##(see the SpecSpec for an explanation)

 * '''Launchpad Entry''': UbuntuSpec:cloud-server-n-containerize-ptrace-kill
 * '''Created''':
 * '''Contributors''': serge-hallyn
 * '''Packages affected''': linux-kernel

== Summary ==

Root powers, in Linux, are supposed to only come from (a) the possession
of POSIX capabilities, and (b) being the owner of critical files like
/etc/passwd.

This work is to push patches upstream to (a) make POSIX capabilities
targeted at user namespaces, and (b) make root in a container user
namespace be recognized as not being the global root user.

This goes a long way to making containers more secure.

== Release Note ==

##This section should include a paragraph describing the end-user impact of this change.  It is meant to be included in the release notes of the first release in which it is implemented.  (Not all of these will actually be included in the release notes, at the release manager's discretion; but writing them is a useful exercise.)

##It is mandatory.

The root user in containers is now properly contained.

== Rationale ==

For containers to be useful, we want it to be possible to be root in a
container without 'owning' the host.  For instance, being root in a
container allows you to mount the cgroup filesystem and make changes
to your cgroup-imposed limits (cpu, memory, io, and allowed devices).

== User stories ==

Joe wants to run some potentially destructive tests in a container,
without risking the tests adversely affecting hist host.

== Assumptions ==

== Design ==


== Implementation ==

##This section should describe a plan of action (the "how") to implement the changes discussed. Could include subsections like:

== Test/Demo Plan ==

##It's important that we are able to test new features, and demonstrate them to users.  Use this section to describe a short plan that anybody can follow that demonstrates the feature is working.  This can then be used during testing, and to show off after release. Please add an entry to http://testcases.qa.ubuntu.com/Coverage/NewFeatures for tracking test coverage.

##This need not be added or completed until the specification is nearing beta.

== Unresolved issues ==

##This should highlight any issues that should be addressed in further specifications, and not problems with the specification itself; since any specification with problems cannot be approved.

== BoF agenda and discussion ==

##Use this section to take notes during the BoF; if you keep it in the approved spec, use it for summarising what was discussed and note any options that were rejected.

=== UDS Natty discussion ===

{{{
== Containerize ptrace/kill ==

The security team has an interest in smarter ptrace controls,
however these do not mesh with this work.  They want to
mostly prevent ptrace, but allow ptrace_traceme (ab)use
by/for debuggers, tracers, and fault handlers.  Containers
will prevent tasks inside the container from allowing ptrace
by a task outside the container.  User namespaces would likely
be too coarse-grained, globbing together an entire KDE or
wine session, allowing all tasks in one such session to ptrace
each other.

However, the containerization of kill and ptrace are deemed
'a good thing.'  Kees recommends pushing the patchset.
}}}

----
CategorySpec