Re: [PATCH] Documentation: cgroup: "unshare -C" to unshare cgroup namespace

2016-04-15 Thread Serge Hallyn
Quoting Josef Lusticky (jo...@lusticky.cz): > Use "unshare -C" to be consistent with the unshare utility from util-linux > > Signed-off-by: Josef Lusticky Thanks. Acked-by: Serge E. Hallyn > --- > Documentation/cgroup-v2.txt | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff -

Re: [PATCH 2/2] sysctl: allow CLONE_NEWUSER to be disabled

2016-01-22 Thread Serge Hallyn
Quoting Kees Cook (keesc...@chromium.org): > On Fri, Jan 22, 2016 at 2:55 PM, Robert Święcki wrote: > > 2016-01-22 23:50 GMT+01:00 Kees Cook : > > > >>> Seems that Debian and some older Ubuntu versions are already using > >>> > >>> $ sysctl -a | grep usern > >>> kernel.unprivileged_userns_clone =

Re: [PATCH 2/2] sysctl: allow CLONE_NEWUSER to be disabled

2016-01-22 Thread Serge Hallyn
Quoting Kees Cook (keesc...@chromium.org): > On Fri, Jan 22, 2016 at 2:55 PM, Robert Święcki wrote: > > 2016-01-22 23:50 GMT+01:00 Kees Cook : > > > >>> Seems that Debian and some older Ubuntu versions are already using > >>> > >>> $ sysctl -a | grep usern > >>> kernel.unprivileged_userns_clone =

Re: [kernel-hardening] Re: [PATCH 0/2] sysctl: allow CLONE_NEWUSER to be disabled

2016-01-25 Thread Serge Hallyn
Quoting Kees Cook (keesc...@chromium.org): > On Fri, Jan 22, 2016 at 7:02 PM, Eric W. Biederman > > So I have concerns about both efficacy and usability with the proposed > > sysctl. > > Two distros already have this sysctl because it was so strongly > requested by their users. This needs to be up

Re: [kernel-hardening] Re: [PATCH 0/2] sysctl: allow CLONE_NEWUSER to be disabled

2016-01-26 Thread Serge Hallyn
Quoting Josh Boyer (jwbo...@fedoraproject.org): > On Mon, Jan 25, 2016 at 11:57 PM, Eric W. Biederman > wrote: > > Kees Cook writes: > > > >> On Mon, Jan 25, 2016 at 11:33 AM, Eric W. Biederman > >> wrote: > >>> Kees Cook writes: > > Well, I don't know about less weird, but it would l

Re: [kernel-hardening] Re: [PATCH 0/2] sysctl: allow CLONE_NEWUSER to be disabled

2016-01-26 Thread Serge Hallyn
Quoting Josh Boyer (jwbo...@fedoraproject.org): > On Tue, Jan 26, 2016 at 9:46 AM, Austin S. Hemmelgarn > wrote: > > On 2016-01-26 09:38, Josh Boyer wrote: > >> > >> On Mon, Jan 25, 2016 at 11:57 PM, Eric W. Biederman > >> wrote: > >>> > >>> Kees Cook writes: > >>> > On Mon, Jan 25, 2016 at