From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from out03.mta.xmission.com ([166.70.13.233]:34355 "EHLO out03.mta.xmission.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755164AbcGFPbd (ORCPT ); Wed, 6 Jul 2016 11:31:33 -0400 From: ebiederm@xmission.com (Eric W. Biederman) To: Andy Lutomirski Cc: Seth Forshee , Linux Containers , Linux FS Devel , Linux API , James Bottomley , Djalal Harouni , "Serge E. Hallyn" , Jan Kara , Jann Horn , Michael Kerrisk References: <87ziq03qnj.fsf@x220.int.ebiederm.org> Date: Wed, 06 Jul 2016 10:19:04 -0500 In-Reply-To: (Andy Lutomirski's message of "Wed, 6 Jul 2016 07:01:39 -0700") Message-ID: <87vb0ilrpz.fsf@x220.int.ebiederm.org> MIME-Version: 1.0 Content-Type: text/plain Subject: Re: [PATCH review 0/11] General unprivileged mount support Sender: linux-fsdevel-owner@vger.kernel.org List-ID: Andy Lutomirski writes: > On Sat, Jul 2, 2016 at 10:18 AM, Eric W. Biederman > wrote: >> >> As well as in these patches the code is also available from: >> git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace.git for-testing >> >> It has been a long time in coming but recently in the userns tree the >> superblock has been expanded with a s_user_ns field indicating the user >> namespace that owns a superblock. >> > > It would be nice if global root could mount otherwise-unsafe > filesystems with s_user_ns set to a non-init namespace. Do you have > plans to allow that? Looking at the code global root would pass the permission checks that are present in my tree today. At the same time I don't have a provision for global root to specify the user namespace. The practical limitation is that the filesystems need a little bit of gentle massaging to handle the case when s_user_ns != &init_user_ns. I think i_uid_read and i_uid_write already provide 90% of that. The other limitation is that s_user_ns is defined as the owner of the filesystem and as the default translation. Which will mean root in s_user_ns will be trusted to remount the filesystem. The primary target right now is a safe unprivileged mount of fuse. I am not opposed to extensions allowing the global root to mount otherwise-unsafe filesystems with s_user_ns != &init_user_ns as long as it is for cases where we can trust the underlying filesystem image and don't mind giving root in s_user_ns all interesting permissions over the filesystem. I think that could be an very interesting intermediary step in getting filesystems supported. Still my focus is true unprivileged mounts, there are a huge number of little details that go into getting that right, and my poor brain can't handle looking at cases beyond that. Eric