lkml.org 
[lkml]   [2013]   [Aug]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    SubjectRe: DoS with unprivileged mounts
    From
    On Wed, Aug 14, 2013 at 9:32 PM, Eric W. Biederman
    <ebiederm@xmission.com> wrote:

    >> The solution is also theoretically simple: mounts in unpriv namespaces
    >> are marked "volatile" and are dissolved on an unlink type operation.
    >>
    >> Such volatile mounts would be useful in general too.
    >
    > Agreed.
    >
    > This is a problem that is a general pain with mount namespaces in
    > general.
    >
    > I think the real technical hurdle is finding the mounts t in some random
    > mount namespace. Once we can do that relatively efficiently the rest
    > becomes simple.

    We already have a "struct mountpoint" hashed on the dentry. Chaining
    mounts on that mountpoint would be trivial. And we need a
    MNT_VOLATILE flag and that's it. If we fear that traversing the list
    of mounts on the dentry to check for non-volatile ones then we could
    also add a separate volatile counter to struct mountpoint and a
    matching flag to the dentry. But I don't think that's really
    necessary.

    Thanks,
    Miklos


    \
     
     \ /
      Last update: 2013-08-15 07:21    [W:4.134 / U:0.284 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site