Messages in this thread | | | Date | Wed, 3 Sep 2008 17:02:15 -0500 | From | "Serge E. Hallyn" <> | Subject | Re: unprivileged mounts git tree |
| |
Quoting Miklos Szeredi (miklos@szeredi.hu): > On Wed, 27 Aug 2008, Serge E. Hallyn wrote: > > Ok, thanks. I look forward to playing around with it when you publish > > the resulting git tree :) > > A couple of centuries later... > > ...here's the updated git tree: > > git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs.git unprivileged-mounts > > Changes since the previous version: > > - update to apply against latest git > - downgrade shared mounts to slave for unprivileged binds (if owners differ) > - don't allow unprivileged recursive binds > > Serge, thanks again for testing and reviewing these patches!
Ooh.
You predicate the turning of shared mount to a slave mount on !capable(CAP_SYS_ADMIN). But in fact it's the mount by a privileged user, turning the mount into a user mount, which you want to convert. So my series of steps was:
as root: (1) mount --bind /mnt /mnt (2) mount --make-rshared /mnt (3) /usr/src/mmount-0.3/mmount --bind -o user=hallyn /mnt \ /home/hallyn/etc/mnt as hallyn: (4) mount --bind /usr /home/hallyn/etc/mnt/usr
You are turning mounts from shared->slave at step 4, but in fact we need to do it at step 3, where we do have CAP_SYS_ADMIN.
-serge
| |