![]() | |||||||||||||
Messages in this thread |
> But proc_check_root is unnecessarily strict, in that it prevents a > process from traversing into a "child" namespace. > > IMHO, a better security restriction anyway would be for processes in > chroot jails to not be able to see processes outside the jail in /proc > - only processes inside the jail should be visible. I think everyone > agrees that would be best. Creating a new namespace would also have the same effect (only processes using that namespace are visible). It would be rather ugly, if a user could not see processes in other login sessions, just because he uses private namespaces. Miklos - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/ | ||||||||||||
| Last update: 2005-05-01 08:43 [from the cache] ©2003-2008 | |||||||||||||