From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Message-ID: <1427811444.4411.20.camel@redhat.com> Subject: Re: [PATCH] devpts: Add ptmx_uid and ptmx_gid options From: Alexander Larsson To: James Bottomley Cc: Andy Lutomirski , gnome-os-list@gnome.org, Linux Containers , "linux-kernel@vger.kernel.org" , mclasen@redhat.com, "Eric W. Biederman" , Linux FS Devel Date: Tue, 31 Mar 2015 16:17:24 +0200 In-Reply-To: <1427810886.2117.129.camel@HansenPartnership.com> References: <1427447013.2250.9.camel@HansenPartnership.com> <1427788642.4411.12.camel@redhat.com> <1427807248.2117.117.camel@HansenPartnership.com> <1427808184.2117.122.camel@HansenPartnership.com> <1427810118.2117.126.camel@HansenPartnership.com> <1427810886.2117.129.camel@HansenPartnership.com> Content-Type: text/plain; charset="UTF-8" Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: On tis, 2015-03-31 at 17:08 +0300, James Bottomley wrote: > On Tue, 2015-03-31 at 06:59 -0700, Andy Lutomirski wrote: > > > > I don't think that this is correct. That user can already create a > > nested userns and map themselves as 0 inside it. Then they can mount > > devpts. > > I don't mind if they create a container and control the isolated ttys in > that sub container in the VPS; that's fine. I do mind if they get > access to the ttys in the VPS. > > If you can convince me (and the rest of Linux) that the tty subsystem > should be mountable by an unprivileged user generally, then what you > propose is OK. That is controlled by the general rights to mount stuff. I.e. unless you have CAP_SYS_ADMIN in the VPS container you will not be able to mount devpts there. You can only do it in a subcontainer where you got permissions to mount via using user namespaces. -- =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Alexander Larsson Red Hat, Inc alexl@redhat.com alexander.larsson@gmail.com He's an old-fashioned neurotic master criminal from the Mississippi delta. She's a manipulative extravagent widow on her way to prison for a murder she didn't commit. They fight crime!