On Thu, Jul 07, 2016 at 10:26:50PM -0700, W. Trevor King wrote:
And if you want to put that whole ancestor tree in fdinfo, you have
to come up with some way to handle the two-parent branching.
Going towards the roots is nice, because you know a given namespace
will only have two parents, but it leaks information about the system
into the container. It's probably better to follow the NStgid,
etc. example and only walk toward the leaves. So a (privileged?)
process in the root namespace could see the whole tree, while a
process in non-root namespaces could only see their namespaces and
descendants. In situations where you were part of a namespace that
belonged to an external user namespace (e.g. you nsenter a child user
namespace but are still in the root PID namespace), you'd want an
“unknown” entry for the parent you couldn't see.
Cheers,
Trevor
--
This email may be signed or encrypted with GnuPG (http://www.gnupg.org).
For more information, see http://en.wikipedia.org/wiki/Pretty_Good_Privacy