Messages in this thread | | | Date | Sun, 29 Jan 2023 08:59:32 -0500 | From | "Colin Walters" <> | Subject | Re: [PATCH v3 1/2] exec: add PR_HIDE_SELF_EXE prctl |
| |
On Wed, Jan 25, 2023, at 11:30 AM, Giuseppe Scrivano wrote: > > After reading some comments on the LWN.net article, I wonder if > PR_HIDE_SELF_EXE should apply to CAP_SYS_ADMIN in the initial user > namespace or if in this case root should keep the privilege to inspect > the binary of a process. If a container runs with that many privileges > then it has already other ways to damage the host anyway.
Right, that's what I was trying to express with the "make it work the same as map_files". Hiding the entry entirely even for initial-namespace-root (real root) seems like it's going to potentially confuse profiling/tracing/debugging tools for no good reason.
| |