From: Zhao Hongjiang <zhaohongjiang37-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
To: "Eric W. Biederman" <ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org>
Cc: containers-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org
Subject: Re: [PATCH] user_ns: Add support for unprivileged remount
Date: Fri, 14 Sep 2012 17:23:15 +0800 [thread overview]
Message-ID: <5052F783.3040904@gmail.com> (raw)
In-Reply-To: <87fw6lfwc3.fsf-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org>
On 2012-9-14 5:26, Eric W. Biederman wrote:
> Zhao Hongjiang <zhaohongjiang37@gmail.com> writes:
>
>> From: Zhao Hongjiang <zhaohongjiang@huawei.com>
>>
>> Relax the permission checks to allow unprivileged users that have
>> CAP_SYS_ADMIN permissions in the user namespace referred to by the
>> current mount namespace to be allowed to remount filesystems.
>
> Remount in general make filesystem configuration changes not mount level
> changes.
>
> In general remount is not safe for unprivielged users.
>
> Do you have a use case where you need to remount a filesystem?
As we can do a umount+mount，I don't see why remount operation is not allowed.
Shouldn't we add checks in remount path in the specific filesystem to ensure
safety instead when we enable unprivilleged mount?
>
> Eric
>
_______________________________________________
Containers mailing list
Containers@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/containers
next prev parent reply other threads:[~2012-09-14 9:23 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-09-13 8:43 [PATCH] user_ns: Add support for unprivileged remount Zhao Hongjiang
[not found] ` <50519CB2.7040801-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
2012-09-13 21:26 ` Eric W. Biederman
[not found] ` <87fw6lfwc3.fsf-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org>
2012-09-14 9:23 ` Zhao Hongjiang [this message]
[not found] ` <5052F783.3040904-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
2012-09-14 9:33 ` Eric W. Biederman
[not found] ` <877grxdk48.fsf-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org>
2013-01-17 7:17 ` Gao feng
[not found] ` <50F7A59A.1080601-BthXqXjhjHXQFUHtdCDX3A@public.gmane.org>
2013-01-17 10:06 ` Eric W. Biederman
[not found] ` <87vcawf7jr.fsf-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org>
2013-01-21 2:09 ` Gao feng
[not found] ` <50FCA340.1020404-BthXqXjhjHXQFUHtdCDX3A@public.gmane.org>
2013-01-21 7:26 ` Eric W. Biederman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=5052F783.3040904@gmail.com \
--to=zhaohongjiang37-re5jqeeqqe8avxtiumwx3w@public.gmane.org \
--cc=containers-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org \
--cc=ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox