[Devel] Re: [PATCH 1/3] Make cr_may_checkpoint_task() check each namespace individually

[Serge E. Hallyn]

Quoting Dan Smith (danms at us.ibm.com):
> Cc: orenl at cs.columbia.edu
> Signed-off-by: Dan Smith <danms at us.ibm.com>

Acked-by: Serge Hallyn <serue at us.ibm.com>

> ---
>  checkpoint/checkpoint.c |   15 +++++++++++++--
>  1 files changed, 13 insertions(+), 2 deletions(-)
> 
> diff --git a/checkpoint/checkpoint.c b/checkpoint/checkpoint.c
> index ef35754..c2f0e16 100644
> --- a/checkpoint/checkpoint.c
> +++ b/checkpoint/checkpoint.c
> @@ -302,8 +302,19 @@ static int cr_may_checkpoint_task(struct task_struct *t, struct cr_ctx *ctx)
>  	if (t != current && !frozen(t))
>  		return -EBUSY;
> 
> -	/* FIXME: change this for nested containers */
> -	if (task_nsproxy(t) != ctx->root_nsproxy)
> +	if (task_nsproxy(t)->uts_ns != ctx->root_nsproxy->uts_ns)
> +		return -EPERM;
> +
> +	if (task_nsproxy(t)->ipc_ns != ctx->root_nsproxy->ipc_ns)
> +		return -EPERM;
> +
> +	if (task_nsproxy(t)->mnt_ns != ctx->root_nsproxy->mnt_ns)
> +		return -EPERM;
> +
> +	if (task_nsproxy(t)->pid_ns != ctx->root_nsproxy->pid_ns)
> +		return -EPERM;
> +
> +	if (task_nsproxy(t)->net_ns != ctx->root_nsproxy->net_ns)
>  		return -EPERM;
> 
>  	return 0;
> -- 
> 1.5.6.3
> 
> _______________________________________________
> Containers mailing list
> Containers at lists.linux-foundation.org
> https://lists.linux-foundation.org/mailman/listinfo/containers
_______________________________________________
Containers mailing list
Containers at lists.linux-foundation.org
https://lists.linux-foundation.org/mailman/listinfo/containers