Re: [LSF/MM TOPIC] Filesystem namespaces and uid/gid/lsm remapping

[Seth Forshee <seth.forshee@canonical.com>]

On Tue, Dec 02, 2014 at 03:47:04PM -0800, Andy Lutomirski wrote:
> This should hopefully be a short topic, and it's possible that it'll
> be settled by the time LSF/MM comes around, but:
> 
> There's a fair amount of interest from different directions for
> allowing filesystems with a backing store to be mounted (in the
> mount-from-scratch sense, not the bind-mount sense) in a user
> namespace.  For example, Seth has patches to allow unprivileged FUSE
> mounts.  There are a few issues here, for example:
> 
>  - What happens to device nodes in those filesystems?
> 
>  - If a FUSE backend is in a user namespace, how should UIDs be
> translated to/from that backend?
> 
>  - How should LSM security labels be translated?
> 
>  - Should a struct super_block be associated with a user namespace?
> (Answer: probably, I think.)  If so, what should the semantics be?

Another issue is how to deal with ids in the filesystem which don't map
into the user namespace from which the filesystem was mounted, e.g. in
inodes and ACLs.

I was also experimenting with mounting ext4 from a user namespace a
month or so ago, and I'm pretty sure a few other issues popped up there.
I'll have to go back and refresh my memory.

Seth