lkml.org 
[lkml]   [2014]   [Sep]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: For review: user_namespace(7) man page
    On 09/11/2014 08:14 AM, Andy Lutomirski wrote:
    > On Thu, Sep 11, 2014 at 7:46 AM, Michael Kerrisk (man-pages)
    > <mtk.manpages@gmail.com> wrote:
    >> Hi Eric,
    >>
    >> On 09/09/2014 09:05 AM, Eric W. Biederman wrote:
    >>> "Michael Kerrisk (man-pages)" <mtk.manpages@gmail.com> writes:
    >>>
    >>>> Hi Andy, and Eric,
    >>>>>> 1. The writing process must have the CAP_SETUID (CAP_SETGID)
    >>>>>> capability in the user namespace of the process pid.
    >>>>>
    >>>>> This checked for the opening process (and I don't actually remember
    >>>>> whether it's checked for the writing process).
    >>>>
    >>>> Eric, can you comment?
    >>>
    >>> We have to check for the opening processes and that changes was made
    >>> after I implemented my interface. Pieces of the code appear to also
    >>> examine the writing process and verify everything applies to it as well.
    >>>
    >>> I goofed when I designed the interface originall and had not realized
    >>> what a classic design error it can be to not restrict by the opening
    >>> process.
    >>
    >> So, I still need some help here. Should the sentence above just read:
    >>
    >> 1. The *opening* process must have the CAP_SETUID (CAP_SETGID)
    >> capability in the user namespace of the process pid.
    >
    > I think this is sufficient.
    >
    >>
    >> or must something also be said about the writing process? (If so, i'd
    >> appreciate a completely formed sentence or two that I can just drop into
    >> the man page..)
    >
    > There might be a restriction there, too, but I think it could be
    > removed, and I also think that it's unlikely that anyone will
    > encounter it.

    Okay. Thanks, Andy.

    Cheers,

    Michael


    --
    Michael Kerrisk
    Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/
    Linux/UNIX System Programming Training: http://man7.org/training/


    \
     
     \ /
      Last update: 2014-09-14 05:21    [W:3.942 / U:0.208 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site