User namespace - Revision history

Kir: Kir moved page UserNamespace to User namespace: fix title according to mediawiki standards

2015-04-06T15:48:52Z

Kir moved page UserNamespace to User namespace: fix title according to mediawiki standards

2015-02-13T12:27:29Z

2015-02-10T13:59:44Z

2014-12-01T15:01:12Z

2014-11-07T14:32:11Z

2014-10-13T15:21:43Z

2014-08-04T17:48:52Z

2014-07-29T18:30:48Z

2014-07-29T18:08:01Z

2014-07-29T17:44:51Z

@@ Line 1: / Line 1: @@
 Implementing user namespace support in CRIU requires a few changes on kernel side. First of all when a new user namespace is created its capability get dropped off, thus any kernel aspect guarded with capable() may fail. In particular we found that the following things are not functional when we restore tasks running in own user namespace:
 * mknod() requires CAP_MKNOD
 * Lots of IPCNS and UTSNS sysctls require CAP_SYS_ADMIN
 The list will be updated with time. To resolve the problems we need to address every issue and modify the kernel. For first bullet there is a patch already floating around in kernel mailing list.
 [[Category:Development]]

@@ Line 5: / Line 5: @@
 * TIOCSLCKTRMIOS (CAP_SYS_ADMIN)
 * mknod() requires CAP_MKNOD
 The list will be updated with time. To resolve the problems we need to address every issue and modify the kernel. For first bullet there is a patch already floating around in kernel mailing list.
 [[Category:Development]]

← Older revision		Revision as of 15:01, 1 December 2014
Line 9:		Line 9:

	[https://github.com/avagin/criu/tree/userns2 Here is a draft of userspace code]		[https://github.com/avagin/criu/tree/userns2 Here is a draft of userspace code]
		+
		+	[[Category:Development]]

@@ Line 1: / Line 1: @@
 Implementing user namespace support in CRIU requires a few changes on kernel side. First of all when a new user namespace is created its capability get dropped off, thus any kernel aspect guarded with capable() may fail. In particular we found that the following things are not functional when we restore tasks running in own user namespace:
 * using of SO_RCVBUFFORCE and SO_SNDBUFFORCE socket option (CAP_NET_ADMIN)
 * open_by_handle_at and linkat(AT_EMPTY_PATH) requires CAP_DAC_READ_SEARCH

@@ Line 2: / Line 2: @@
 * setup of memory descriptor (prctl syscall) (CAP_SYS_RESOURCE) (assigned to gorcunov@, discussion https://lkml.org/lkml/2014/8/4/570)
-* access to /proc/pid/map_files which we use for restore of shared memory (CAP_SYS_ADMIN)
+* access to /proc/pid/map_files which we use for restore of shared memory (CAP_SYS_ADMIN) (assigned to avagin@. We are going to use memfd_create() for estoring shared memory)
 * using of SO_RCVBUFFORCE and SO_SNDBUFFORCE socket option (CAP_NET_ADMIN)
 * open_by_handle_at and linkat(AT_EMPTY_PATH) requires CAP_DAC_READ_SEARCH