[systemd-devel] [PATCH] netns: unix: only allow to find out unix socket in same net namespace

[Kay Sievers]

On Wed, Aug 21, 2013 at 9:22 AM, Gao feng <gaofeng at cn.fujitsu.com> wrote:
> On 08/21/2013 03:06 PM, Eric W. Biederman wrote:

>> I suspect libvirt should simply not share /run or any other normally
>> writable directory with the host.  Sharing /run /var/run or even /tmp
>> seems extremely dubious if you want some kind of containment, and
>> without strange things spilling through.

Right, /run or /var cannot be shared. It's not only about sockets,
many other things will also go really wrong that way.

> right now I only take note of the unix socket /run/systemd/private,
> but there may have many similar unix sockets, they can exist in any
> path. the strange problems will still happen.
>
> anyway, I will send a patch to setup a fresh tmpfs for the /run directory of
> container first.

This is what systemd-nspawn does for a container setup:
  http://cgit.freedesktop.org/systemd/systemd/tree/src/nspawn/nspawn.c#n350

Kay