Re: [PATCH RFC] allow some kernel filesystems to be mounted in a user namespace

[Serge Hallyn <serge.hallyn@ubuntu.com>]

Quoting Eric W. Biederman (ebiederm@xmission.com):
> "Serge E. Hallyn" <serge@hallyn.com> writes:
> 
> > I'm not "relying on LSM" to make these safe.  I'm relying on the
> > uid mappings to make these safe.
> >
> > Nevertheless I at least have hope of working around the others (in a
> > distro-acceptable way), so if the others are too scary I'll pursue
> > the workaround for the others and see where I get.  But I really feel
> > the securityfs one is the best solution.
> 
> Personally I don't trust debugfs enough to compile it into my kernel.

That, again, seems reasonable, but would also seem to invalidate
objections to this patch :)  but,

> fuse simply isn't ready to be have fresh mounts usefully created inside
> a user namespace.
> 
> Fundamentally with debugfs and securityfs you run into the issue we saw
> with sysfs and proc where at some level it is the system administrators
> perogative if those filesystems should be mounted.
> 
> The rule with filesystems like that is mounting them needs to be no more
> dangerous than bind mounting them.  At the point in the cycle you are
> talking about mounting them you presumably have already thrown away
> their original mounts making it impossible to tell if it would have been
> safe to mount them or not.  Making your patch completely inappropriate.

Right so the specific problem this patch introduces is:  An admin who is
using a distro kernel with these filesystems enabled but not mounted,
without this patch does not have to worry about unprivileged users being
able to access the fs.  With this patch, he does.

Thanks everyone, I withdraw this patch.

> What you need to do is at container setup time to bind mount those
> filesystems if they are already mounted and you want them in the
> container.  If you are just shuffling around something you can already
> see there are no security issues.

-serge