[lkml]   [2007]   [Jan]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: [PATCH 4/8] user ns: hook permission
    Quoting Eric W. Biederman (
    > "Serge E. Hallyn" <> writes:
    > > From: Serge E. Hallyn <>
    > > Subject: [PATCH 4/8] user ns: hook permission
    > >
    > > Hook permission to check vfsmnt->user_ns against current.
    > This looks wrong on several levels.
    > - This should ultimately be inside generic_permission instead of
    > permission as there are some distributed filesystems that know how to cope with
    > multiple mount namespaces simultaneous.
    > - As implemented the test is not what I would expect. I would
    > expect comparisons of uid X == uid Y and gid X == gid Y to
    > be replaced by comparing the tuples of uid namesspace and uid.
    > Which would allow access to world readable/writeable files,
    > and it would allow users with CAP_DAC_OVERRIDE to be able to access
    > everything.

    Whoa - why on earth would we want that?

    > All we are really saying as I understand a user namespace is that
    > instead of uid's uniquely identifying a user the pair the pair uidns,
    > uid is uniquely identifies a user.

    Ok that would be one way to interpret it, but it is insufficient for
    preventing root in one vserver from messing with users in another

    > Because you didn't pick what I would consider the obvious choice
    > you now need an extra mount flag to disable the uid namespace all
    > together, so you can transition through the intermediate uid namespace
    > state. That really feels wrong.

    Some bit of required bootstrapping seems both acceptable and expected
    to me.

    > All mounts should have an associated uid namespace and the only


    > way you should be able to ignore that is to access filesystems
    > that can cope with multiple uid namespaces simultaneously.

    But it's my fs on my box, why shouldn't i be able to say all uid
    namespaces can acces this subtree read-only, just bc you feel the
    fs is inadequate? :)

    Note that the tiniest of trees, with just a statically compiled bash,
    mount, pivot_mount, and initrc, should suffice, mounted readonly for
    all uid namespaces to use to bootstrap.

    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    More majordomo info at
    Please read the FAQ at

     \ /
      Last update: 2007-01-24 20:59    [W:0.021 / U:1.364 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site