lkml.org 
[lkml]   [2010]   [Mar]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: Upstream first policy
> time.  If pathnames were not fundamentally important we could apply
> a patch like the one below and allow unprivileged users to unshare
> the mount namespace and mount filesystems wherever. There is nothing
> fundamental about those operations that require root privileges except
> that you are manipulating the pathnames of objects.

And in a purely SELinux enviromnment your patch would work out because
you could use labels to control this stuff.


> - if (!capable(CAP_SYS_ADMIN))
> - return -EPERM;
> -

It does raise the question about whether you can do it if you had a
namespace property of "ignore suidness". I'm not sure thats enough
however.


\
 
 \ /
  Last update: 2010-03-10 00:05    [W:0.094 / U:1.600 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site