Messages in this thread |  | | From | (Eric W. Biederman) | Date | Sat, 29 Apr 2017 23:42:17 -0500 | Subject | Re: [PATCH] userns,pidns: Verify the userns for new pid namespaces |
| |
ebiederm@xmission.com (Eric W. Biederman) writes:
> "Serge E. Hallyn" <serge@hallyn.com> writes: > >> Quoting Eric W. Biederman (ebiederm@xmission.com): >>> >>> It is pointless and confusing to allow a pid namespace hierarchy and >>> the user namespace hierarchy to get out of sync. The owner of a child >>> pid namespace should be the owner of the parent pid namespace or >>> a descendant of the owner of the parent pid namespace. >>> >>> Otherwise it is possible to construct scenarios where it is legal to >>> do something in a parent pid namespace but in a child pid namespace. >> >> Hi, >> >> did you mean 'but not in a child...' above? > > Actually I believe I meant: > >>> Otherwise it is possible to construct scenarios where it is not legal >>> to do something in a parent pid namespace but it is legal a child pid >>> namespace. > > I definitely need to fix that wording thank you.
Looking at some more I mean:
Otherwise it is possible to construct scenarios where a process has a capability in a over a parent pid namespace but does not have the capability over a child pid namespace. Which confusingly makes permission checks non-transitive.
Eric
|  |