Re: [libvirt] [systemd-devel] [PATCH] netns: unix: only allow to find out unix socket in same net namespace
On Mon, 2013-08-26 at 11:35 +0800, Gao feng wrote:
On 08/26/2013 11:19 AM, James Bottomley wrote:
> Yes, we are discussing this problem in this whole thread.
I wasn't really watching that bit, since the problem looks solved to me.
I was just reacting against the unfortunate notion that a container
should run init.
If so, OpenVZ
> has never suffered from that problem and I thought it was fixed
> upstream. I've not tested lxc tools, but the latest vzctl from the
> openvz website will bring up a container on the vanilla 3.9 kernel
> (provided you have USER_NS compiled in) can also be used to reboot the
> container, so I see no reason it wouldn't work for lxc as well.
>
I'm using libvirt lxc not lxc-tools.
Not all of users enable user namespace, I trust these container
management
tools can have right/proper setting which inhibit this reboot-problem
occur.
but I don't think this reboot-problem won't happen in any
configuration.
It sounds like you're setting up your containers wrongly. If a
container can reboot the system it means that host root capabilities
have leaked into the container, which is a big security no-no. The
upstream way of avoiding this is USER_NS (because root in the container
is now not root in the host). The OpenVZ kernel uses a different
mechanism to solve the problem, but we think USER_NS is the better way
to go on this.
James