bind mounting namespace inodes for unprivileged users

[James Bottomley <James.Bottomley@HansenPartnership.com>]

Right at the moment, unprivileged users cannot call mount --bind to
create a permanent copy of any of their namespaces.  This is annoying
because it means that for entry to long running containers you have to
spawn an undying process and use nsenter via the /proc/<pid>/ns files.

The first question is:  assuming we restrict it to bind mounting only
nsfs inodes, is there any reason an unprivileged user shouldn't be able
to bind a namespace they've created to a file they own in the initial
mount namespace?

Assuming the answer to this is no, then how to implement it becomes the
next problem.  Right at the moment, util-linux/mount will deny a non
-root user the ability to use --bind.  This check could be relaxed and,
since mount is setuid root, it could be modified to force the binding
as root meaning this could be implemented entirely within the util
-linux package.

Doing this from within the kernel sys_mount is much more problematic:
no root users are forbidden from calling any type of mount by the
may_mount() check, which makes sure you only have root capability in
the user_ns attached to the current mnt_ns.  Overriding that simply to
allow nsfs binding looks like a recipe for introducing unexpected
security problems.

So, does anyone have any strong (or even weak) opinions about this
before I start coding patches?

James