All of lore.kernel.org
 help / color / mirror / Atom feed
From: Vivek Goyal <vgoyal@redhat.com>
To: Stefan Hajnoczi <stefanha@redhat.com>
Cc: virtio-fs@redhat.com, qemu-devel@nongnu.org
Subject: Re: [Virtio-fs] [PATCH 2/2] virtiofsd: move to a new pid namespace
Date: Thu, 17 Oct 2019 10:45:53 -0400	[thread overview]
Message-ID: <20191017144553.GA12588@redhat.com> (raw)
In-Reply-To: <20191016160157.12414-3-stefanha@redhat.com>

On Wed, Oct 16, 2019 at 05:01:57PM +0100, Stefan Hajnoczi wrote:

[..]
> +	/*
> +	 * If the mounts have shared propagation then we want to opt out so our
> +	 * mount changes don't affect the parent mount namespace.
> +	 */
> +	if (mount(NULL, "/", NULL, MS_REC|MS_SLAVE, NULL) < 0) {
> +		fuse_log(FUSE_LOG_ERR, "mount(/, MS_REC|MS_SLAVE): %m\n");
> +		exit(1);
> +	}

So we will get mount propogation form parent but our mounts will not
propagate back. Sounds reasonable.

Can we take away CAP_SYS_ADMIN from virtiofsd? That way it will not be 
able to do mount at all. 

I am wondering are we dependent on daemon having CAP_SYS_ADMIN. 

Thanks
Vivek


  reply	other threads:[~2019-10-17 14:45 UTC|newest]

Thread overview: 16+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-10-16 16:01 [Virtio-fs] [PATCH 0/2] virtiofsd: add net and pid namespace sandboxing Stefan Hajnoczi
2019-10-16 16:01 ` Stefan Hajnoczi
2019-10-16 16:01 ` [Virtio-fs] [PATCH 1/2] virtiofsd: move to an empty network namespace Stefan Hajnoczi
2019-10-16 16:01   ` Stefan Hajnoczi
2019-10-23  9:34   ` [Virtio-fs] " Dr. David Alan Gilbert
2019-10-23  9:34     ` Dr. David Alan Gilbert
2019-10-16 16:01 ` [Virtio-fs] [PATCH 2/2] virtiofsd: move to a new pid namespace Stefan Hajnoczi
2019-10-16 16:01   ` Stefan Hajnoczi
2019-10-17 14:45   ` Vivek Goyal [this message]
2019-10-17 16:11     ` [Virtio-fs] " Stefan Hajnoczi
2019-10-23  9:46   ` Dr. David Alan Gilbert
2019-10-23  9:46     ` Dr. David Alan Gilbert
2019-10-24 10:26   ` [Virtio-fs] " Daniel P. Berrangé
2019-10-24 10:26     ` Daniel P. Berrangé
2019-10-25 12:53     ` [Virtio-fs] " Stefan Hajnoczi
2019-10-25 12:53       ` Stefan Hajnoczi

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20191017144553.GA12588@redhat.com \
    --to=vgoyal@redhat.com \
    --cc=qemu-devel@nongnu.org \
    --cc=stefanha@redhat.com \
    --cc=virtio-fs@redhat.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.