Messages in this thread | | | Date | Fri, 15 Feb 2013 12:00:52 -0500 | From | "J. Bruce Fields" <> | Subject | Re: [PATCH review 52/85] sunrpc: Properly encode kuids and kgids in auth.unix.gid rpc pipe upcalls. |
| |
On Wed, Feb 13, 2013 at 03:22:32PM -0800, Eric W. Biederman wrote: > "J. Bruce Fields" <bfields@fieldses.org> writes: > > > On Wed, Feb 13, 2013 at 02:32:29PM -0800, Eric W. Biederman wrote: > >> Now looking at the nfs server, seems to be hard coded to only start > >> in the initial network namespace despite almost having support for > >> starting in more. > > > > Right, Stanislav's got 4 more patches that should finish the job; see > > http://mid.gmane.org/<20130201125210.3257.46454.stgit@localhost.localdomain> > > and followups. That should make it for 3.9, I just need to review > > them.... > > Ok that is interesting. > > There is an interesting corner case here where an unprivileged user > can create a user namespace and then can create a network namespace. > Depending on how we interpret things when Stanislaves patches reach > there we might have to add: > > if (net->user_ns != &init_user_ns) > -EINVAL > > Somewhere appropriate.
I'm assuming that's something that's needed only in kernels that have *both* Stanislav's patches and yours.
I've committed his patches to
git://linux-nfs.org/~bfields/linux.git for-3.9
which should also get pulled into next. Let me know if there's another patch I should take.
> I am a touch concerned about /proc/fs/nfsd/exports after my patches > and Stanislavs patches both come in. As I think that will allow for > cases where net->user_ns != &init_userns. But we can cross that bridge > when we come to it.
OK, let me know of anything I can do to make your life easier....
--b.
| |