Messages in this thread | | | Subject | Re: RFC: Multiple instances of kernel namespaces. | From | (Eric W. Biederman) | Date | Thu, 26 Jan 2006 13:13:45 -0700 |
| |
Herbert Poetzl <herbert@13thfloor.at> writes:
> On Sat, Jan 21, 2006 at 03:04:16AM -0700, Eric W. Biederman wrote: >> So in the simple case I have names like: >> 1178/1632 > > which is a new namespace in itself, but it doesn't matter > as long as it uniquely and persistently identifies the > namespace for the time it exists ... just leaves the > question how to retrieve a list of all namespaces :)
Yes but the name of the namespace is still in the original pid namespace. And more importantly to me it isn't a new kind of namespace.
>> If I want a guest that can keep secrets from the host sysadmin I don't >> want transitioning into a guest namespace to come too easily. > > which can easily be achieved by 'marking' the namespace > as private and/or applying certain rules/checks to the > 'enter' procedure ...
Right. The trick here is that you must be able to deny transitioning into a namespace from the inside the namespace. Or else a guest could never trust it. Something one of my coworkers pointed out to me.
Eric - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |