From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: passt.top; dmarc=fail (p=quarantine dis=none) header.from=redhat.com Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by passt.top (Postfix) with ESMTPS id 6A6FB5A0265 for ; Wed, 21 Oct 2026 02:48:34 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1792543713; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=wLqa/yTAxzQu3gtN2mNxD8QufkRn7ZkgLUE54CYwcrE=; b=PjTjWApO+LW7qeJYQooJHgTZi0LX4BVwdiVEkojMQ8RbclhqJZo+RdvSTJnE5jagyXcA3R 2fv11vJL1VuYJvlKcTGSzxsthc73bIOWWc/jI2/pnjkeMbMD4krjbnOGFlQ99USepVDtdH QjacyNFYwBgewVNlyifsJeZ9hQEoLJE= Received: from mail-wm1-f72.google.com (mail-wm1-f72.google.com [209.85.128.72]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-627-CeKYgCToNIOy63xzMAK-fg-1; Wed, 21 Oct 2026 00:48:31 +0000 X-MC-Unique: CeKYgCToNIOy63xzMAK-fg-1 X-Mimecast-MFC-AGG-ID: CeKYgCToNIOy63xzMAK-fg_1792543711 Received: by mail-wm1-f72.google.com with SMTP id 5b1f17b1804b1-4a01d1fb07bso1865845e9.2 for ; Tue, 20 Oct 2026 17:48:31 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792543710; x=1793148510; h=date:content-transfer-encoding:content-type:mime-version :organization:references:in-reply-to:message-id:subject:cc:to:from :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to:content-type; bh=wLqa/yTAxzQu3gtN2mNxD8QufkRn7ZkgLUE54CYwcrE=; b=La5ELXtG7p0dffuXafdKFdX8COEp+w08sThUPKKdNzn7qjiy/Odn5N39opIN99DiKy b/q7fnJBk/kR84NW7mrfJPGVavOsGOd3mtqjzILLmGpVhzRemrOCXPReQY7p9452EPEo PYNxLOFaKXpzJ94cXfdKSjltW1V2uKwRiB7Z+Pp4YhnQHoaoulq9EPDJv14UVAzbq4o6 zvqyoecsfBTRWObA31gCEBOxHCAsBZrCzN8GYXa3S4WDQTCgisDTDrPWu+ArokSPU2sB BOT9si1ajGxFb3jusFzrp0Xri9qOZW+VbnNIsSZU6SgJ8vqlxY9FymibCO1GrYecmbin QP4g== X-Forwarded-Encrypted: i=1; AKwUvBz+x0ZnN5h9MX248EzLkrHevGwFoobm0u1hxkfuSQ7tVRU3RWgcu8Ztz5TZP4S+lMb/jeRn63j1fTs=@passt.top X-Gm-Message-State: AFq9FYLLa9Gy4M6gHbntgAIfKr7bnjxpfsnAPGIgnzsloPWaYlXnzOXJ 3cIjO2n4XmPs+SCUGv+c4OZlqCjy3fBftRMPYqiF3GhD1aLJ8gZu4znEVNO16iEtqbL2kml7ajn HteOI8NL+go9LMrlGoqSVIbSy/6eGopmml72313lVc3fR6bV/co5DPA== X-Gm-Gg: AYBFou1jEVGutQWSIiuCSdxwQi1ZRw3Du0ugjZYVZncdO4D5yfuY/LRsx1+9WjRDOwc S6o4anYAjNmg45knb6R54SXVjnD/kUgFxSo5yFFb8l49UPixD9vxcYNGQ1q8D8zoTT9F5n9+r59 X6tP4hEvBb5JJAxC/dDj5ImM/aUE9S9IyhkspCY3aoR0n+KUm6NSjt5m1CoCJdmyUHZIpLkEK1t pf+yOtiBo73HEsg8rLL6DPGwshpPM4+C5BfH6Le5gbari57SWX06iwZyAMjWryWvUkcG0D9CP75 K1WwxKj3Yyg+ORfWYdc58gqw4si+Wrsp+zTGGYkEi+tdu4YsX4PUNXWOyNIcG6LtnqarT8gd1ZG ai2uOPDuUWg== X-Received: by 2002:a05:600c:e555:10b0:4a1:e284:21a with SMTP id 5b1f17b1804b1-4a1fdb1c4f3mr4340855e9.24.1792543710527; Tue, 20 Oct 2026 17:48:30 -0700 (PDT) X-Received: by 2002:a05:600c:e555:10b0:4a1:e284:21a with SMTP id 5b1f17b1804b1-4a1fdb1c4f3mr4340695e9.24.1792543710032; Tue, 20 Oct 2026 17:48:30 -0700 (PDT) Received: from maya.myfinge.rs (ifcgrfdd.trafficplex.cloud. [2a10:fc81:a806:d6a9::1]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4a1fb83ff0dsm45180235e9.7.2026.10.20.17.48.29 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 20 Oct 2026 17:48:29 -0700 (PDT) From: Stefano Brivio To: "Lawrence, Richard E" Subject: Re: [PATCH v2] feat: Pass open files to child in pasta mode Message-ID: <20261021024828.7bfcf35e@elisabeth> In-Reply-To: References: <20260731132601.422518-1-rlawrence@tamu.edu> <20260806235422.5d6d8fd3@elisabeth> Organization: Red Hat X-Mailer: Claws Mail 4.2.0 (GTK 3.24.49; x86_64-pc-linux-gnu) MIME-Version: 1.0 Date: Wed, 21 Oct 2026 02:48:28 +0200 (CEST) X-Mimecast-Spam-Score: 0 X-Mimecast-MFC-PROC-ID: Yy5oEvBAAQ8A6KUbCtFnWSDaU5ZTjuQ3nYPM6tgNWic_1792543711 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Message-ID-Hash: IXKSQB7DXDXXNZ6YFDKEXY3ORJZ3IGAC X-Message-ID-Hash: IXKSQB7DXDXXNZ6YFDKEXY3ORJZ3IGAC X-MailFrom: sbrivio@redhat.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: David Gibson , "passt-dev@passt.top" X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Richard, On Fri, 14 Aug 2026 18:12:56 +0000 "Lawrence, Richard E" wrote: > Howdy Stefano, David, > > I don't understand the plan. Are you waiting on me? Am I waiting on you? > > I could implement any of these ideas, but I don't wish to implement **all** of them. Can we reach a consensus? Sorry for the extremely long delay here. I think at this point there are no moving parts in isolation.c and surroundings, and we could go back to one of those ideas. None of the reworks that occurred meanwhile would seem to make ideas based on partial close_ranges() or reading out procfs entries (as your v2 does) any easier. My two proposals (wrapper around open() maintaining an array of files we shouldn't close, or having all open files in a specific struct / array can check easily) weren't made any easier either. At this point I would be inclined to suggest something like your ealier v3 adding a specific configuration option. To somewhat retain as much as possible of the original security benefits, we could explicitly limit that to the case where pasta(1) spawns another command, because the only use case where we have any evidence of this need is starting Bubblewrap from pasta's command line. I'm sorry this wait hasn't been particularly productive but at some point it looked like we could introduce a easy way to defer closing files so that the command spawned by pasta could simply inherit them unconditionally. That doesn't seem to be the case though. Let me know if you need any help in reviving your earlier v3, or if you need any support with anything related. -- Stefano