Conversation
Jarkko Sakkinen
jarkko
Edited 19 days ago
I'm now ready to send my rootns patch set that I've had branch for some time at git.kernel.org.
I got the story now in my head why we need it (in universal sense). It has been hard to finalize the code when there is no mission to accomplish.
Now there is a mission to accomplish, which makes it easy to cover letter the code.
It's exactly Claude Mythos and similar LLM powered agentic security scanners. the window that pivot_root leaves grows too big of a risk.
We cannot rely on to stuff like this anymore.
I got the story now in my head why we need it (in universal sense). It has been hard to finalize the code when there is no mission to accomplish.
Now there is a mission to accomplish, which makes it easy to cover letter the code.
It's exactly Claude Mythos and similar LLM powered agentic security scanners. the window that pivot_root leaves grows too big of a risk.
We cannot rely on to stuff like this anymore.
1
0
0
1
0
0
@pid_eins Do you think this could make sense for systemd? Just poking a bit before I do decide to do anything with it.
It's derived works of https://lwn.net/Articles/723561/ with the difference that there are no container objects, there's just a new namespace. Empty root does not categorize as a FS namespace as FS namespaces are all non-empty filesystem hierarchies (enforced by BUG_ON actually).
Have been in and between whether to send this work some day or not, as anything namespaces related feature-wise are a somewhat sensitive topics to begin with...
It's derived works of https://lwn.net/Articles/723561/ with the difference that there are no container objects, there's just a new namespace. Empty root does not categorize as a FS namespace as FS namespaces are all non-empty filesystem hierarchies (enforced by BUG_ON actually).
Have been in and between whether to send this work some day or not, as anything namespaces related feature-wise are a somewhat sensitive topics to begin with...
0
0
0