The namespaces compatibility list doc
PATCH 1/1 The namespaces compatibility list doc
From time to time people begin discussions about how the namespaces are working/going-to-work together.
Ted T'so proposed to create some document that describes what problems user may have when he/she creates some new namespace, but keeps others shared. I liked this idea, so here's the initial version of such a document with the problems I currently have in mind and can describe somewhat audibly - the "namespaces compatibility list".
The Documentation/namespaces/ directory is about to contain more docs about the namespaces stuff.
Thanks to Cedirc for notes and spell checks on the doc.
---
commit 83061c56e1c4dcd54d48a62b108d219a7f5279a0
Author: Pavel <pavel-00xAsUaB/BPciZdyczg/[email protected]> Date: Fri Nov 16 12:25:53 2007 +0300
Namespaces compatibility list
Documentation/00-INDEX +2 -0
@@ -262,6 +262,8 @@ mtrr.txt - how to use PPro Memory Type Range Registers to increase performance. mutex-design.txt - info on the generic mutex subsystem. +namespaces/ + - directory with various information about namespaces nbd.txt - info on a TCP implementation of a network block device. netlabel/
Documentation/namespaces/compatibility-list.txt new file +33 -0
@@ -0,0 +1,33 @@ + Namespaces compatibility list + +This document contains the information about the problems user +may have when creating tasks living in different namespaces. + +Here's the summary. This matrix shows the known problems, that +occur when tasks share some namespace (the columns) while living +in different other namespaces (the rows): + + UTS IPC VFS PID User Net +UTS X +IPC X 1 +VFS X +PID 1 1 X +User 2 X +Net X + +1. Both the IPC and the PID namespaces provide IDs to address + object inside the kernel. E.g. semaphore with ipcid or + process group with pid. + + In both cases, tasks shouldn't try exposing this id to some + other task living in a different namespace via a shared filesystem + or IPC shmem/message. The fact is that this ID is only valid + within the namespace it was obtained in and may refer to some + other object in another namespace. + +2. Intentionnaly, two equal user ids in different user namespaces + should not be equal from the VFS point of view. In other + words, user 10 in one user namespace shouldn't have the same + access permissions to files, beloging to user 10 in another + namespace. But currently this is not so. +
Quoted 48 lines · Pavel Emelyanov
Quoted 1 line
From time to time people begin discussions about how the
namespaces are working/going-to-work together.
Ted T'so proposed to create some document that describes what
problems user may have when he/she creates some new namespace,
but keeps others shared. I liked this idea, so here's the initial version of such a document with the problems I currently have in mind and can describe somewhat audibly - the "namespaces compatibility list".The
Documentation/namespaces/directory is about to contain more docs about the namespaces stuff.Thanks to Cedirc for notes and spell checks on the doc.
Signed-off-by Pavel Emelyanov <[email protected]>---
commit
83061c56e1c4dcd54d48a62b108d219a7f5279a0Author: Pavel <[email protected]> Date: Fri Nov 16 12:25:53 2007 +0300Namespaces compatibility list
Documentation/00-INDEX +2
-0@@ -262,6 +262,8 @@ mtrr.txt - how to use PPro Memory Type Range Registers to increase performance. mutex-design.txt - info on the generic mutex subsystem. +namespaces/ + - directory with various information about namespaces nbd.txt - info on a TCP implementation of a network block device. netlabel/Documentation/namespaces/compatibility-list.txt new file +7
-0@@ -0,0 +1,33 @@ + Namespaces compatibility list + +This document contains the information about the problems user +may have when creating tasks living in different namespaces. + +Here's the summary. This matrix shows the known problems, that +occur when tasks share some namespace (the columns) while living
Documentation/namespaces/compatibility-list.txt line 17
Quoted 10 lines
Documentation/namespaces/compatibility-list.txt new file +10
-0+in different other namespaces (the rows): + + UTS IPC VFS PID User Net +UTS X +IPC X 1 +VFS X +PID 1 1 X +User 2 X +Net +
UTS IPC VFS PID User Net
UTS X
IPC X 1 3
VFS X
PID 1 1 X
User 2 X
Net
Documentation/namespaces/compatibility-list.txt line 28
Quoted 11 lines
Documentation/namespaces/compatibility-list.txt new file +11
-0+1. Both the IPC and the PID namespaces provide IDs to address + object inside the kernel. E.g. semaphore with ipcid or + process group with pid. + + In both cases, tasks shouldn't try exposing this id to some + other task living in a different namespace via a shared filesystem + or IPC shmem/message. The fact is that this ID is only valid + within the namespace it was obtained in and may refer to some + other object in another namespace. + +2. Intentionnaly, two equal user ids in different user namespaces
Intentionaly
Documentation/namespaces/compatibility-list.txt line 31
Quoted 3 lines
Documentation/namespaces/compatibility-list.txt new file +3
-0+ should not be equal from the VFS point of view. In other + words, user 10 in one user namespace shouldn't have the same + access permissions to files, beloging to user 10 in another
belonging
Documentation/namespaces/compatibility-list.txt line 33
Quoted 2 lines
Documentation/namespaces/compatibility-list.txt new file +2
-0+ namespace. But currently this is not so. +
3. IPC and User
Two processes running in different user namespaces but with the same uids can access with the same permissions to the IPC created by one or other process
Quoted 87 lines · Daniel Lezcano
Quoted 51 lines · Pavel Emelyanov
Quoted 1 line
From time to time people begin discussions about how the
namespaces are working/going-to-work together.
