Re: [Virtio-fs] virtiofsd: Any reason why there's not an "openat2" sandbox mode?

2022-10-05 Thread Vivek Goyal
On Mon, Oct 03, 2022 at 06:51:42PM -0400, Colin Walters wrote: > > > On Thu, Sep 29, 2022, at 1:03 PM, Vivek Goyal wrote: > > > > So rust version of virtiofsd, already supports running unprivileged > > (inside a user namespace). > > I know, but as I already said, the use case here is running

Re: [Virtio-fs] virtiofsd: Any reason why there's not an "openat2" sandbox mode?

2022-10-03 Thread Colin Walters
On Thu, Sep 29, 2022, at 1:03 PM, Vivek Goyal wrote: > > So rust version of virtiofsd, already supports running unprivileged > (inside a user namespace). I know, but as I already said, the use case here is running inside an OpenShift unprivileged pod where *we are already in a container*. >

Re: [Virtio-fs] virtiofsd: Any reason why there's not an "openat2" sandbox mode?

2022-09-30 Thread German Maglione
On Thu, Sep 29, 2022 at 7:03 PM Vivek Goyal wrote: > > On Thu, Sep 29, 2022 at 11:47:32AM -0400, Colin Walters wrote: > > > > > > On Thu, Sep 29, 2022, at 10:10 AM, Vivek Goyal wrote: > > > > > What's your use case. How do you plan to use virtiofs. > > > > At the current time, the Kubernetes that

Re: [Virtio-fs] virtiofsd: Any reason why there's not an "openat2" sandbox mode?

2022-09-29 Thread Vivek Goyal
On Thu, Sep 29, 2022 at 11:47:32AM -0400, Colin Walters wrote: > > > On Thu, Sep 29, 2022, at 10:10 AM, Vivek Goyal wrote: > > > What's your use case. How do you plan to use virtiofs. > > At the current time, the Kubernetes that we run does not support user > namespaces. We want to do the

Re: [Virtio-fs] virtiofsd: Any reason why there's not an "openat2" sandbox mode?

2022-09-29 Thread Colin Walters
On Thu, Sep 29, 2022, at 10:10 AM, Vivek Goyal wrote: > What's your use case. How do you plan to use virtiofs. At the current time, the Kubernetes that we run does not support user namespaces. We want to do the production builds of our operating system (Fedora CoreOS and RHEL CoreOS) today

Re: [Virtio-fs] virtiofsd: Any reason why there's not an "openat2" sandbox mode?

2022-09-29 Thread Vivek Goyal
On Thu, Sep 29, 2022 at 10:04:36AM -0400, Colin Walters wrote: > On Wed, Sep 28, 2022, at 3:28 PM, Vivek Goyal wrote: > > > Sounds reasonable. In fact, we could probably do someting similar > > for "landlock" as well. > > Thanks for the discussion all! Can someone (vaguely) commit to look into

Re: [Virtio-fs] virtiofsd: Any reason why there's not an "openat2" sandbox mode?

2022-09-29 Thread Colin Walters
On Wed, Sep 28, 2022, at 3:28 PM, Vivek Goyal wrote: > Sounds reasonable. In fact, we could probably do someting similar > for "landlock" as well. Thanks for the discussion all! Can someone (vaguely) commit to look into this in say the next few months? It's not *urgent*, we can live with the

Re: [Virtio-fs] virtiofsd: Any reason why there's not an "openat2" sandbox mode?

2022-09-28 Thread Vivek Goyal
On Wed, Sep 28, 2022 at 10:33:40AM +0200, Sergio Lopez wrote: > On Tue, Sep 27, 2022 at 04:14:20PM -0400, Stefan Hajnoczi wrote: > > On Tue, Sep 27, 2022 at 01:51:41PM -0400, Colin Walters wrote: > > > > > > > > > On Tue, Sep 27, 2022, at 1:27 PM, German Maglione wrote: > > > > > > > >> > Now

Re: [Virtio-fs] virtiofsd: Any reason why there's not an "openat2" sandbox mode?

2022-09-28 Thread Sergio Lopez
On Tue, Sep 27, 2022 at 04:14:20PM -0400, Stefan Hajnoczi wrote: > On Tue, Sep 27, 2022 at 01:51:41PM -0400, Colin Walters wrote: > > > > > > On Tue, Sep 27, 2022, at 1:27 PM, German Maglione wrote: > > > > > >> > Now all the development has moved to rust virtiofsd. > > > > Oh, awesome!! The

Re: [Virtio-fs] virtiofsd: Any reason why there's not an "openat2" sandbox mode?

2022-09-27 Thread Stefan Hajnoczi
On Tue, Sep 27, 2022 at 01:51:41PM -0400, Colin Walters wrote: > > > On Tue, Sep 27, 2022, at 1:27 PM, German Maglione wrote: > > > >> > Now all the development has moved to rust virtiofsd. > > Oh, awesome!! The code there looks great. > > > I could work on this for the next major version and