Quoting Daniel Lezcano (daniel.lezcano@xxxxxxx): > On 08/12/2011 06:29 PM, Serge Hallyn wrote: > > Quoting Daniel Lezcano (daniel.lezcano@xxxxxxx): > > ... > >>> Doesn't this mean that an unprivileged task in a container can shut > >>> down the container? > >> Ha ha ! Right, good catch :) > >> > >> Yes, rethinking about it, we can do what initially proposed Bruno by > >> just preventing to reboot when we are not in the init_pid_ns. Actually, > >> the sys_reboot occurs after the services shutdown and "kill -1 SIGTERM" > >> and "kill -1 SIGKILL", and would not make sense to do that in a child > >> pid namespace, except if we are in a container where we don't want to > >> reboot :) > >> > >> So IMO, it is safe to do: > >> > >> if (!ns_capable(current_pid_ns()->user_ns, CAP_SYS_BOOT)) > >> return -EPERM; > >> > >> if (pid_ns != &init_pid_ns) > >> return pid_namespace_reboot(pid_ns, cmd, buffer); > > So I don't know if you want to prepend > > http://kernel.ubuntu.com/git?p=serge/linux-syslogns.git;a=commit;h=63556e9a39bcd75ec4a88333425800905013c73e > > to your patchset, or just check nsown_capable(CAP_SYS_BOOT) for now, > > but as soon as you resend with that I'll happily, nay, > > ecstatically ack. > > Ok, in order to not mix the functionnalities, I will send in a separate > patch the nsown_capable change. Actually the nsown_capable was a temp hack fix anyway, for a problem we don't actually have. I forgot you are not using user namespaces yet anyway. So you can just leave it as if (!capable(CAP_SYS_BOOT)) return -EPERM; for now. Since you're root in the init user namespace, that'll pass (as soon as you don't drop it from bounding set of course) thanks, -serge _______________________________________________ Containers mailing list Containers@xxxxxxxxxxxxxxxxxxxxxxxxxx https://lists.linux-foundation.org/mailman/listinfo/containers
