lkml.org 
[lkml]   [2009]   [Feb]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCHv2 1/5] VFS: DazukoFS, stackable-fs, file access control
On Fri, Feb 13, 2009 at 09:00:36PM +0100, Jan Engelhardt wrote:

> You could write an additional mount helper (and putting that into
> /sbin/mount.dazukofs) that does all the security checks:
>
> - that the device is the same as mountpoint
> - that the device belonging to the underlying '/mnt' is not
> mounted anywhere else (in this namespace, at least)
> - exit(1) otherwise
>
> Sure, it may not protect against all the cases Al can come up with,
> but it is better than having nothing.

It's still racy, at the very least. Folks, seriously, you can not
rely on the underlying tree being inaccessible elsewhere. Anything
that does stacking has to cope with that possibility; it's not
bypassable by userland helpers.


\
 
 \ /
  Last update: 2009-02-13 21:27    [W:0.071 / U:0.064 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site