From: Michael Richardson <mcr@sandelman.ca>
To: "openbmc\@lists.ozlabs.org" <openbmc@lists.ozlabs.org>
Subject: Re: overlayFS security concern
Date: Sat, 20 Feb 2021 17:29:39 -0500 [thread overview]
Message-ID: <19011.1613860179@localhost> (raw)
In-Reply-To: <YDE90CWoSXCHjgYK@heinlein>
[-- Attachment #1: Type: text/plain, Size: 645 bytes --]
Patrick Williams <patrick@stwcx.xyz> wrote:
> A protection we could do which would make attacks slightly harder than
> they are today would be to change how we mount OverlayFS. Right now we
> mount it on top of root, but we could be more explicit about mounting
I was going to ask about that. Could we just overlay less?
The second question is: would a non-persistent overlay be useful?
--
] Never tell me the odds! | ipv6 mesh networks [
] Michael Richardson, Sandelman Software Works | IoT architect [
] mcr@sandelman.ca http://www.sandelman.ca/ | ruby on rails [
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 487 bytes --]
next prev parent reply other threads:[~2021-02-20 22:30 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-02-20 0:31 overlayFS security concern Kun Zhao
2021-02-20 0:52 ` chunhui.jia
2021-02-20 1:13 ` Kun Zhao
2021-02-20 1:17 ` chunhui.jia
2021-02-20 1:16 ` Andrew Jeffery
2021-02-20 16:50 ` Patrick Williams
2021-02-20 22:29 ` Michael Richardson [this message]
2021-02-23 5:22 ` Lei Yu
2021-02-23 5:49 ` Milton Miller II
2021-02-22 17:36 ` overlayFS security concern - threat model Joseph Reynolds
2021-03-03 17:55 ` Kun Zhao
2021-03-03 18:00 ` Joseph Reynolds
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=19011.1613860179@localhost \
--to=mcr@sandelman.ca \
--cc=openbmc@lists.ozlabs.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.