lkml.org 
[lkml]   [2022]   [Aug]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRe: [PATCH v5 0/4] Introduce security_create_user_ns()
Paul Moore <paul@paul-moore.com> writes:

> At the end of the v4 patchset I suggested merging this into lsm/next
> so it could get a full -rc cycle in linux-next, assuming no issues
> were uncovered during testing

What in the world can be uncovered in linux-next for code that has no in
tree users.

That is one of my largest problems. I want to talk about the users and
the use cases and I don't get dialog. Nor do I get hey look back there
you missed it.

Since you don't want to rehash this. I will just repeat my conclusion
that the patchset appears to introduce an ineffective defense that will
achieve nothing in the defense of the kernel, and so all it will achieve
a code maintenance burden and to occasionally break legitimate users of
the user namespace.

Further the process is broken. You are changing the semantics of an
operation with the introduction of a security hook. That needs a
man-page and discussion on linux-abi. In general of the scrutiny we
give to new systems and changed system calls. As this change
fundamentally changes the semantics of creating a user namespace.

Skipping that part of the process is not simply disagree that is being
irresponsible.

Eric

\
 
 \ /
  Last update: 2022-08-17 21:59    [W:0.481 / U:0.144 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site