Re: [PATCH] Use CAP_SYS_RESOURCE as magic for escaping user namespaces.

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Tue, May 7, 2013 at 8:10 PM, Serge E. Hallyn <serge@xxxxxxxxxx> wrote:

> Uh, I would say nack, and if you need this then a device
> namespace allowing you to 'pass' devices similarly to how you
> pass a physical nic to a child netns is a part of the answer.

Hmm, 'slight' issue is that it does not really exist and that ns
can not even be properly specified as functionality (we tried
that earlier didn't we - everyone had different opinion on what
that ns should really do).


> Your goals are not 100% clear to me.  What is it about a user
> namespace that you want?

I'm trying to experiment with a system that has init_ns size
of one tiny task and apart from that everything runs inside
containers. Because of this I need a way to elevate rights
of certain trusted applications inside user namespaces so
that they could operate against things requesting rights
from init ns.


-- 
Janne
_______________________________________________
Containers mailing list
Containers@xxxxxxxxxxxxxxxxxxxxxxxxxx
https://lists.linuxfoundation.org/mailman/listinfo/containers




[Index of Archives]     [Cgroups]     [Netdev]     [Linux Wireless]     [Kernel Newbies]     [Security]     [Linux for Hams]     [Netfilter]     [Bugtraq]     [Yosemite Forum]     [MIPS Linux]     [ARM Linux]     [Linux RAID]     [Linux Admin]     [Samba]

  Powered by Linux