<div dir="ltr">Thank You for the valuable Response RGB.<div><br></div><div>As you mentioned in the above statement is what I was looking for, "<span style="font-size:12.8px">There is a mapping from the PID in </span><span style="font-size:12.8px">the initial PID namespace to its PID in a child PID namespace".</span></div><div><span style="font-size:12.8px">As per your context, Is it initial PID namespace is the one which is get created in the "HOST"?</span></div><div><span style="font-size:12.8px">Please provide me details about how to enter into INIT-PID namespace to get the mappings of child PID Namespace.</span></div><div><span style="font-size:12.8px"><br></span></div><div><span style="font-size:12.8px"><br></span></div><div><span style="font-size:12.8px"><br></span></div><div><span style="font-size:12.8px"><br></span></div><div><span style="font-size:12.8px">-DEEPIKA</span></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Apr 29, 2016 at 8:07 AM, Richard Guy Briggs <span dir="ltr"><<a href="mailto:rgb@redhat.com" target="_blank">rgb@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">On 16/04/28, Deepika Sundar wrote:<br> > Thank you for the replies.<br> ><br> > As per My understanding Root as Admin it has the control over all the<br> > namespaces.If this is correct,<br> <br> </span>As per my previous email, not necessarily.<br> <span class=""><br> > (i) Is that root should have access to all namespace relate info,<br> > for ex: PID's in the host is mapped to what PID's in the Namespace?<br> <br> </span>The initial PID namespace knows about all the PIDs on the machine since<br> the PID namespaces are hierarchical. There is a mapping from the PID in<br> the initial PID namespace to its PID in a child PID namespace. A child<br> PID namespace should never be able to find out what its PID is in a<br> parent PID namespace.<br> <span class=""><br> > if not ,<br> ><br> > (ii) Init should have only access to his own process and should not have<br> > access to other namespace.<br> <br> </span>See above.<br> <span class=""><br> > Is this design limitation (or) Is it designed for better security ?<br> <br> </span>Both.<br> <div class="HOEnZb"><div class="h5"><br> > On Wed, Apr 27, 2016 at 4:49 PM, Deepika Sundar <<a href="mailto:sundar.deepika18@gmail.com">sundar.deepika18@gmail.com</a>> wrote:<br> > > As per rule root(admin) is the one who is monitoring the system's<br> > > information .so,there must exist some namespace information in proc field<br> > > for the namespace related PID in global.Is this the way I'm approaching to<br> > > the namespace related stuffs is correct?<br> > ><br> > > -Deepika<br> > ><br> > > On Mon, Apr 25, 2016 at 12:24 PM, Deepika Sundar <<br> > > <a href="mailto:sundar.deepika18@gmail.com">sundar.deepika18@gmail.com</a>> wrote:<br> > ><br> > >> Yeah.<br> > >> When the PID's which are in the namespace application has different PID<br> > >> compared to Global PID.There would be some means to map the PID's in the<br> > >> kernel level.Can anyone suggest How it can be mapped?<br> > >><br> > >> On Wed, Apr 20, 2016 at 6:03 PM, Steve Grubb <<a href="mailto:sgrubb@redhat.com">sgrubb@redhat.com</a>> wrote:<br> > >><br> > >>> On Wednesday, April 20, 2016 10:06:38 AM Deepika Sundar wrote:<br> > >>> > Is there any way that can be suggested as to map PID's of namespace in<br> > >>> > global?<br> > >>><br> > >>> This is on the TODO list. We have been kicking around several ideas but<br> > >>> have<br> > >>> not come to a conclusion about what exactly needs to be done. The upshot<br> > >>> of<br> > >>> this is that basically containers have no support.<br> > >>><br> > >>> -Steve<br> > >>><br> > >>><br> > >>> > On Mon, Apr 18, 2016 at 8:47 PM, Paul Moore <<a href="mailto:paul@paul-moore.com">paul@paul-moore.com</a>><br> > >>> wrote:<br> > >>> > > Please ask your question on the mailing list so that everyone can<br> > >>> benefit.<br> > >>> > ><br> > >>> > > On Mon, Apr 18, 2016 at 1:34 AM, Deepika Sundar<br> > >>> > ><br> > >>> > > <<a href="mailto:sundar.deepika18@gmail.com">sundar.deepika18@gmail.com</a>> wrote:<br> > >>> > > > How it can be achieved ,Can I get any idea on this?<br> > >>> > > ><br> > >>> > > > On Fri, Apr 15, 2016 at 4:12 AM, Paul Moore <<a href="mailto:paul@paul-moore.com">paul@paul-moore.com</a>><br> > >>> wrote:<br> > >>> > > >> On Wed, Apr 13, 2016 at 1:43 AM, sowndarya kumar<br> > >>> > > >><br> > >>> > > >> <<a href="mailto:sowndarya.nadar@gmail.com">sowndarya.nadar@gmail.com</a>> wrote:<br> > >>> > > >> > Hi<br> > >>> > > >> ><br> > >>> > > >> > Is there any way to map the PID's seen in the namespace<br> > >>> application<br> > >>> > ><br> > >>> > > with<br> > >>> > ><br> > >>> > > >> > the<br> > >>> > > >> > PID's seen in global?<br> > >>> > > >> > If it can be done please provide the documentation or idea on<br> > >>> how it<br> > >>> > ><br> > >>> > > can<br> > >>> > ><br> > >>> > > >> > be<br> > >>> > > >> > done.<br> > >>> > > >><br> > >>> > > >> In general the audit subsystem doesn't pay attention to<br> > >>> namespaces,<br> > >>> > > >> all PIDs reported to userspace are reported with respect to the<br> > >>> init<br> > >>> > > >> namespace.<br> > >>> > > >><br> > >>> > > >> --<br> > >>> > > >> paul moore<br> > >>> > > >> <a href="http://www.paul-moore.com" rel="noreferrer" target="_blank">www.paul-moore.com</a><br> > >>> > > >><br> > >>> > > >> --<br> > >>> > > >> Linux-audit mailing list<br> > >>> > > >> <a href="mailto:Linux-audit@redhat.com">Linux-audit@redhat.com</a><br> > >>> > > >> <a href="https://www.redhat.com/mailman/listinfo/linux-audit" rel="noreferrer" target="_blank">https://www.redhat.com/mailman/listinfo/linux-audit</a><br> > >>> > ><br> > >>> > > --<br> > >>> > > paul moore<br> > >>> > > <a href="http://www.paul-moore.com" rel="noreferrer" target="_blank">www.paul-moore.com</a><br> > >>><br> > >>><br> > >><br> > ><br> <br> </div></div><div class="HOEnZb"><div class="h5">- RGB<br> <br> --<br> Richard Guy Briggs <<a href="mailto:rgb@redhat.com">rgb@redhat.com</a>><br> Kernel Security Engineering, Base Operating Systems, Red Hat<br> Remote, Ottawa, Canada<br> Voice: +1.647.777.2635, Internal: (81) 32635<br> </div></div></blockquote></div><br></div>