Re: [CRIU] Introspecting userns relationships to other namespaces?
From: Eric W. Biederman
Date: Fri Jul 08 2016 - 20:04:48 EST
James Bottomley <James.Bottomley@xxxxxxxxxxxxxxxxxxxxx> writes:
> On July 8, 2016 1:38:19 PM PDT, Andrew Vagin <avagin@xxxxxxxxxxxxx> wrote:
>>What do you think about the idea to mount nsfs and be able to look up
>>any alive namespace by inum:
> I think I like it. It will give us a way to enter any extant
> namespace. It will work for Eric's fs namespaces as well. Perhaps a
> /process/ns/<inum> Directory?
That makes it very easy to bypass any existing controls that exist for
getting at namespaces. It is true that everything of that kind is
directory based but still.
Plus I think it would serve as information leak to information outside
of the container.
An operation to get a user namespace file descriptor from some kernel
object sounds reasonably sane.
A great big list of things sounds about as scary as it can get. This is
not the time to be making it easier to escape from containers.