Messages in this thread | | | Date | Thu, 10 Apr 2014 14:45:48 +0000 | From | Colin Walters <> | Subject | Re: [PATCH 0/6] File Sealing & memfd_create() |
| |
On Thu, Mar 20, 2014 at 11:32 AM, tytso@mit.edu wrote: > > Looking at your patches, and what files you are modifying, you are > enforcing this in the low-level file system.
I would love for this to be implemented in the filesystem level as well. Something like the ext4 immutable bit, but with the ability to still make hardlinks would be *very* useful for OSTree. And anyone else that uses hardlinks as a data source. The vserver people do something similiar: http://linux-vserver.org/util-vserver:Vhashify
At the moment I have a read-only bind mount over /usr, but what I really want is to make the individual objects in the object store in /ostree/repo/objects be immutable, so even if a user or app navigates out to /sysroot they still can't mutate them (or the link targets in the visible /usr).
| |