Commit 2868f89f authored by Pavel Emelyanov's avatar Pavel Emelyanov Committed by Linus Torvalds
Browse files

The namespaces compatibility list doc 



People discuss how the namespaces are working/going-to-work together.

Ted Ts'o proposed to create some document that describes what problems user
may have when he/she creates some new namespace, but keeps others shared.
I liked this idea, so here's the initial version of such a document with
the problems I currently have in mind and can describe somewhat audibly -
the "namespaces compatibility list".

The Documentation/namespaces/ directory is about to contain more docs about
the namespaces stuff.

Thanks to Cedirc for notes and spell checks on the doc, to Daniel for
additional info about IPC and User namespaces interaction and to Randy, who
alluded me to using a spell checker before sending the documentation :)

Signed-off-by: default avatarPavel Emelyanov <xemul@openvz.org>
Cc: Randy Dunlap <randy.dunlap@oracle.com>
Cc: Daniel Lezcano <dlezcano@fr.ibm.com>
Cc: Theodore Tso <tytso@mit.edu>
Cc: Cedric Le Goater <clg@fr.ibm.com>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 32df81cb

Documentation/00-INDEX

+2 −0
Original line number Diff line number Diff line
@@ -262,6 +262,8 @@ mtrr.txt 
	- how to use PPro Memory Type Range Registers to increase performance.

mutex-design.txt

	- info on the generic mutex subsystem.

namespaces/

	- directory with various information about namespaces

nbd.txt

	- info on a TCP implementation of a network block device.

netlabel/

Documentation/namespaces/compatibility-list.txt

0 → 100644
+39 −0
Original line number Diff line number Diff line 
	Namespaces compatibility list



This document contains the information about the problems user

may have when creating tasks living in different namespaces.



Here's the summary. This matrix shows the known problems, that

occur when tasks share some namespace (the columns) while living

in different other namespaces (the rows):



	UTS	IPC	VFS	PID	User	Net

UTS	 X

IPC		 X	 1

VFS			 X

PID		 1	 1	 X

User		 2	 2		 X

Net						 X



1. Both the IPC and the PID namespaces provide IDs to address

   object inside the kernel. E.g. semaphore with IPCID or

   process group with pid.



   In both cases, tasks shouldn't try exposing this ID to some

   other task living in a different namespace via a shared filesystem

   or IPC shmem/message. The fact is that this ID is only valid

   within the namespace it was obtained in and may refer to some

   other object in another namespace.



2. Intentionally, two equal user IDs in different user namespaces

   should not be equal from the VFS point of view. In other

   words, user 10 in one user namespace shouldn't have the same

   access permissions to files, belonging to user 10 in another

   namespace.



   The same is true for the IPC namespaces being shared - two users

   from different user namespaces should not access the same IPC objects

   even having equal UIDs.



   But currently this is not so.

CRA Git | Maintained and supported by SUSTech CRA and CCSE