Re: [PATCHv3 0/2] capability controlled user-namespaces

2018-01-09 Thread महेश बंडेवार
On Tue, Jan 9, 2018 at 2:28 PM, Serge E. Hallyn wrote: > Quoting Mahesh Bandewar (महेश बंडेवार) (mahe...@google.com): >> On Mon, Jan 8, 2018 at 10:36 AM, Serge E. Hallyn wrote: >> > Quoting Mahesh Bandewar (महेश बंडेवार) (mahe...@google.com): >> >> On Mon, Jan 8, 2018 at 10:11 AM, Serge E. Hallyn

Re: [PATCHv3 0/2] capability controlled user-namespaces

2018-01-09 Thread Serge E. Hallyn
Quoting Mahesh Bandewar (महेश बंडेवार) (mahe...@google.com): > On Mon, Jan 8, 2018 at 10:36 AM, Serge E. Hallyn wrote: > > Quoting Mahesh Bandewar (महेश बंडेवार) (mahe...@google.com): > >> On Mon, Jan 8, 2018 at 10:11 AM, Serge E. Hallyn wrote: > >> > Quoting Mahesh Bandewar (महेश बंडेवार) (mahe.

Re: [PATCHv3 0/2] capability controlled user-namespaces

2018-01-08 Thread महेश बंडेवार
On Mon, Jan 8, 2018 at 10:36 AM, Serge E. Hallyn wrote: > Quoting Mahesh Bandewar (महेश बंडेवार) (mahe...@google.com): >> On Mon, Jan 8, 2018 at 10:11 AM, Serge E. Hallyn wrote: >> > Quoting Mahesh Bandewar (महेश बंडेवार) (mahe...@google.com): >> >> On Mon, Jan 8, 2018 at 7:47 AM, Serge E. Hallyn

Re: [PATCHv3 0/2] capability controlled user-namespaces

2018-01-08 Thread Serge E. Hallyn
Quoting Mahesh Bandewar (महेश बंडेवार) (mahe...@google.com): > On Mon, Jan 8, 2018 at 10:11 AM, Serge E. Hallyn wrote: > > Quoting Mahesh Bandewar (महेश बंडेवार) (mahe...@google.com): > >> On Mon, Jan 8, 2018 at 7:47 AM, Serge E. Hallyn wrote: > >> > Quoting James Morris (james.l.mor...@oracle.co

Re: [PATCHv3 0/2] capability controlled user-namespaces

2018-01-08 Thread महेश बंडेवार
On Mon, Jan 8, 2018 at 10:11 AM, Serge E. Hallyn wrote: > Quoting Mahesh Bandewar (महेश बंडेवार) (mahe...@google.com): >> On Mon, Jan 8, 2018 at 7:47 AM, Serge E. Hallyn wrote: >> > Quoting James Morris (james.l.mor...@oracle.com): >> >> On Mon, 8 Jan 2018, Serge E. Hallyn wrote: >> >> I meant in

Re: [PATCHv3 0/2] capability controlled user-namespaces

2018-01-08 Thread Serge E. Hallyn
Quoting Mahesh Bandewar (महेश बंडेवार) (mahe...@google.com): > On Mon, Jan 8, 2018 at 7:47 AM, Serge E. Hallyn wrote: > > Quoting James Morris (james.l.mor...@oracle.com): > >> On Mon, 8 Jan 2018, Serge E. Hallyn wrote: > >> I meant in terms of "marking" a user ns as "controlled" type -- it's > >>

Re: [PATCHv3 0/2] capability controlled user-namespaces

2018-01-08 Thread महेश बंडेवार
On Mon, Jan 8, 2018 at 7:47 AM, Serge E. Hallyn wrote: > Quoting James Morris (james.l.mor...@oracle.com): >> On Mon, 8 Jan 2018, Serge E. Hallyn wrote: >> >> > > Also, why do we need the concept of a controlled user-ns at all, if the >> > > default whitelist maintains existing behavior? >> > >> >

