lkml.org 
[lkml]   [2007]   [Dec]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: RFC: permit link(2) to work across --bind mounts ?
    > Why does link(2) not support hard-linking across bind mount points
    > of the same underlying filesystem ?

    Whenever we get mount -r --bind working properly (which I use to place
    copies of necessary shared libraries inside chroot jails while allowing
    page cache sharing), this feature would break security.

    mkdir /usr/lib/libs.jail
    for i in $LIST_OF_LIBRARIES; do
    ln /usr/lib/$i /usr/lib/libs.jail/$i
    done
    mount -r /usr/lib/libs.jail /jail/lib
    chown prisoner /usr/log/jail
    mount /usr/log/jail /jail/usr/log
    chrootuid /jail prisoner /bin/untrusted &

    Although protections should be enough, but I'd rather avoid having the
    prisoner link /jail/lib/libfoo.so (write returns EROFS) to /jail/usr/log
    where it's potentially writeable.


    \
     
     \ /
      Last update: 2007-12-20 02:39    [W:2.819 / U:0.476 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site