Messages in this thread | | | Date | Tue, 9 Mar 2010 22:49:41 +0000 | From | Alan Cox <> | Subject | Re: Upstream first policy |
| |
> time. If pathnames were not fundamentally important we could apply > a patch like the one below and allow unprivileged users to unshare > the mount namespace and mount filesystems wherever. There is nothing > fundamental about those operations that require root privileges except > that you are manipulating the pathnames of objects.
And in a purely SELinux enviromnment your patch would work out because you could use labels to control this stuff.
> - if (!capable(CAP_SYS_ADMIN)) > - return -EPERM; > -
It does raise the question about whether you can do it if you had a namespace property of "ignore suidness". I'm not sure thats enough however.
| |