From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Serge E. Hallyn" Subject: Re: unprivileged mounts git tree Date: Thu, 11 Sep 2008 10:20:33 -0500 Message-ID: <20080911152033.GA29318@us.ibm.com> References: <20080903224334.GA726@us.ibm.com> <20080904132804.GA14709@us.ibm.com> <20080905153134.GA18367@us.ibm.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: ebiederm@xmission.com, akpm@linux-foundation.org, hch@infradead.org, viro@ZenIV.linux.org.uk, linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org To: Miklos Szeredi Return-path: Received: from e1.ny.us.ibm.com ([32.97.182.141]:51488 "EHLO e1.ny.us.ibm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752472AbYIKPUl (ORCPT ); Thu, 11 Sep 2008 11:20:41 -0400 Content-Disposition: inline In-Reply-To: Sender: linux-fsdevel-owner@vger.kernel.org List-ID: Quoting Miklos Szeredi (miklos@szeredi.hu): > On Thu, 11 Sep 2008, ebiederm@xmission.com (Eric W. Biederman) > > There is a weird corner case I'm trying to wrap my head around. > > unlink and rmdir do not work on dentries that are mount points > > in another mount namespace. > > > > Which is at least needed for the moment so we don't leak mounts. > > > > Once we have unprivileged mounts does that introduce a DOS attack? > > Hmm, yes. That's a tough one... > > I think if the dentry has only user mounts, unlink should go ahead and > on success dissolve any mounts on the dentry. Does that sound > workable? > > Thanks, > Miklos Is it really a problem? The admin can always go ahead and kill the user, which already takes care of any mounts in private namespaces, which I think is Eric's primary concern. IT also takes care of that user's processes pinning files under the mounts. So now the admin can umount all the user's mounts in the init namespace (using a script parsing /proc/self/mountinfo if need be), and delete the files. Doesn't really seem like a problem. Or am I missing Eric's real concern? -serge