Re: [PATCH -mm 5/7] add user namespace

Serge E. Hallyn
2006-07-14T16:30:46Z

Quoting Eric W. Biederman (ebiederm@xmission.com):
> Dave Hansen <haveblue@us.ibm.com> writes:
>
> > On Thu, 2006-07-13 at 21:45 -0600, Eric W. Biederman wrote:
> >> I think for filesystems like /proc and /sys that there will normally
> >> be problems. However many of those problems can be rationalized away
> >> as a reasonable optimization, or are not immediately apparent.
> >
> > Could you talk about some of these problems?
>
> Already mentioned but. rw permissions on sensitive files are for
> uid == 0. No capability checks are performed.

As Herbert (IIRC) pointed out that could/should be fixed.

-serge