From: ebiederm@xmission.com (Eric W. Biederman)
To: Ian Kent <raven@themaw.net>
Cc: Linux Containers <containers@lists.linux-foundation.org>,
linux-kernel@vger.kernel.org,
Miklos Szeredi <mszeredi@redhat.com>,
linux-fsdevel@vger.kernel.org,
Seth Forshee <seth.forshee@canonical.com>
Subject: Re: [PATCH 0/2] userns: automount cleanups
Date: Wed, 29 Nov 2017 23:21:24 -0600 [thread overview]
Message-ID: <877eu8ibor.fsf@xmission.com> (raw)
In-Reply-To: <c5174597-ab58-9b71-e6e9-6b15d256f22c@themaw.net> (Ian Kent's message of "Thu, 30 Nov 2017 08:11:55 +0800")
Ian Kent <raven@themaw.net> writes:
> On 30/11/17 08:01, Eric W. Biederman wrote:
>>
>> While reviewing some code I realized that in getting d_automount working
>> with s_user_ns I had left behind some unnecessary relics of the blind
>> path I started down. Here are two patches that remove those relics.
>>
>> Unless someone has another preference I will drop them in my userns tree
>> and merge them that way.
>
> I saw the "<etc>->s_user_ns != &init_user_ns" and wondered if that would
> trigger for automount(8) run entirely with a container (eg. docker)?
autofs still needs FS_USERNS_MOUNT before you can reach that point. But
docker does have a mode ?--userns-remap? where it sets up the containers
mounts that way.
I think in principle that should work and be safe. I don't know how
robust autofs is against malicious users. Which is the question to ask
before actually adding FS_USERNS_MOUNT in struct file_system_type.
> Anyway, it's gone now, so ACK to these two, thanks Eric.
Eric
next prev parent reply other threads:[~2017-11-30 5:21 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-11-30 0:01 [PATCH 0/2] userns: automount cleanups Eric W. Biederman
2017-11-30 0:04 ` [PATCH 1/2] userns: Don't fail follow_automount based on s_user_ns Eric W. Biederman
[not found] ` <874lpck52r.fsf-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org>
2017-11-30 0:04 ` Eric W. Biederman
2017-11-30 0:05 ` [PATCH 2/2] autofs4: Modify autofs_wait to use current_uid() and current_gid() Eric W. Biederman
2017-11-30 0:05 ` Eric W. Biederman
2017-11-30 0:11 ` [PATCH 0/2] userns: automount cleanups Ian Kent
2017-11-30 0:11 ` Ian Kent
2017-11-30 5:21 ` Eric W. Biederman [this message]
[not found] ` <877eu8ibor.fsf-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org>
2017-11-30 9:11 ` Ian Kent
2017-11-30 9:11 ` Ian Kent
[not found] ` <c5174597-ab58-9b71-e6e9-6b15d256f22c-PKsaG3nR2I+sTnJN9+BGXg@public.gmane.org>
2017-11-30 5:21 ` Eric W. Biederman
-- strict thread matches above, loose matches on Subject: below --
2017-11-30 0:01 Eric W. Biederman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=877eu8ibor.fsf@xmission.com \
--to=ebiederm@xmission.com \
--cc=containers@lists.linux-foundation.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mszeredi@redhat.com \
--cc=raven@themaw.net \
--cc=seth.forshee@canonical.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.