From: Zhao Hongjiang <zhaohongjiang37-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
To: "Eric W. Biederman" <ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org>
Cc: containers-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org
Subject: Re: [PATCH] user_ns: Add support for unprivileged remount
Date: Fri, 14 Sep 2012 17:23:15 +0800 [thread overview]
Message-ID: <5052F783.3040904@gmail.com> (raw)
In-Reply-To: <87fw6lfwc3.fsf-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org>
On 2012-9-14 5:26, Eric W. Biederman wrote:
> Zhao Hongjiang <zhaohongjiang37@gmail.com> writes:
>
>> From: Zhao Hongjiang <zhaohongjiang@huawei.com>
>>
>> Relax the permission checks to allow unprivileged users that have
>> CAP_SYS_ADMIN permissions in the user namespace referred to by the
>> current mount namespace to be allowed to remount filesystems.
>
> Remount in general make filesystem configuration changes not mount level
> changes.
>
> In general remount is not safe for unprivielged users.
>
> Do you have a use case where you need to remount a filesystem?
As we can do a umount+mount，I don't see why remount operation is not allowed.
Shouldn't we add checks in remount path in the specific filesystem to ensure
safety instead when we enable unprivilleged mount?
>
> Eric
>
_______________________________________________
Containers mailing list
Containers@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/containers
next prev parent reply other threads:[~2012-09-14 9:23 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-09-13 8:43 [PATCH] user_ns: Add support for unprivileged remount Zhao Hongjiang
[not found] ` <50519CB2.7040801-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
2012-09-13 21:26 ` Eric W. Biederman
[not found] ` <87fw6lfwc3.fsf-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org>
2012-09-14 9:23 ` Zhao Hongjiang [this message]
[not found] ` <5052F783.3040904-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
2012-09-14 9:33 ` Eric W. Biederman
[not found] ` <877grxdk48.fsf-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org>
2013-01-17 7:17 ` Gao feng
[not found] ` <50F7A59A.1080601-BthXqXjhjHXQFUHtdCDX3A@public.gmane.org>
2013-01-17 10:06 ` Eric W. Biederman
[not found] ` <87vcawf7jr.fsf-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org>
2013-01-21 2:09 ` Gao feng
[not found] ` <50FCA340.1020404-BthXqXjhjHXQFUHtdCDX3A@public.gmane.org>
2013-01-21 7:26 ` Eric W. Biederman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=5052F783.3040904@gmail.com \
--to=zhaohongjiang37-re5jqeeqqe8avxtiumwx3w@public.gmane.org \
--cc=containers-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org \
--cc=ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.