Re: [PATCH] private mounts

Miklos Szeredi
2005-05-01T06:39:48Z

> But proc_check_root is unnecessarily strict, in that it prevents a
> process from traversing into a "child" namespace.
>
> IMHO, a better security restriction anyway would be for processes in
> chroot jails to not be able to see processes outside the jail in /proc
> - only processes inside the jail should be visible. I think everyone
> agrees that would be best.

Creating a new namespace would also have the same effect (only
processes using that namespace are visible). It would be rather ugly,
if a user could not see processes in other login sessions, just
because he uses private namespaces.

Miklos