[PATCH 0/3] Enable namespaced file capabilities

[Serge E. Hallyn]

Quoting Aleksa Sarai (asarai at suse.de):
> >>So my essential point is that building the real kuid into the permanent
> >>record of the xattr damages image portability, which is touted as one
> >>of the real advantages of container images.
> >
> >'container images' aren't portable in that sense now - for at least
> >many cases - because you have to shift the uid.  However you're doing
> >that, you may be able to shift the xattr the same way.
> 
> Piling more things on top of that issue isn't going to make the
> issue easier to solve IMO. Would shiftfs or shift-bindmounts also
> have to do translation of arbitrary xattrs? Plus I would think that
> handling xattrs would be harder than {u,g}ids because the image
> unpacker now has to be aware of all xattrs that require remapping
> (Which might be an ever-growing list).

No, that's actually the point of Stefan's patch (versus mine).  It
should be able to generically map anything that is 'security.foo at uid=100'
or 'trusted.foo at uid=100'.  It doesn't need more intelligence than that.

-serge