1*4882a593Smuzhiyun============================= 2*4882a593SmuzhiyunNamespaces compatibility list 3*4882a593Smuzhiyun============================= 4*4882a593Smuzhiyun 5*4882a593SmuzhiyunThis document contains the information about the problems user 6*4882a593Smuzhiyunmay have when creating tasks living in different namespaces. 7*4882a593Smuzhiyun 8*4882a593SmuzhiyunHere's the summary. This matrix shows the known problems, that 9*4882a593Smuzhiyunoccur when tasks share some namespace (the columns) while living 10*4882a593Smuzhiyunin different other namespaces (the rows): 11*4882a593Smuzhiyun 12*4882a593Smuzhiyun==== === === === === ==== === 13*4882a593Smuzhiyun- UTS IPC VFS PID User Net 14*4882a593Smuzhiyun==== === === === === ==== === 15*4882a593SmuzhiyunUTS X 16*4882a593SmuzhiyunIPC X 1 17*4882a593SmuzhiyunVFS X 18*4882a593SmuzhiyunPID 1 1 X 19*4882a593SmuzhiyunUser 2 2 X 20*4882a593SmuzhiyunNet X 21*4882a593Smuzhiyun==== === === === === ==== === 22*4882a593Smuzhiyun 23*4882a593Smuzhiyun1. Both the IPC and the PID namespaces provide IDs to address 24*4882a593Smuzhiyun object inside the kernel. E.g. semaphore with IPCID or 25*4882a593Smuzhiyun process group with pid. 26*4882a593Smuzhiyun 27*4882a593Smuzhiyun In both cases, tasks shouldn't try exposing this ID to some 28*4882a593Smuzhiyun other task living in a different namespace via a shared filesystem 29*4882a593Smuzhiyun or IPC shmem/message. The fact is that this ID is only valid 30*4882a593Smuzhiyun within the namespace it was obtained in and may refer to some 31*4882a593Smuzhiyun other object in another namespace. 32*4882a593Smuzhiyun 33*4882a593Smuzhiyun2. Intentionally, two equal user IDs in different user namespaces 34*4882a593Smuzhiyun should not be equal from the VFS point of view. In other 35*4882a593Smuzhiyun words, user 10 in one user namespace shouldn't have the same 36*4882a593Smuzhiyun access permissions to files, belonging to user 10 in another 37*4882a593Smuzhiyun namespace. 38*4882a593Smuzhiyun 39*4882a593Smuzhiyun The same is true for the IPC namespaces being shared - two users 40*4882a593Smuzhiyun from different user namespaces should not access the same IPC objects 41*4882a593Smuzhiyun even having equal UIDs. 42*4882a593Smuzhiyun 43*4882a593Smuzhiyun But currently this is not so. 44