On Thursday 24 May 2007 20:40, Al Viro wrote: > On Thu, May 24, 2007 at 08:10:00PM +0200, Andreas Gruenbacher wrote: > > > Read it like this: we don't have a good idea how to support multiple > > namespaces so far. Currently, we interpret all pathnames relative to the > > namespace a process is in. Confined processes don't have the privilege to > > create or manipulate namespaces, which makes this safe. We may find a > > better future solution. > > You also don't have a solution for multiple chroot jails, since they > often have the same fs mounted in many places on given box *and* since > the pathnames from the confined processes' POVs have fsck-all to do > with each other. > > It's really not kinder than multiple namespaces as far as your approach > is concerned. Well, the pathnames we check against are namespace relative, so no matter what pathnames the chrooted processes think they are looking at, we always know the actual pathnames up to ``outside the chroot''. Having the same filesystem mounted in multiple chroots or in multiple locations in the same chroot doesn't matter. The main problem I see when it comes to defining per-namespace policy is that namespaces are inherently anonymous, and there is no obvious way of associating different sets of profiles with different namespaces. Implementing something to also handle multiple namespaces doesn't seem hard -- after all, it's not such a difficult concept -- but I don't have a good enough idea what would work best. Thanks, Andreas - To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
