# Re: \[CRIU\] Introspecting userns relationships to other namespaces?

- From: Eric W. Biederman \<hidden\>
- Date: 2016-07-09 00:04:46 
- List: linux-api
- Page: https://ratatoskr.run/linux-api/2016/07/4791395
- Thread: https://ratatoskr.run/linux-api/2016/07/4791395/t.md

```text
James Bottomley [ref] writes:

> On July 8, 2016 1:38:19 PM PDT, Andrew Vagin [ref] wrote:

>>What do you think about the idea to mount nsfs and be able to look up
>>any alive namespace by inum:
>
> I think I like it.  It will give us a way to enter any extant
> namespace.  It will work for Eric's fs namespaces as well.  Perhaps a
> /process/ns/<inum> Directory?

*Shivers*

That makes it very easy to bypass any existing controls that exist for
getting at namespaces.  It is true that everything of that kind is
directory based but still.

Plus I think it would serve as information leak to information outside
of the container.

An operation to get a user namespace file descriptor from some kernel
object sounds reasonably sane.

A great big list of things sounds about as scary as it can get.  This is
not the time to be making it easier to escape from containers.

Eric
```