[Bug 120671] missing info about userns restrictions

[bugzilla-daemon-590EEB7GvNiWaY/ihj7yzEB+6BGkLq7r@public.gmane.org]

https://bugzilla.kernel.org/show_bug.cgi?id=120671

--- Comment #4 from Michael Kerrisk <mtk.manpages-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org> ---
(In reply to Michał Zegan from comment #2)
> Well... For example, cap_sys_module does not work in user namespace, doesn't
> it? cap_sys_mknod last i checked did not work in userns, but may be wrong.

Yes, but that is conveyed in a sentence in user_namespaces(7):

       Having a capability inside a user namespace permits  a  process
       to   perform   operations  (that  require  privilege)  only  on
       resources governed by that namespace.

[1] Loading a kernel module or creating a device node are not governed by any
of the 7 current namespace types. What I mean here: this is not a question of
whether particular capabilities work in a namespace, rather what operations /
abilities are associated with various namespaces.

> About mounting filesystems, there is probably a whitelist.  If I recall
> correctly you are unable to mount any block based fs like ext4 inside of the
> userns, like you have no permissions to mount most of them except tmpfs,
> proc and such like. 

[2] This isn't correct as far as I know, but if you can show me an interesting
counterexample...

> There may be other restrictions I am not aware of, but
> those are some I know, unless I am wrong. It will help to clarify some
> things that are just not present in that manpage.

So far, I don't see a real problem in the man page(s). (But maybe, the
explanations on the first point could be more detailed.)

-- 
You are receiving this mail because:
You are watching the assignee of the bug.--
To unsubscribe from this list: send the line "unsubscribe linux-man" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html