From: David Gibson <david@gibson.dropbear.id.au>
To: passt-dev@passt.top
Subject: [PATCH 00/10] Clean up handling of userns
Date: Wed, 07 Sep 2022 11:44:59 +1000 [thread overview]
Message-ID: <20220907014509.3480812-1-david@gibson.dropbear.id.au> (raw)
[-- Attachment #1: Type: text/plain, Size: 1480 bytes --]
Our handling of user namespaces is more complex than it needs to be.
This simplifies the handling by identifying and entering (or creating)
the correct userns earlier, so that later code doesn't need to deal
with it any more.
Along the way we make a number of other cleanups to handling of userns
and setting our user and group.
This is based on my earlier test command dispatch and performance test
cleanup series.
David Gibson (10):
Don't store UID & GID persistently in the context structure
Split checking for root from dropping root privilege
Consolidate determination of UID/GID to run as
Safer handling if we can't open /proc/self/uid_map
Move self-isolation code into a separate file
Consolidate validation of pasta namespace options
Clean up and rename conf_ns_open()
Correctly handle --netns-only in pasta_start_ns()
Handle userns isolation and dropping root at the same time
Allow --userns when pasta spawns a command
Makefile | 8 +-
conf.c | 236 ++++++++++++++++++++++++++--------------------------
isolation.c | 209 ++++++++++++++++++++++++++++++++++++++++++++++
isolation.h | 15 ++++
passt.1 | 5 +-
passt.c | 117 +-------------------------
passt.h | 9 --
pasta.c | 91 ++++++++++++--------
pasta.h | 1 +
util.c | 84 -------------------
util.h | 2 -
11 files changed, 411 insertions(+), 366 deletions(-)
create mode 100644 isolation.c
create mode 100644 isolation.h
--
2.37.3
next reply other threads:[~2022-09-07 1:44 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-09-07 1:44 David Gibson [this message]
2022-09-07 1:45 ` [PATCH 01/10] Don't store UID & GID persistently in the context structure David Gibson
2022-09-07 1:45 ` [PATCH 02/10] Split checking for root from dropping root privilege David Gibson
2022-09-07 1:45 ` [PATCH 03/10] Consolidate determination of UID/GID to run as David Gibson
2022-09-07 1:45 ` [PATCH 04/10] Safer handling if we can't open /proc/self/uid_map David Gibson
2022-09-07 1:45 ` [PATCH 05/10] Move self-isolation code into a separate file David Gibson
2022-09-07 1:45 ` [PATCH 06/10] Consolidate validation of pasta namespace options David Gibson
2022-09-07 1:45 ` [PATCH 07/10] Clean up and rename conf_ns_open() David Gibson
2022-09-07 1:45 ` [PATCH 08/10] Correctly handle --netns-only in pasta_start_ns() David Gibson
2022-09-07 1:45 ` [PATCH 09/10] Handle userns isolation and dropping root at the same time David Gibson
2022-09-07 1:45 ` [PATCH 10/10] Allow --userns when pasta spawns a command David Gibson
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220907014509.3480812-1-david@gibson.dropbear.id.au \
--to=david@gibson.dropbear.id.au \
--cc=passt-dev@passt.top \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://passt.top/passt
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for IMAP folder(s).