Re: [systemd-devel] [PATCH] netns: unix: only allow to find out unix socket in same net namespace

On Wed, Aug 21, 2013 at 9:22 AM, Gao feng [off-list ref] wrote:

On 08/21/2013 03:06 PM, Eric W. Biederman wrote:

quoted

I suspect libvirt should simply not share /run or any other normally
writable directory with the host.  Sharing /run /var/run or even /tmp
seems extremely dubious if you want some kind of containment, and
without strange things spilling through.

Right, /run or /var cannot be shared. It's not only about sockets,
many other things will also go really wrong that way.

right now I only take note of the unix socket /run/systemd/private,
but there may have many similar unix sockets, they can exist in any
path. the strange problems will still happen.

anyway, I will send a patch to setup a fresh tmpfs for the /run directory of
container first.

This is what systemd-nspawn does for a container setup:
  http://cgit.freedesktop.org/systemd/systemd/tree/src/nspawn/nspawn.c#n350

Kay