On Thu, Jul 07, 2016 at 10:26:50PM -0700, W. Trevor King wrote: > And if you want to put that whole ancestor tree in fdinfo, you have > to come up with some way to handle the two-parent branching. Going towards the roots is nice, because you know a given namespace will only have two parents, but it leaks information about the system into the container. It's probably better to follow the NStgid, etc. example and only walk toward the leaves. So a (privileged?) process in the root namespace could see the whole tree, while a process in non-root namespaces could only see their namespaces and descendants. In situations where you were part of a namespace that belonged to an external user namespace (e.g. you nsenter a child user namespace but are still in the root PID namespace), you'd want an “unknown” entry for the parent you couldn't see. Cheers, Trevor -- This email may be signed or encrypted with GnuPG (http://www.gnupg.org). For more information, see http://en.wikipedia.org/wiki/Pretty_Good_Privacy
Attachment:
signature.asc
Description: OpenPGP digital signature
