Re: [PATCH v2 2/2] namespaces: add transparent user namespaces

2016-07-12 Thread Eric W. Biederman
Mickaël Salaün writes: > Hi, > > I have been looking for this kind of feature for StemJail [1]. One of > the main idea is to being able to create mount points inside a jail as > an unprivileged user but to keep as much as possible the same > environment from outside the jail. For now, I can only

Re: [PATCH v2 2/2] namespaces: add transparent user namespaces

2016-07-12 Thread Mickaël Salaün
Hi, I have been looking for this kind of feature for StemJail [1]. One of the main idea is to being able to create mount points inside a jail as an unprivileged user but to keep as much as possible the same environment from outside the jail. For now, I can only create a mapping for the current

Re: [PATCH v2 2/2] namespaces: add transparent user namespaces

2016-06-27 Thread Eric W. Biederman
Added a few more relevant cc's. Jann Horn writes: > This allows the admin of a user namespace to mark the namespace as > transparent. All other namespaces, by default, are opaque. I have just skimmed through this and at a high level this doesn't seem too scary. Having an identity mapped user

Re: [PATCH v2 2/2] namespaces: add transparent user namespaces

2016-06-26 Thread Michael Kerrisk
Hi Jann, Patches such as this really should CC linux-api@ (added). On Sat, Jun 25, 2016 at 2:23 AM, Jann Horn wrote: > This allows the admin of a user namespace to mark the namespace as > transparent. All other namespaces, by default, are opaque. > > While the current behavior of user namespaces

[PATCH v2 2/2] namespaces: add transparent user namespaces

2016-06-24 Thread Jann Horn
This allows the admin of a user namespace to mark the namespace as transparent. All other namespaces, by default, are opaque. While the current behavior of user namespaces is appropriate for use in containers, there are many programs that only use user namespaces because doing so enables them to d