Ted T'so proposed to create some document that describes what problems user may have when he/she creates some new namespace, but keeps others shared. I liked this idea, so here's the initial version of such a document with the problems I currently have in mind and can describe somewhat audibly - the "namespaces compatibility list".
The
Documentation/namespaces/directory is about to contain more docs about the namespaces stuff.Thanks to Cedirc for notes and spell checks on the doc.
Signed-off-by Pavel Emelyanov <[email protected]>---
commit
83061c56e1c4dcd54d48a62b108d219a7f5279a0Author: Pavel <[email protected]> Date: Fri Nov 16 12:25:53 2007 +0300Namespaces compatibility list
Documentation/00-INDEX +2
-0@@ -262,6 +262,8 @@ mtrr.txt - how to use PPro Memory Type Range Registers to increase performance. mutex-design.txt - info on the generic mutex subsystem. +namespaces/ + - directory with various information about namespaces nbd.txt - info on a TCP implementation of a network block device. netlabel/Documentation/namespaces/compatibility-list.txt new file +7
-0@@ -0,0 +1,33 @@ + Namespaces compatibility list + +This document contains the information about the problems user +may have when creating tasks living in different namespaces. + +Here's the summary. This matrix shows the known problems, that +occur when tasks share some namespace (the columns) while livingDocumentation/namespaces/compatibility-list.txt line 17
Quoted 10 lines
Documentation/namespaces/compatibility-list.txt new file +10
-0+in different other namespaces (the rows): + + UTS IPC VFS PID User Net +UTS X +IPC X 1 +VFS X +PID 1 1 X +User 2 X +Net +UTS IPC VFS PID User Net
UTS X
IPC X 1 3
VFS X
PID 1 1 X
User 2 X
NetDocumentation/namespaces/compatibility-list.txt line 28
Quoted 11 lines
Documentation/namespaces/compatibility-list.txt new file +11
-0+1. Both the IPC and the PID namespaces provide IDs to address + object inside the kernel. E.g. semaphore with ipcid or + process group with pid. + + In both cases, tasks shouldn't try exposing this id to some + other task living in a different namespace via a shared filesystem + or IPC shmem/message. The fact is that this ID is only valid + within the namespace it was obtained in and may refer to some + other object in another namespace. + +2. Intentionnaly, two equal user ids in different user namespacesIntentionaly
Documentation/namespaces/compatibility-list.txt line 31
Quoted 3 lines
Documentation/namespaces/compatibility-list.txt new file +3
-0+ should not be equal from the VFS point of view. In other + words, user 10 in one user namespace shouldn't have the same + access permissions to files, beloging to user 10 in anotherbelonging
Quoted 8 lines
Documentation/namespaces/compatibility-list.txt line 33
Quoted 2 lines
Documentation/namespaces/compatibility-list.txt new file +2
-0+ namespace. But currently this is not so. +3. IPC and User
Two processes running in different user namespaces but with the same uids can access with the same permissions to the IPC created by one or other process
Different user and equal IPC is where the row UID and column IPC cross, not the vice versa.
Anything, thanks, please send an incremental patch if Andrew accepts this one.
Thanks,
Pavel
Quoted 4 lines · On Fri, 16 Nov 2007 16:52:34 +0100 Daniel Lezcano wrote:
Quoted 4 lines
+1. Both the IPC and the PID namespaces provide IDs to address
Documentation/namespaces/compatibility-list.txt new file +3
-0+ object inside the kernel. E.g. semaphore with ipcid or + process group with pid. +
Quoted 8 lines
Documentation/namespaces/compatibility-list.txt line 28
Quoted 7 lines
Documentation/namespaces/compatibility-list.txt new file +7
-0+ In both cases, tasks shouldn't try exposing this id to some + other task living in a different namespace via a shared filesystem + or IPC shmem/message. The fact is that this ID is only valid + within the namespace it was obtained in and may refer to some + other object in another namespace. + +2. Intentionnaly, two equal user ids in different user namespacesIntentionaly
Intentionally,
Quoted 6 lines
Documentation/namespaces/compatibility-list.txt line 31
Quoted 3 lines
Documentation/namespaces/compatibility-list.txt new file +3
-0+ should not be equal from the VFS point of view. In other + words, user 10 in one user namespace shouldn't have the same + access permissions to files, beloging to user 10 in anotherbelonging
Quoted 2 lines
Documentation/namespaces/compatibility-list.txt new file +2
-0+ namespace. But currently this is not so. +
---
~Randy
Quoted 4 lines · Daniel Lezcano
Quoted 2 lines · Pavel Emelyanov
+2. Intentionnaly, two equal user ids in different user namespaces
Intentionaly
Intentionally