Messages in this thread | | | Date | Sun, 24 Apr 2005 23:22:58 +0100 | From | Jamie Lokier <> | Subject | Re: [PATCH] private mounts |
| |
Ram wrote: > > Much better is the proposal to make namespaces first-class objects, > > that can be switched to. Then users can choose to have themselves a > > namespace containing their private mounts, if they want it, with > > login/libpam or even a program run from .profile switching into it. > > > > While users can be allowed to create their own namespaces which affect > > the path traversal of their _own_ directories, it's important that the > > existence of such namespaces cannot affect path traversal of other > > directories such as /etc, or /autofs/whatever - and that creation of > > namespaces by a user cannot prevent the unmounting of a non-user > > filesystem either. > > > > The way to do that is shared subtrees, or something along those lines. > > Right. Adding to it. To begin with the system namespace has all its > entire tree shared. So when a new namespace is cloned, the new namespace > can see any new mount/unmount/binds done in the system namespace as > well. (System namespace is the first initial namespace created by > default). > > Any private mounts done by the user in his private-namespace > will first make that part of the tree private first and then will > continue with the mount. Otherwise the private mount will end up showing > in the system namespace(since it is shared).
Yes, exactly that.
-- Jamie - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |