overlayfs mounts in user namespaces

["Serge E. Hallyn" <serge@hallyn.com>]

Hi Eric,

most filesystems cannot be mounted in a non-init user namespace because we
don't trust the superblock parsers to DTRT when handed garbage.  I was
wondering if you had any ideas on ways that allowing root in a non-init userns
to mount an overlayfs fs would be dangerous?  There's no superblock parsing in
that case at all;  writes end up being allowed if and only if the userid owning
the 'upper' (writeable) layer is mapped into the userns.  Near as I can tell
it should be quite safe.  But my imagination isn't the most active.

I assume there would be concerns about memory usage if the system is not
configured to place all logged-in users into configured cgroups?  Is there
anything else you can think of that could be abused?

(I realize overlayfs isn't upstream yet so the question may not be all that
interesting to most people...)

thanks,
-serge