Messages in this thread | | | Subject | Re: Upstream first policy | From | (Eric W. Biederman) | Date | Wed, 10 Mar 2010 19:52:26 -0800 |
| |
Weird. Somehow I only got a copy of this from lkml.
Alan Cox <alan@lxorguk.ukuu.org.uk> writes:
>> time. If pathnames were not fundamentally important we could apply >> a patch like the one below and allow unprivileged users to unshare >> the mount namespace and mount filesystems wherever. There is nothing >> fundamental about those operations that require root privileges except >> that you are manipulating the pathnames of objects. > > And in a purely SELinux enviromnment your patch would work out because > you could use labels to control this stuff. > > >> - if (!capable(CAP_SYS_ADMIN)) >> - return -EPERM; >> - > > It does raise the question about whether you can do it if you had a > namespace property of "ignore suidness". I'm not sure thats enough > however.
The long term plan is to change that to.
if (nscapable(mnt_ns->user_ns, CAP_SYS_ADMIN)) return -EPERM.
That is. - Create a new user/credential namespace (ultimately an unprivileged operation). - Have the root user of the new user namespace create a new mount namespace. - Over that new mount namespace the root user of the new user namespace has full control.
It is a little convoluted but it maintains backwards compatibility. Unfortunately there is still a long ways to go before we get there.
Eric
| |