Pavel Emelyanov | 2868f89 | 2007-11-28 16:21:39 -0800 | [diff] [blame] | 1 | Namespaces compatibility list |
| 2 | |
| 3 | This document contains the information about the problems user |
| 4 | may have when creating tasks living in different namespaces. |
| 5 | |
| 6 | Here's the summary. This matrix shows the known problems, that |
| 7 | occur when tasks share some namespace (the columns) while living |
| 8 | in different other namespaces (the rows): |
| 9 | |
| 10 | UTS IPC VFS PID User Net |
| 11 | UTS X |
| 12 | IPC X 1 |
| 13 | VFS X |
| 14 | PID 1 1 X |
| 15 | User 2 2 X |
| 16 | Net X |
| 17 | |
| 18 | 1. Both the IPC and the PID namespaces provide IDs to address |
| 19 | object inside the kernel. E.g. semaphore with IPCID or |
| 20 | process group with pid. |
| 21 | |
| 22 | In both cases, tasks shouldn't try exposing this ID to some |
| 23 | other task living in a different namespace via a shared filesystem |
| 24 | or IPC shmem/message. The fact is that this ID is only valid |
| 25 | within the namespace it was obtained in and may refer to some |
| 26 | other object in another namespace. |
| 27 | |
| 28 | 2. Intentionally, two equal user IDs in different user namespaces |
| 29 | should not be equal from the VFS point of view. In other |
| 30 | words, user 10 in one user namespace shouldn't have the same |
| 31 | access permissions to files, belonging to user 10 in another |
| 32 | namespace. |
| 33 | |
| 34 | The same is true for the IPC namespaces being shared - two users |
| 35 | from different user namespaces should not access the same IPC objects |
| 36 | even having equal UIDs. |
| 37 | |
| 38 | But currently this is not so. |
| 39 | |