Open lowenna opened 7 years ago
we've gone back on forth on this. I'm sure @wking could give a historical breakdown.
On Tue, May 16, 2017 at 10:54:40AM -0700, v1.0.0.batts wrote:
I'm sure @wking could give a historical breakdown.
The current policy (since at least 2016-05-18) seems to be 1:
If any platform cannot use your setting, namespace it, unless that would seem weird for aesthetic reasons we're punting on defining.
Maybe this is a call to define those aesthetic reasons or drop the loophole? The initial shift of Linux-specific stuff into ‘process’ happened in #329, and there was a more recent shift in #789, neither of which has a lot of discussion about whether namespacing is appropriate. There is some previous discussion about namespacing in
Looking at the spec all-up, it seems that the
Process
struct is imbalanced relative to the spec in general, and shouldn't directly contain the Linux-specific fields, namelyCapabilities, Rlimits, NoNewPrivileges, ApparmorProfile, OOMScoreAdj, SelinuxLabel
and instead mirror the top-levelSpec
structure and have aLinuxProcess
struct with those fields.Something like
Thoughts?