From: Glauber Costa <glommer-bzQdu9zFT3WakBO8gow8eQ@public.gmane.org>
To: "Kirill A. Shutemov" <kirill-oKw7cIdHH8eLwutG50LtGA@public.gmane.org>
Cc: Al Viro <viro-3bDd1+5oDREiFSDQTTA3OLVCufUGDwFn@public.gmane.org>,
cgroups-u79uwXL29TY76Z2rM5mHXA@public.gmane.org,
linux-fsdevel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org,
ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org,
serge-A9i7LUbDfNHQT0dZR+AlfA@public.gmane.org,
daniel.lezcano-GANU6spQydw@public.gmane.org,
pjt-hpIqsD4AKlfQT0dZR+AlfA@public.gmane.org,
mzxreary-uLTowLwuiw4b1SvskN2V4Q@public.gmane.org,
xemul-bzQdu9zFT3WakBO8gow8eQ@public.gmane.org,
James.Bottomley-d9PhHud1JfjCXq6kfMZ53/egYHeGw8Jk@public.gmane.org,
tj-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org,
eric.dumazet-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org
Subject: Re: [RFC 0/4] per-namespace allowed filesystems list
Date: Tue, 24 Jan 2012 14:32:07 +0400 [thread overview]
Message-ID: <4F1E88A7.4000401@parallels.com> (raw)
In-Reply-To: <20120123230457.GA14347-oKw7cIdHH8eLwutG50LtGA@public.gmane.org>
On 01/24/2012 03:04 AM, Kirill A. Shutemov wrote:
> On Mon, Jan 23, 2012 at 09:12:19PM +0000, Al Viro wrote:
>> This is bloody ridiculous; if you want to prevent a luser adming playing with
>> the set of mounts you've given it, the right way to go is not to mess with the
>> "which fs types are allowed" but to add a per-namespace "immutable" flag.
>> And add a new clone(2)/unshare(2) flag, used only along with the CLONE_NEWNS
>> and setting the "immutable" on the copied namespace.
>
> How will it work if we want to allow namespaced environment to mount block
> devices, but not, let say, debugfs?
>
For the record, that is more or less what I have in mind. But my main
use case is /proc. I guess the case for debugfs is the same.
next prev parent reply other threads:[~2012-01-24 10:32 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-01-23 16:56 [RFC 0/4] per-namespace allowed filesystems list Glauber Costa
2012-01-23 16:56 ` [RFC 2/4] " Glauber Costa
2012-01-23 16:56 ` [RFC 3/4] show only allowed filesystems in /proc/filesystems Glauber Costa
[not found] ` <1327337772-1972-1-git-send-email-glommer-bzQdu9zFT3WakBO8gow8eQ@public.gmane.org>
2012-01-23 16:56 ` [RFC 1/4] move /proc/filesystems inside /proc/self Glauber Costa
2012-01-23 16:56 ` [RFC 4/4] fslist netlink interface Glauber Costa
2012-01-23 19:20 ` [RFC 0/4] per-namespace allowed filesystems list Eric W. Biederman
2012-01-23 21:12 ` Al Viro
[not found] ` <20120123211218.GF23916-3bDd1+5oDREiFSDQTTA3OLVCufUGDwFn@public.gmane.org>
2012-01-23 23:04 ` Kirill A. Shutemov
[not found] ` <20120123230457.GA14347-oKw7cIdHH8eLwutG50LtGA@public.gmane.org>
2012-01-23 23:12 ` Al Viro
2012-01-24 7:17 ` Kirill A. Shutemov
2012-01-24 10:32 ` Glauber Costa [this message]
2012-01-24 10:22 ` Glauber Costa
2012-01-24 0:04 ` Eric W. Biederman
[not found] ` <m1vco2m0eh.fsf-+imSwln9KH6u2/kzUuoCbdi2O/JbrIOy@public.gmane.org>
2012-01-24 10:31 ` Glauber Costa
[not found] ` <4F1E886A.7000107-bzQdu9zFT3WakBO8gow8eQ@public.gmane.org>
2012-01-24 11:17 ` Eric W. Biederman
2012-01-24 11:24 ` Glauber Costa
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4F1E88A7.4000401@parallels.com \
--to=glommer-bzqdu9zft3wakbo8gow8eq@public.gmane.org \
--cc=James.Bottomley-d9PhHud1JfjCXq6kfMZ53/egYHeGw8Jk@public.gmane.org \
--cc=cgroups-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \
--cc=daniel.lezcano-GANU6spQydw@public.gmane.org \
--cc=ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org \
--cc=eric.dumazet-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org \
--cc=kirill-oKw7cIdHH8eLwutG50LtGA@public.gmane.org \
--cc=linux-fsdevel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \
--cc=mzxreary-uLTowLwuiw4b1SvskN2V4Q@public.gmane.org \
--cc=pjt-hpIqsD4AKlfQT0dZR+AlfA@public.gmane.org \
--cc=serge-A9i7LUbDfNHQT0dZR+AlfA@public.gmane.org \
--cc=tj-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org \
--cc=viro-3bDd1+5oDREiFSDQTTA3OLVCufUGDwFn@public.gmane.org \
--cc=xemul-bzQdu9zFT3WakBO8gow8eQ@public.gmane.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).