Messages in this thread | | | From | (Eric W. Biederman) | Date | Tue, 17 Mar 2015 08:04:40 -0500 | Subject | Re: [RFCv2][PATCH 1/2] fs proc: make pagemap a privileged interface |
| |
Dave Hansen <dave@sr71.net> writes:
> From: Dave Hansen <dave.hansen@linux.intel.com> > > Changes from v1: > * Do not allow a child pid namespace to unset paranoid > when its parent had it set. > * Update description text to clarify the options we > have to solve this problem.
Again.
Nacked-by: "Eric W. Biederman" <ebiederm@xmission.com>
The option name "paranoid" is entirely too general. Who knows what it referrs to.
A mount option is not an appropriate place to control one small bit of policy like this. Proc mount options are a real pain in the butt to deal with and to maintain.
Further a per pid namespace decision does not actually work, for having restricted policy only for a small set of processes because it is only with very careful container setup that you would expose this policy.
If you really need a subset of processes with a restricted policy make it a prctl, and bloat struct task. Then disallow a process with the prctl set from reading the file.
Eric
| |