On Wed, May 04, 2016 at 04:26:46PM +0200, Djalal Harouni wrote: > This is version 2 of the VFS:userns support portable root filesystems > RFC. Changes since version 1: > > * Update documentation and remove some ambiguity about the feature. > Based on Josh Triplett comments. > * Use a new email address to send the RFC :-) > > > This RFC tries to explore how to support filesystem operations inside > user namespace using only VFS and a per mount namespace solution. This > allows to take advantage of user namespace separations without > introducing any change at the filesystems level. All this is handled > with the virtual view of mount namespaces. [...] > As an example if the mapping 0:65535 inside mount namespace and outside > is 1000000:1065536, then 0:65535 will be the range that we use to > construct UIDs/GIDs mapping into init_user_ns and use it for on-disk > data. They represent the persistent values that we want to write to the > disk. Therefore, we don't keep track of any UID/GID shift that was applied > before, it gives portability and allows to use the previous mapping > which was freed for another root filesystem... So let me get this straight. Two /isolated/ containers, different UID/GID mappings, sharing the same files and directories. Create a new file in a writeable directory in container 1, namespace information gets stripped from on-disk uid/gid representation. Container 2 then reads that shared directory, finds the file written by container 1. As there is no no namespace component to the uid:gid stored in the inode, we apply the current namespace shift to the VFS inode uid/gid and so it maps to root in container 2 and we are allowed to read it? Unless I've misunderstood something in this crazy mapping scheme, isn't this just a vector for unintentional containment breaches? [...] > Simple demo overlayfs, and btrfs mounted with vfs_shift_uids and > vfs_shift_gids. The overlayfs mounts will share the same upperdir. We > create two user namesapces every one with its own mapping and where > container-uid-2000000 will pull changes from container-uid-1000000 > upperdir automatically. Ok, forget I asked - it's clearly intentional. This is beyond crazy, IMO. > 3) ROADMAP: > =========== > * Confirm current design, and make sure that the mapping is done > correctly. How are you going to ensure that all filesystems behave the same, and it doesn't get broken by people who really don't care about this sort of crazy? FWIW, having the VFS convert things to "on-disk format" is an oxymoron - the "V" in VFS means "virtual" and has nothing to do with disks or persistent storage formats. Indeed, let's convert the UID to "on-disk" format for a network filesystem client.... ..... > * Add XFS support. What is the problem here? Next question: how does this work with uid/gid based quotas? Cheers, Dave. -- Dave Chinner david@xxxxxxxxxxxxx -- To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
