From: Stefano Brivio <sbrivio@redhat.com>
To: David Gibson <david@gibson.dropbear.id.au>
Cc: passt-dev@passt.top
Subject: Re: [PATCH 00/10] Fixes and cleanups for capability handling
Date: Thu, 13 Oct 2022 04:44:23 +0200 [thread overview]
Message-ID: <20221013044423.2fc0d429@elisabeth> (raw)
In-Reply-To: <20221011054018.1449506-1-david@gibson.dropbear.id.au>
On Tue, 11 Oct 2022 16:40:08 +1100
David Gibson <david@gibson.dropbear.id.au> wrote:
> Our current handling of capabilities isn't quite right. In
> particular, drop_caps() attempts to remove capabilities from the
> bounding set, which usually won't work, and even if it does won't have
> the effect we want.
>
> This series corrects that, as well as making some other fixes and
> cleanups in adjacent code.
Other than those entirely formal details I reported (...and I tried
hard), this looks great to me, and feels like a relief. :)
--
Stefano
prev parent reply other threads:[~2022-10-13 2:44 UTC|newest]
Thread overview: 33+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-10-11 5:40 [PATCH 00/10] Fixes and cleanups for capability handling David Gibson
2022-10-11 5:40 ` [PATCH 01/10] test: Move slower tests to end of test run David Gibson
2022-10-11 5:40 ` [PATCH 02/10] pasta: More general way of starting spawned shell as a login shell David Gibson
2022-10-13 2:16 ` Stefano Brivio
2022-10-13 8:22 ` David Gibson
2022-10-13 9:48 ` Stefano Brivio
2022-10-13 23:24 ` David Gibson
2022-10-11 5:40 ` [PATCH 03/10] pasta_start_ns() always ends in parent context David Gibson
2022-10-11 5:40 ` [PATCH 04/10] Remove unhelpful drop_caps() call in pasta_start_ns() David Gibson
2022-10-11 5:40 ` [PATCH 05/10] Clarify various self-isolation steps David Gibson
2022-10-13 2:17 ` Stefano Brivio
2022-10-13 8:31 ` David Gibson
2022-10-13 12:49 ` Stefano Brivio
2022-10-13 23:25 ` David Gibson
2022-10-11 5:40 ` [PATCH 06/10] Replace FWRITE with a function David Gibson
2022-10-13 2:17 ` Stefano Brivio
2022-10-13 8:51 ` David Gibson
2022-10-11 5:40 ` [PATCH 07/10] isolation: Replace drop_caps() with a version that actually does something David Gibson
2022-10-13 2:18 ` Stefano Brivio
2022-10-13 9:44 ` David Gibson
2022-10-13 4:01 ` Stefano Brivio
2022-10-13 13:08 ` Stefano Brivio
2022-10-13 16:37 ` Stefano Brivio
2022-10-13 23:42 ` David Gibson
2022-10-11 5:40 ` [PATCH 08/10] isolation: Prevent any child processes gaining capabilities David Gibson
2022-10-13 2:17 ` Stefano Brivio
2022-10-13 9:33 ` David Gibson
2022-10-13 9:50 ` Stefano Brivio
2022-10-11 5:40 ` [PATCH 09/10] isolation: Only configure UID/GID mappings in userns when spawning shell David Gibson
2022-10-13 2:18 ` Stefano Brivio
2022-10-13 9:36 ` David Gibson
2022-10-11 5:40 ` [PATCH 10/10] Rename pasta_setup_ns() to pasta_spawn_cmd() David Gibson
2022-10-13 2:44 ` Stefano Brivio [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20221013044423.2fc0d429@elisabeth \
--to=sbrivio@redhat.com \
--cc=david@gibson.dropbear.id.au \
--cc=passt-dev@passt.top \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://passt.top/passt
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for IMAP folder(s).