From mboxrd@z Thu Jan 1 00:00:00 1970 From: ebiederm@xmission.com (Eric W. Biederman) Subject: Re: [PATCH 0/7] Initial support for user namespace owned mounts Date: Wed, 15 Jul 2015 22:15:21 -0500 Message-ID: <87615k7pyu.fsf@x220.int.ebiederm.org> References: <1436989569-69582-1-git-send-email-seth.forshee@canonical.com> Mime-Version: 1.0 Content-Type: text/plain Cc: Alexander Viro , linux-fsdevel@vger.kernel.org, linux-security-module@vger.kernel.org, selinux@tycho.nsa.gov, Serge Hallyn , Andy Lutomirski , linux-kernel@vger.kernel.org, Casey Schaufler To: Seth Forshee Return-path: In-Reply-To: <1436989569-69582-1-git-send-email-seth.forshee@canonical.com> (Seth Forshee's message of "Wed, 15 Jul 2015 14:46:01 -0500") Sender: linux-kernel-owner@vger.kernel.org List-Id: linux-fsdevel.vger.kernel.org Seth I think for the LSMs we should start with: diff --git a/security/security.c b/security/security.c index 062f3c997fdc..5b6ece92a8e5 100644 --- a/security/security.c +++ b/security/security.c @@ -310,6 +310,8 @@ int security_sb_statfs(struct dentry *dentry) int security_sb_mount(const char *dev_name, struct path *path, const char *type, unsigned long flags, void *data) { + if (current_user_ns() != &init_user_ns) + return -EPERM; return call_int_hook(sb_mount, 0, dev_name, path, type, flags, data); } Then we should push this down into all of the lsms. Then when we should remove or relax or change the check as appropriate in each lsm. The point is this is good enough to see that it is trivially safe, and this allows us to focus on the core issues, and stop worrying about the lsms for a bit. Then we can focus on each lsm one at at time and take the time to really understand them and talk with their maintainers etc to make certain we get things correct. This should remove the need for your patches 5, 6 and 7. For the immediate future. Eric