Re: [PATCH v2 00/10] userns: sysctl limits for namespaces

I won't have any more time for this until I return from vacation at the end of the month but after a little bit of thought I think I have fixed all of the bugs (except arguably the return value). I have further tweaked these and made the limits per user. Because it occured to me that if the

Re: [PATCH v2 00/10] userns: sysctl limits for namespaces

I won't have any more time for this until I return from vacation at the end of the month but after a little bit of thought I think I have fixed all of the bugs (except arguably the return value). I have further tweaked these and made the limits per user. Because it occured to me that if the

Re: [PATCH v2 00/10] userns: sysctl limits for namespaces

On Tue, Jul 26, 2016 at 10:29 AM, Michael Kerrisk (man-pages) wrote: > On 26 July 2016 at 18:52, Kees Cook wrote: >> On Tue, Jul 26, 2016 at 8:06 AM, Eric W. Biederman >> wrote: >>> "Michael Kerrisk (man-pages)"

Re: [PATCH v2 00/10] userns: sysctl limits for namespaces

On Tue, Jul 26, 2016 at 10:29 AM, Michael Kerrisk (man-pages) wrote: > On 26 July 2016 at 18:52, Kees Cook wrote: >> On Tue, Jul 26, 2016 at 8:06 AM, Eric W. Biederman >> wrote: >>> "Michael Kerrisk (man-pages)" writes: >>> Hello Eric, I realized I had a question after the last

Re: [PATCH v2 00/10] userns: sysctl limits for namespaces

On 26 July 2016 at 18:52, Kees Cook wrote: > On Tue, Jul 26, 2016 at 8:06 AM, Eric W. Biederman > wrote: >> "Michael Kerrisk (man-pages)" writes: >> >>> Hello Eric, >>> >>> I realized I had a question after the last mail. >>>

Re: [PATCH v2 00/10] userns: sysctl limits for namespaces

On 26 July 2016 at 18:52, Kees Cook wrote: > On Tue, Jul 26, 2016 at 8:06 AM, Eric W. Biederman > wrote: >> "Michael Kerrisk (man-pages)" writes: >> >>> Hello Eric, >>> >>> I realized I had a question after the last mail. >>> >>> On 07/21/2016 06:39 PM, Eric W. Biederman wrote: This

Re: [PATCH v2 00/10] userns: sysctl limits for namespaces

On Tue, Jul 26, 2016 at 8:06 AM, Eric W. Biederman wrote: > "Michael Kerrisk (man-pages)" writes: > >> Hello Eric, >> >> I realized I had a question after the last mail. >> >> On 07/21/2016 06:39 PM, Eric W. Biederman wrote: >>> >>> This patchset

Re: [PATCH v2 00/10] userns: sysctl limits for namespaces

On Tue, Jul 26, 2016 at 8:06 AM, Eric W. Biederman wrote: > "Michael Kerrisk (man-pages)" writes: > >> Hello Eric, >> >> I realized I had a question after the last mail. >> >> On 07/21/2016 06:39 PM, Eric W. Biederman wrote: >>> >>> This patchset addresses two use cases: >>> - Implement a sane

Re: [PATCH v2 00/10] userns: sysctl limits for namespaces

"Michael Kerrisk (man-pages)" writes: > Hello Eric, > > On 07/21/2016 06:39 PM, Eric W. Biederman wrote: >> >> This patchset addresses two use cases: >> - Implement a sane upper bound on the number of namespaces. >> - Provide a way for sandboxes to limit the attack

Re: [PATCH v2 00/10] userns: sysctl limits for namespaces

"Michael Kerrisk (man-pages)" writes: > Hello Eric, > > On 07/21/2016 06:39 PM, Eric W. Biederman wrote: >> >> This patchset addresses two use cases: >> - Implement a sane upper bound on the number of namespaces. >> - Provide a way for sandboxes to limit the attack surface from >> namespaces.

Re: [PATCH v2 00/10] userns: sysctl limits for namespaces

"Michael Kerrisk (man-pages)" writes: > Hello Eric, > > I realized I had a question after the last mail. > > On 07/21/2016 06:39 PM, Eric W. Biederman wrote: >> >> This patchset addresses two use cases: >> - Implement a sane upper bound on the number of namespaces. >> -

Re: [PATCH v2 00/10] userns: sysctl limits for namespaces

"Michael Kerrisk (man-pages)" writes: > Hello Eric, > > I realized I had a question after the last mail. > > On 07/21/2016 06:39 PM, Eric W. Biederman wrote: >> >> This patchset addresses two use cases: >> - Implement a sane upper bound on the number of namespaces. >> - Provide a way for

Re: [PATCH v2 00/10] userns: sysctl limits for namespaces

Hello Eric, I realized I had a question after the last mail. On 07/21/2016 06:39 PM, Eric W. Biederman wrote: This patchset addresses two use cases: - Implement a sane upper bound on the number of namespaces. - Provide a way for sandboxes to limit the attack surface from namespaces. Can

