Re: [kernel-hardening] [PATCH 0/2] capability controlled user-namespaces

2017-10-19 Thread महेश बंडेवार
On Mon, Oct 2, 2017 at 11:12 AM, Mahesh Bandewar (महेश बंडेवार) wrote: > On Mon, Oct 2, 2017 at 10:14 AM, Serge E. Hallyn wrote: >> Quoting Mahesh Bandewar (mah...@bandewar.net): >>> From: Mahesh Bandewar >>> >>> [Same as the previous RFC series sent on 9/21] >>> >>> TL;DR version >>> --

Re: [kernel-hardening] [PATCH 0/2] capability controlled user-namespaces

2017-10-02 Thread महेश बंडेवार
On Mon, Oct 2, 2017 at 10:14 AM, Serge E. Hallyn wrote: > Quoting Mahesh Bandewar (mah...@bandewar.net): >> From: Mahesh Bandewar >> >> [Same as the previous RFC series sent on 9/21] >> >> TL;DR version >> - >> Creating a sandbox environment with namespaces is challenging >> consideri

Re: [kernel-hardening] [PATCH 0/2] capability controlled user-namespaces

2017-10-02 Thread Serge E. Hallyn
Quoting Mahesh Bandewar (mah...@bandewar.net): > From: Mahesh Bandewar > > [Same as the previous RFC series sent on 9/21] > > TL;DR version > - > Creating a sandbox environment with namespaces is challenging > considering what these sandboxed processes can engage into. e.g. > CVE-201

[PATCH 0/2] capability controlled user-namespaces

2017-09-29 Thread Mahesh Bandewar
From: Mahesh Bandewar [Same as the previous RFC series sent on 9/21] TL;DR version - Creating a sandbox environment with namespaces is challenging considering what these sandboxed processes can engage into. e.g. CVE-2017-6074, CVE-2017-7184, CVE-2017-7308 etc. just to name few. Curre

[RFC PATCH 0/2] capability controlled user-namespaces

2017-09-21 Thread Mahesh Bandewar
From: Mahesh Bandewar TL;DR version - Creating a sandbox environment with namespaces is challenging considering what these sandboxed processes can engage into. e.g. CVE-2017-6074, CVE-2017-7184, CVE-2017-7308 etc. just to name few. Current form of user-namespaces, however, if changed