Re: [PATCH] devpts: Add ptmx_uid and ptmx_gid options

[Alexander Larsson <alexl@redhat.com>]

On tis, 2015-03-31 at 17:08 +0300, James Bottomley wrote:
> On Tue, 2015-03-31 at 06:59 -0700, Andy Lutomirski wrote:
> > 
> > I don't think that this is correct.  That user can already create a
> > nested userns and map themselves as 0 inside it.  Then they can mount
> > devpts.
> 
> I don't mind if they create a container and control the isolated ttys in
> that sub container in the VPS; that's fine.  I do mind if they get
> access to the ttys in the VPS.
> 
> If you can convince me (and the rest of Linux) that the tty subsystem
> should be mountable by an unprivileged user generally, then what you
> propose is OK.

That is controlled by the general rights to mount stuff. I.e. unless you
have CAP_SYS_ADMIN in the VPS container you will not be able to mount
devpts there. You can only do it in a subcontainer where you got
permissions to mount via using user namespaces.

-- 
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
 Alexander Larsson                                            Red Hat, Inc 
       alexl@redhat.com            alexander.larsson@gmail.com 
He's an old-fashioned neurotic master criminal from the Mississippi 
delta. She's a manipulative extravagent widow on her way to prison for a 
murder she didn't commit. They fight crime!