Re: [PATCH 3/3] fork: unify and tighten up CLONE_NEWUSER/CLONE_NEWPID checks

2013-08-23 Thread Andy Lutomirski
On Fri, Aug 23, 2013 at 6:59 AM, Oleg Nesterov wrote: > On 08/22, Andy Lutomirski wrote: >> >> On Thu, Aug 22, 2013 at 11:32 AM, Oleg Nesterov wrote: >> > On 08/22, Andy Lutomirski wrote: >> >> >> >> On Thu, Aug 22, 2013 at 11:15 AM, Oleg Nesterov wrote: >> >> > >> >> > Yes. Before this patch do

Re: [PATCH 3/3] fork: unify and tighten up CLONE_NEWUSER/CLONE_NEWPID checks

2013-08-23 Thread Oleg Nesterov
On 08/22, Andy Lutomirski wrote: > > On Thu, Aug 22, 2013 at 11:32 AM, Oleg Nesterov wrote: > > On 08/22, Andy Lutomirski wrote: > >> > >> On Thu, Aug 22, 2013 at 11:15 AM, Oleg Nesterov wrote: > >> > > >> > Yes. Before this patch do_fork() did: > >> > > >> > if (clone_flags & (CLONE_NEWU

Re: [PATCH 3/3] fork: unify and tighten up CLONE_NEWUSER/CLONE_NEWPID checks

2013-08-22 Thread Andy Lutomirski
On Thu, Aug 22, 2013 at 11:32 AM, Oleg Nesterov wrote: > On 08/22, Andy Lutomirski wrote: >> >> On Thu, Aug 22, 2013 at 11:15 AM, Oleg Nesterov wrote: >> > >> > Yes. Before this patch do_fork() did: >> > >> > if (clone_flags & (CLONE_NEWUSER | CLONE_NEWPID)) { >> > if (clo

Re: [PATCH 3/3] fork: unify and tighten up CLONE_NEWUSER/CLONE_NEWPID checks

2013-08-22 Thread Oleg Nesterov
On 08/22, Andy Lutomirski wrote: > > On Thu, Aug 22, 2013 at 11:15 AM, Oleg Nesterov wrote: > > > > Yes. Before this patch do_fork() did: > > > > if (clone_flags & (CLONE_NEWUSER | CLONE_NEWPID)) { > > if (clone_flags & (CLONE_THREAD|CLONE_PARENT)) > >

Re: [PATCH 3/3] fork: unify and tighten up CLONE_NEWUSER/CLONE_NEWPID checks

2013-08-22 Thread Andy Lutomirski
On Thu, Aug 22, 2013 at 11:15 AM, Oleg Nesterov wrote: > On 08/22, Andy Lutomirski wrote: >> >> On Thu, Aug 22, 2013 at 10:10 AM, Oleg Nesterov wrote: >> > do_fork() denies CLONE_THREAD | CLONE_PARENT if NEWUSER | NEWPID. >> > >> > Then later copy_process() denies CLONE_SIGHAND if the new process

Re: [PATCH 3/3] fork: unify and tighten up CLONE_NEWUSER/CLONE_NEWPID checks

2013-08-22 Thread Oleg Nesterov
On 08/22, Andy Lutomirski wrote: > > On Thu, Aug 22, 2013 at 10:10 AM, Oleg Nesterov wrote: > > do_fork() denies CLONE_THREAD | CLONE_PARENT if NEWUSER | NEWPID. > > > > Then later copy_process() denies CLONE_SIGHAND if the new process > > will be in a different pid namespace (task_active_pid_ns()

Re: [PATCH 3/3] fork: unify and tighten up CLONE_NEWUSER/CLONE_NEWPID checks

2013-08-22 Thread Andy Lutomirski
On Thu, Aug 22, 2013 at 10:10 AM, Oleg Nesterov wrote: > do_fork() denies CLONE_THREAD | CLONE_PARENT if NEWUSER | NEWPID. > > Then later copy_process() denies CLONE_SIGHAND if the new process > will be in a different pid namespace (task_active_pid_ns() doesn't > match current->nsproxy->pid_ns). >

[PATCH 3/3] fork: unify and tighten up CLONE_NEWUSER/CLONE_NEWPID checks

2013-08-22 Thread Oleg Nesterov
do_fork() denies CLONE_THREAD | CLONE_PARENT if NEWUSER | NEWPID. Then later copy_process() denies CLONE_SIGHAND if the new process will be in a different pid namespace (task_active_pid_ns() doesn't match current->nsproxy->pid_ns). This looks confusing and inconsistent. CLONE_NEWPID is very simil