From mboxrd@z Thu Jan  1 00:00:00 1970
X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on inbox.vuxu.org
X-Spam-Level: 
X-Spam-Status: No, score=-0.1 required=5.0 tests=DKIM_INVALID,DKIM_SIGNED,
	NICE_REPLY_A,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no
	version=3.4.4
Received: (qmail 25904 invoked from network); 12 May 2022 04:32:19 -0000
Received: from 9front.inri.net (168.235.81.73)
  by inbox.vuxu.org with ESMTPUTF8; 12 May 2022 04:32:19 -0000
Received: from mail.posixcafe.org ([45.76.19.58]) by 9front; Thu May 12 00:29:19 -0400 2022
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=posixcafe.org;
	s=20200506; t=1652329754;
	h=from:from:reply-to:subject:subject:date:date:message-id:message-id:
	 to:to:cc:mime-version:mime-version:content-type:content-type:
	 content-transfer-encoding:content-transfer-encoding:
	 in-reply-to:in-reply-to:references:references;
	bh=o891/8crbkCGzG0wtIlSZrATBQePfVWRNc/vwd/6iZ8=;
	b=QihMUV5hdnNrKSKt2VnYbzyacago4QrHZZC5y9yJ5FJua17ry6k+qvJlinjTvkCkaxZSIO
	cdDI+qwvSHEGAIqHvJ1j1BOp9PozxeTcFeLuPvS5EMN1aJnomqvFpnbjyApfv1CyMnbPYf
	oc10cNx8ZbZINs5ytso9YNczmxaaCCo=
Received: from [192.168.168.200] (161-97-228-135.lpcnextlight.net [161.97.228.135])
	by mail.posixcafe.org (OpenSMTPD) with ESMTPSA id 29a003b9 (TLSv1.3:TLS_AES_256_GCM_SHA384:256:NO)
	for <9front@9front.org>;
	Wed, 11 May 2022 23:29:14 -0500 (CDT)
Message-ID: <67d71431-8fde-81b6-7d56-d7ca0b96ce51@posixcafe.org>
Date: Wed, 11 May 2022 22:29:08 -0600
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101
 Thunderbird/91.8.1
Content-Language: en-US
To: 9front@9front.org
References: <51d86b8f-ac14-3460-0fea-979c93c45877@posixcafe.org>
 <E811DF5E-82ED-48AB-9C36-C75948E4C5C4@stanleylieber.com>
From: Jacob Moody <moody@mail.posixcafe.org>
In-Reply-To: <E811DF5E-82ED-48AB-9C36-C75948E4C5C4@stanleylieber.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
List-ID: <9front.9front.org>
List-Help: <http://lists.9front.org>
X-Glyph: ➈
X-Bullshit: virtual XML over SVG property STM controller 
Subject: Re: [9front] [PATCH] Unmount to remove sharp devices.
Reply-To: 9front@9front.org
Precedence: bulk

On 5/11/22 10:11, Stanley Lieber wrote:
> in some cases, would it make more sense to invoke auth/newns at the listener level, rather than every time rc-httpd is called?
> 

Kind of, listen uses that provided namespace for announcing and listening
itself and also as a parent for all of the running non trusted services. I think
this makes the union of what devices you might need to be pretty large. It also makes
using the namespace file to carve limited views of the root itself a bit more
difficult.But making a new namespace per connection is also pretty crap.

How about:
	/rc/bin/service/namespace.tcp80

with a default checked in file of
	/rc/bin/service/namespace.!tcp80

That way we get a more specific namespace that gets
shared for all connections of one service. You then also
have the -n argument to listen itself for setting
a namespace shared by all services.

This gets it out of /lib, and we could get
rid of /cfg/$sysname/namespace.$service.

moody