[Devel] Re: [PATCH 0/3] keys: play nicely with user namespaces

[Serge E. Hallyn]

Quoting David Howells (dhowells at redhat.com):
> Serge E. Hallyn <serue at us.ibm.com> wrote:
> 
> > Cool, thanks.  I needed the following change to toolbox.inc.sh.orig in
> > order to be able to run with >1 user namespaces:
> > 
> > 36c36
> > < maxsquota=`grep '^ *0': /proc/key-users | sed s at .*/@@`
> > ---
> > > maxsquota=`grep '^ *0': /proc/key-users | sed s at .*/@@ | head -1`
> > 
> > since /proc/key-users then lists multiple entries.  Otherwise,
> > all tests pass when running the testsuite in a child-user-ns.
> 
> Should you only get key-users from the set of users in your namespace, I
> wonder?
> 
> David

Yup - patch coming (probably next week) for that, but there's the
question, given that user namespaces are hierarchical, of whether,
if pidns B is a child of pidns A created by userid 500, a task in
pidns A should see keys in userns B (listed as belonging to userid
500).

-serge
_______________________________________________
Containers mailing list
Containers at lists.linux-foundation.org
https://lists.linux-foundation.org/mailman/listinfo/containers