From: Marko Rauhamaa <marko.rauhamaa@f-secure.com>
To: Amir Goldstein <amir73il@gmail.com>
Cc: Miklos Szeredi <miklos@szeredi.hu>, Jan Kara <jack@suse.cz>,
Christian Brauner <christian.brauner@ubuntu.com>,
linux-fsdevel <linux-fsdevel@vger.kernel.org>,
overlayfs <linux-unionfs@vger.kernel.org>
Subject: Re: fsnotify events for overlayfs real file
Date: Tue, 08 Jun 2021 15:05:38 +0300 [thread overview]
Message-ID: <87r1hcftnx.fsf@drapion.f-secure.com> (raw)
In-Reply-To: <CAOQ4uxiYZfQSZN4avfnNmQv1OxB5+Q=9wr-eSRXK+QkostC66w@mail.gmail.com> (Amir Goldstein's message of "Mon, 31 May 2021 21:26:35 +0300")
Amir Goldstein <amir73il@gmail.com>:
> The security oriented users of fanotify are anti-virus on-access
> protection engines and those are using mount marks anyway
> (dynamically adding them as far as I know).
> [cc Marko who may be able to shed some light]
(Thanks for the CC; back from vacation.)
Yes.
> For those products, creating a bind mount inside a new mount ns
> may actually escape the on-access policy or the new mount will
> also be marked I am not sure. I suppose cloning mount ns may be
> prohibited by another LSM or something(?).
Not sure I appreciate all dimensions of the problem space, but I don't
immediately foresee overwhelming escaping problems.
Marko
prev parent reply other threads:[~2021-06-08 12:05 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-05-10 16:31 fsnotify events for overlayfs real file Amir Goldstein
2021-05-18 14:43 ` Miklos Szeredi
2021-05-18 17:56 ` Amir Goldstein
2021-05-31 15:18 ` Miklos Szeredi
2021-05-31 18:26 ` Amir Goldstein
2021-06-01 9:08 ` Christian Brauner
2021-06-08 12:05 ` Marko Rauhamaa [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87r1hcftnx.fsf@drapion.f-secure.com \
--to=marko.rauhamaa@f-secure.com \
--cc=amir73il@gmail.com \
--cc=christian.brauner@ubuntu.com \
--cc=jack@suse.cz \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-unionfs@vger.kernel.org \
--cc=miklos@szeredi.hu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.