Re: [PATCH v2 00/10] userns: sysctl limits for namespaces

Hello Eric, I realized I had a question after the last mail. On 07/21/2016 06:39 PM, Eric W. Biederman wrote: This patchset addresses two use cases: - Implement a sane upper bound on the number of namespaces. - Provide a way for sandboxes to limit the attack surface from namespaces. Can

Re: [PATCH v2 00/10] userns: sysctl limits for namespaces

Hello Eric, On 07/21/2016 06:39 PM, Eric W. Biederman wrote: This patchset addresses two use cases: - Implement a sane upper bound on the number of namespaces. - Provide a way for sandboxes to limit the attack surface from namespaces. The maximum sane case I can imagine is if every process

Re: [PATCH v2 00/10] userns: sysctl limits for namespaces

Hello Eric, On 07/21/2016 06:39 PM, Eric W. Biederman wrote: This patchset addresses two use cases: - Implement a sane upper bound on the number of namespaces. - Provide a way for sandboxes to limit the attack surface from namespaces. The maximum sane case I can imagine is if every process

Re: [PATCH v2 00/10] userns: sysctl limits for namespaces

Kees Cook writes: > On Fri, Jul 22, 2016 at 11:45 AM, Eric W. Biederman > wrote: >> Colin Walters writes: >> >>> On Thu, Jul 21, 2016, at 12:39 PM, Eric W. Biederman wrote: This patchset addresses two use cases: -

Re: [PATCH v2 00/10] userns: sysctl limits for namespaces

Kees Cook writes: > On Fri, Jul 22, 2016 at 11:45 AM, Eric W. Biederman > wrote: >> Colin Walters writes: >> >>> On Thu, Jul 21, 2016, at 12:39 PM, Eric W. Biederman wrote: This patchset addresses two use cases: - Implement a sane upper bound on the number of namespaces. -

Re: [PATCH v2 00/10] userns: sysctl limits for namespaces

On Fri, Jul 22, 2016 at 11:45 AM, Eric W. Biederman wrote: > Colin Walters writes: > >> On Thu, Jul 21, 2016, at 12:39 PM, Eric W. Biederman wrote: >>> >>> This patchset addresses two use cases: >>> - Implement a sane upper bound on the number of

Re: [PATCH v2 00/10] userns: sysctl limits for namespaces

On Fri, Jul 22, 2016 at 11:45 AM, Eric W. Biederman wrote: > Colin Walters writes: > >> On Thu, Jul 21, 2016, at 12:39 PM, Eric W. Biederman wrote: >>> >>> This patchset addresses two use cases: >>> - Implement a sane upper bound on the number of namespaces. >>> - Provide a way for sandboxes to

Re: [PATCH v2 00/10] userns: sysctl limits for namespaces

Colin Walters writes: > On Thu, Jul 21, 2016, at 12:39 PM, Eric W. Biederman wrote: >> >> This patchset addresses two use cases: >> - Implement a sane upper bound on the number of namespaces. >> - Provide a way for sandboxes to limit the attack surface from >> namespaces.

Re: [PATCH v2 00/10] userns: sysctl limits for namespaces

Colin Walters writes: > On Thu, Jul 21, 2016, at 12:39 PM, Eric W. Biederman wrote: >> >> This patchset addresses two use cases: >> - Implement a sane upper bound on the number of namespaces. >> - Provide a way for sandboxes to limit the attack surface from >> namespaces. > > Perhaps this is

Re: [PATCH v2 00/10] userns: sysctl limits for namespaces

On Thu, Jul 21, 2016, at 12:39 PM, Eric W. Biederman wrote: > > This patchset addresses two use cases: > - Implement a sane upper bound on the number of namespaces. > - Provide a way for sandboxes to limit the attack surface from > namespaces. Perhaps this is obvious, but since you didn't

Re: [PATCH v2 00/10] userns: sysctl limits for namespaces

On Thu, Jul 21, 2016, at 12:39 PM, Eric W. Biederman wrote: > > This patchset addresses two use cases: > - Implement a sane upper bound on the number of namespaces. > - Provide a way for sandboxes to limit the attack surface from > namespaces. Perhaps this is obvious, but since you didn't

[PATCH v2 00/10] userns: sysctl limits for namespaces

This patchset addresses two use cases: - Implement a sane upper bound on the number of namespaces. - Provide a way for sandboxes to limit the attack surface from namespaces. The maximum sane case I can imagine is if every process is a fat process, so I set the maximum number of namespaces to

[PATCH v2 00/10] userns: sysctl limits for namespaces

This patchset addresses two use cases: - Implement a sane upper bound on the number of namespaces. - Provide a way for sandboxes to limit the attack surface from namespaces. The maximum sane case I can imagine is if every process is a fat process, so I set the maximum number of namespaces to