On 09/24/2010 03:02 PM, Andrew Lutomirski wrote: > Eric W. Biederman wrote: >> Introduce file for manipulating namespaces and related syscalls. >> files: >> /proc/self/ns/<nstype> >> >> syscalls: >> int setns(unsigned long nstype, int fd); >> socketat(int nsfd, int family, int type, int protocol); >> > > How does security work? Are there different kinds of fd that give (say) pin-the-namespace permission, socketat permission, and setns permission? AFAICS, socketat, setns and "set netns by fd" only accept fd from /proc/<pid>/ns/<ns>. setns does : file = proc_ns_fget(fd); if (IS_ERR(file)) return PTR_ERR(file); proc_ns_fget checks if (file->f_op != &ns_file_operations) socketat and get_net_ns_by_fd: net = get_net_ns_by_fd(fd); this one calls proc_ns_fget. We have the guarantee here, the fd is resulting from an open of the file with the right permissions. Another way to pin the namespace, would be to mount --bind /proc/<pid>/ns/<ns> but we have to be root to do that ... _______________________________________________ Containers mailing list Containers@xxxxxxxxxxxxxxxxxxxxxxxxxx https://lists.linux-foundation.org/mailman/listinfo/containers
