > > In past discussions two uses have been brought up: > > > >

Re: [PATCHv3 0/2] capability controlled user-namespaces

Quoting James Morris (james.l.mor...@oracle.com): > On Mon, 8 Jan 2018, Serge E. Hallyn wrote: > > > > Also, why do we need the concept of a controlled user-ns at all, if the > > > default whitelist maintains existing behavior? > > > > In past discussions two uses have been brought up: > > > >

Re: [PATCHv3 0/2] capability controlled user-namespaces

On Mon, Jan 08, 2018 at 11:35:26AM +1100, James Morris wrote: > On Tue, 2 Jan 2018, Mahesh Bandewar (महेश बंडेवार) wrote: > > > On Sat, Dec 30, 2017 at 12:31 AM, James Morris > > wrote: > > > On Wed, 27 Dec 2017, Mahesh Bandewar (महेश बंडेवार) wrote: > > > > > >> Hello

Re: [PATCHv3 0/2] capability controlled user-namespaces

On Mon, Jan 08, 2018 at 11:35:26AM +1100, James Morris wrote: > On Tue, 2 Jan 2018, Mahesh Bandewar (महेश बंडेवार) wrote: > > > On Sat, Dec 30, 2017 at 12:31 AM, James Morris > > wrote: > > > On Wed, 27 Dec 2017, Mahesh Bandewar (महेश बंडेवार) wrote: > > > > > >> Hello James, > > >> > > >> Seems

Re: [PATCHv3 0/2] capability controlled user-namespaces

Hello Michael, I really don't want to turn this into how-to-hack guide but I do see few points in your argument to make the case clearer. Please see the comments inline. On Sat, Dec 30, 2017 at 12:50 AM, Michael Kerrisk (man-pages) wrote: > Hello Mahesh, > > On

Re: [PATCHv3 0/2] capability controlled user-namespaces

Hello Michael, I really don't want to turn this into how-to-hack guide but I do see few points in your argument to make the case clearer. Please see the comments inline. On Sat, Dec 30, 2017 at 12:50 AM, Michael Kerrisk (man-pages) wrote: > Hello Mahesh, > > On 12/28/2017 01:45 AM, Mahesh

Re: [PATCHv3 0/2] capability controlled user-namespaces

On Sat, Dec 30, 2017 at 12:31 AM, James Morris wrote: > On Wed, 27 Dec 2017, Mahesh Bandewar (महेश बंडेवार) wrote: > >> Hello James, >> >> Seems like I missed your name to be added into the review of this >> patch series. Would you be willing be pull this into the

Re: [PATCHv3 0/2] capability controlled user-namespaces

On Sat, Dec 30, 2017 at 12:31 AM, James Morris wrote: > On Wed, 27 Dec 2017, Mahesh Bandewar (महेश बंडेवार) wrote: > >> Hello James, >> >> Seems like I missed your name to be added into the review of this >> patch series. Would you be willing be pull this into the security >> tree? Serge Hallyn

Re: [PATCHv3 0/2] capability controlled user-namespaces

Hello Mahesh, On 12/28/2017 01:45 AM, Mahesh Bandewar (महेश बंडेवार) wrote: > On Wed, Dec 27, 2017 at 12:23 PM, Michael Kerrisk (man-pages) > wrote: >> Hello Mahesh, >> >> On 27 December 2017 at 18:09, Mahesh Bandewar (महेश बंडेवार) >> wrote: >>>

Re: [PATCHv3 0/2] capability controlled user-namespaces

Hello Mahesh, On 12/28/2017 01:45 AM, Mahesh Bandewar (महेश बंडेवार) wrote: > On Wed, Dec 27, 2017 at 12:23 PM, Michael Kerrisk (man-pages) > wrote: >> Hello Mahesh, >> >> On 27 December 2017 at 18:09, Mahesh Bandewar (महेश बंडेवार) >> wrote: >>> Hello James, >>> >>> Seems like I missed your

Re: [PATCHv3 0/2] capability controlled user-namespaces

On Wed, Dec 27, 2017 at 12:23 PM, Michael Kerrisk (man-pages) wrote: > Hello Mahesh, > > On 27 December 2017 at 18:09, Mahesh Bandewar (महेश बंडेवार) > wrote: >> Hello James, >> >> Seems like I missed your name to be added into the review of this >>

Re: [PATCHv3 0/2] capability controlled user-namespaces

On Wed, Dec 27, 2017 at 12:23 PM, Michael Kerrisk (man-pages) wrote: > Hello Mahesh, > > On 27 December 2017 at 18:09, Mahesh Bandewar (महेश बंडेवार) > wrote: >> Hello James, >> >> Seems like I missed your name to be added into the review of this >> patch series. Would you be willing be pull

Re: [PATCHv3 0/2] capability controlled user-namespaces

Hello Mahesh, On 27 December 2017 at 18:09, Mahesh Bandewar (महेश बंडेवार) wrote: > Hello James, > > Seems like I missed your name to be added into the review of this > patch series. Would you be willing be pull this into the security > tree? Serge Hallyn has already ACKed

Re: [PATCHv3 0/2] capability controlled user-namespaces

Hello Mahesh, On 27 December 2017 at 18:09, Mahesh Bandewar (महेश बंडेवार) wrote: > Hello James, > > Seems like I missed your name to be added into the review of this > patch series. Would you be willing be pull this into the security > tree? Serge Hallyn has already ACKed it. We seem to have

Re: [PATCHv3 0/2] capability controlled user-namespaces

Hello James, Seems like I missed your name to be added into the review of this patch series. Would you be willing be pull this into the security tree? Serge Hallyn has already ACKed it. Thanks, --mahesh.. On Tue, Dec 5, 2017 at 2:30 PM, Mahesh Bandewar wrote: > From:

Re: [PATCHv3 0/2] capability controlled user-namespaces

Hello James, Seems like I missed your name to be added into the review of this patch series. Would you be willing be pull this into the security tree? Serge Hallyn has already ACKed it. Thanks, --mahesh.. On Tue, Dec 5, 2017 at 2:30 PM, Mahesh Bandewar wrote: > From: Mahesh Bandewar > > TL;DR

[PATCHv3 0/2] capability controlled user-namespaces

From: Mahesh Bandewar TL;DR version - Creating a sandbox environment with namespaces is challenging considering what these sandboxed processes can engage into. e.g. CVE-2017-6074, CVE-2017-7184, CVE-2017-7308 etc. just to name few. Current form of user-namespaces,

[PATCHv3 0/2] capability controlled user-namespaces

From: Mahesh Bandewar TL;DR version - Creating a sandbox environment with namespaces is challenging considering what these sandboxed processes can engage into. e.g. CVE-2017-6074, CVE-2017-7184, CVE-2017-7308 etc. just to name few. Current form of user-namespaces, however, if changed