Re: [PATCHv3 0/2] capability controlled user-namespaces

2018-01-08 Thread Serge E. Hallyn
Quoting James Morris (james.l.mor...@oracle.com): > On Mon, 8 Jan 2018, Serge E. Hallyn wrote: > > > > Also, why do we need the concept of a controlled user-ns at all, if the > > > default whitelist maintains existing behavior? > > > > In past discussions two uses have been brought up: > > > >

Re: [PATCHv3 0/2] capability controlled user-namespaces

2018-01-07 Thread Serge E. Hallyn
On Mon, Jan 08, 2018 at 11:35:26AM +1100, James Morris wrote: > On Tue, 2 Jan 2018, Mahesh Bandewar (महेश बंडेवार) wrote: > > > On Sat, Dec 30, 2017 at 12:31 AM, James Morris > > wrote: > > > On Wed, 27 Dec 2017, Mahesh Bandewar (महेश बंडेवार) wrote: > > > > > >> Hello James, > > >> > > >> Seems

Re: [PATCHv3 0/2] capability controlled user-namespaces

2018-01-02 Thread महेश बंडेवार
Hello Michael, I really don't want to turn this into how-to-hack guide but I do see few points in your argument to make the case clearer. Please see the comments inline. On Sat, Dec 30, 2017 at 12:50 AM, Michael Kerrisk (man-pages) wrote: > Hello Mahesh, > > On 12/28/2017 01:45 AM, Mahesh Bandew

Re: [PATCHv3 0/2] capability controlled user-namespaces

2018-01-02 Thread महेश बंडेवार
On Sat, Dec 30, 2017 at 12:31 AM, James Morris wrote: > On Wed, 27 Dec 2017, Mahesh Bandewar (महेश बंडेवार) wrote: > >> Hello James, >> >> Seems like I missed your name to be added into the review of this >> patch series. Would you be willing be pull this into the security >> tree? Serge Hallyn ha

Re: [PATCHv3 0/2] capability controlled user-namespaces

2017-12-30 Thread Michael Kerrisk (man-pages)
Hello Mahesh, On 12/28/2017 01:45 AM, Mahesh Bandewar (महेश बंडेवार) wrote: > On Wed, Dec 27, 2017 at 12:23 PM, Michael Kerrisk (man-pages) > wrote: >> Hello Mahesh, >> >> On 27 December 2017 at 18:09, Mahesh Bandewar (महेश बंडेवार) >> wrote: >>> Hello James, >>> >>> Seems like I missed your nam

Re: [PATCHv3 0/2] capability controlled user-namespaces

2017-12-27 Thread महेश बंडेवार
On Wed, Dec 27, 2017 at 12:23 PM, Michael Kerrisk (man-pages) wrote: > Hello Mahesh, > > On 27 December 2017 at 18:09, Mahesh Bandewar (महेश बंडेवार) > wrote: >> Hello James, >> >> Seems like I missed your name to be added into the review of this >> patch series. Would you be willing be pull this

Re: [PATCHv3 0/2] capability controlled user-namespaces

2017-12-27 Thread Michael Kerrisk (man-pages)
Hello Mahesh, On 27 December 2017 at 18:09, Mahesh Bandewar (महेश बंडेवार) wrote: > Hello James, > > Seems like I missed your name to be added into the review of this > patch series. Would you be willing be pull this into the security > tree? Serge Hallyn has already ACKed it. We seem to have no

Re: [PATCHv3 0/2] capability controlled user-namespaces

2017-12-27 Thread महेश बंडेवार
Hello James, Seems like I missed your name to be added into the review of this patch series. Would you be willing be pull this into the security tree? Serge Hallyn has already ACKed it. Thanks, --mahesh.. On Tue, Dec 5, 2017 at 2:30 PM, Mahesh Bandewar wrote: > From: Mahesh Bandewar > > TL;DR

[PATCHv3 0/2] capability controlled user-namespaces

2017-12-05 Thread Mahesh Bandewar
From: Mahesh Bandewar TL;DR version - Creating a sandbox environment with namespaces is challenging considering what these sandboxed processes can engage into. e.g. CVE-2017-6074, CVE-2017-7184, CVE-2017-7308 etc. just to name few. Current form of user-namespaces, however, if changed