[RFC PATCH 04/27] containers: Allow a process to be forked into a container

David Howells dhowells at redhat.com
Tue Feb 19 23:16:59 UTC 2019

Eric W. Biederman <ebiederm at xmission.com> wrote:

> > Further attempts to fork into the container will be rejected.
> There are no technical reasons to disallow this, and may good practical
> reasons to allow this.

Fair enough; that can be done.  Could even emulate /sbin/request-key upcalling
that way, with the manager spawning the daemon into the container with it.

> So you are breaking nsenter, and it's like.

It shouldn't stop nsenter() from working.


More information about the Linux-security-module-archive mailing list