Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751974Ab3GQFng (ORCPT ); Wed, 17 Jul 2013 01:43:36 -0400 Received: from out02.mta.xmission.com ([166.70.13.232]:47149 "EHLO out02.mta.xmission.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751520Ab3GQFne (ORCPT ); Wed, 17 Jul 2013 01:43:34 -0400 From: ebiederm@xmission.com (Eric W. Biederman) To: "Serge E. Hallyn" Cc: Andy Lutomirski , Al Viro , Serge Hallyn , linux-kernel@vger.kernel.org References: <20130716192920.GA8980@sergelap> <20130716193826.GP4165@ZenIV.linux.org.uk> <20130716195002.GA23370@mail.hallyn.com> <51E5BC0D.3090303@mit.edu> <20130716213748.GA24076@mail.hallyn.com> <20130716220301.GA24223@mail.hallyn.com> <20130716222308.GA24408@mail.hallyn.com> Date: Tue, 16 Jul 2013 22:43:17 -0700 In-Reply-To: <20130716222308.GA24408@mail.hallyn.com> (Serge E. Hallyn's message of "Tue, 16 Jul 2013 22:23:08 +0000") Message-ID: <87d2qh91xm.fsf@xmission.com> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.1 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain X-XM-AID: U2FsdGVkX18VBhhi2ifoShP0WXwhTDTC0wQdbq6HCZw= X-SA-Exim-Connect-IP: 98.207.154.105 X-SA-Exim-Mail-From: ebiederm@xmission.com X-Spam-Report: * -1.0 ALL_TRUSTED Passed through trusted hosts only via SMTP * 0.7 XMSubLong Long Subject * 0.0 T_TM2_M_HEADER_IN_MSG BODY: T_TM2_M_HEADER_IN_MSG * -3.0 BAYES_00 BODY: Bayes spam probability is 0 to 1% * [score: 0.0000] * -0.0 DCC_CHECK_NEGATIVE Not listed in DCC * [sa08 1397; Body=1 Fuz1=1 Fuz2=1] X-Spam-DCC: XMission; sa08 1397; Body=1 Fuz1=1 Fuz2=1 X-Spam-Combo: ;"Serge E. Hallyn" X-Spam-Relay-Country: Subject: Re: [PATCH RFC] allow some kernel filesystems to be mounted in a user namespace X-Spam-Flag: No X-SA-Exim-Version: 4.2.1 (built Wed, 14 Nov 2012 14:26:46 -0700) X-SA-Exim-Scanned: Yes (on in02.mta.xmission.com) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1609 Lines: 36 "Serge E. Hallyn" writes: > I'm not "relying on LSM" to make these safe. I'm relying on the > uid mappings to make these safe. > > Nevertheless I at least have hope of working around the others (in a > distro-acceptable way), so if the others are too scary I'll pursue > the workaround for the others and see where I get. But I really feel > the securityfs one is the best solution. Personally I don't trust debugfs enough to compile it into my kernel. fuse simply isn't ready to be have fresh mounts usefully created inside a user namespace. Fundamentally with debugfs and securityfs you run into the issue we saw with sysfs and proc where at some level it is the system administrators perogative if those filesystems should be mounted. The rule with filesystems like that is mounting them needs to be no more dangerous than bind mounting them. At the point in the cycle you are talking about mounting them you presumably have already thrown away their original mounts making it impossible to tell if it would have been safe to mount them or not. Making your patch completely inappropriate. What you need to do is at container setup time to bind mount those filesystems if they are already mounted and you want them in the container. If you are just shuffling around something you can already see there are no security issues. Eric -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/