google/gvisor

Implement /proc/sys/user/max_user_namespaces ?

Open

#11,210 建立於 2024年11月22日

在 GitHub 查看
 (4 留言) (1 反應) (0 負責人)Go (12,713 star) (1,061 fork)batch import
good first issuetype: enhancement

描述

Description

Bubblewrap with option "--disable-userns" enabled fails to run in gvisor due to lack of /proc/sys/user/max_user_namespaces (relevant code). The option "--disable-userns" is set as default by flatpak, so adding /proc/sys/user/max_user_namespaces will make it possible to build and run flatpak in container with gvisor.

Is this feature related to a specific bug?

No response

Do you have a specific solution in mind?

No response

貢獻者指南

技術棧
go
領域
backendsecurity
議題類型
feature
難度面向新貢獻者的預計實作難度，1 表示很小改動，5 表示專家級工作。
4
預計時間有經驗貢獻者完成調查、實作、測試並準備 pull request 的粗略時間範圍。
3-5 days
活動狀態議題目前的可參與程度：新鮮、活躍、陳舊、阻塞或等待維護者輸入。
fresh
清晰度議題是否清楚說明預期改動、驗收標準和下一步。
mostly clear
前置要求
Linux namespace basicsprocfs in gVisorGo programming
新手友善度1-100 的估計分數，表示該議題對首次貢獻者的友善程度。
15
研究方向
Examine the current implementation of /proc/sys in gVisor, particularly under /pkg/sentry/fs/proc/. Understand how other /proc/sys/user files are defined (e.g., /proc/sys/user/max user namespaces is missing). Look at the bubblewrap code linked to see how it reads this file. A new file must be added to the proc filesystem that returns a value (likely 0 or a configurable limit). Check existing tests for similar proc files.