Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754014AbbG3QWa (ORCPT ); Thu, 30 Jul 2015 12:22:30 -0400 Received: from out01.mta.xmission.com ([166.70.13.231]:37245 "EHLO out01.mta.xmission.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753992AbbG3QW2 (ORCPT ); Thu, 30 Jul 2015 12:22:28 -0400 From: ebiederm@xmission.com (Eric W. Biederman) To: Colin Walters Cc: Casey Schaufler , Amir Goldstein , Seth Forshee , "Theodore Ts'o" , Stephen Smalley , Andy Lutomirski , Alexander Viro , Linux FS Devel , LSM List , "SELinux-NSA" , Serge Hallyn , linux-kernel@vger.kernel.org References: <20150730135531.GA109168@ubuntu-hedt> <55BA43C7.40300@schaufler-ca.com> <1438271527.4081427.337383497.750BC231@webmail.messagingengine.com> Date: Thu, 30 Jul 2015 11:15:48 -0500 In-Reply-To: <1438271527.4081427.337383497.750BC231@webmail.messagingengine.com> (Colin Walters's message of "Thu, 30 Jul 2015 11:52:07 -0400") Message-ID: <87twslliyz.fsf@x220.int.ebiederm.org> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.3 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain X-XM-AID: U2FsdGVkX1+7SecQO4p9qV6pX1WXMtr16yXlweRd64w= X-SA-Exim-Connect-IP: 97.119.22.40 X-SA-Exim-Mail-From: ebiederm@xmission.com X-Spam-Report: * -1.0 ALL_TRUSTED Passed through trusted hosts only via SMTP * 0.7 XMSubLong Long Subject * 1.5 XMNoVowels Alpha-numberic number with no vowels * 0.0 TVD_RCVD_IP Message was received from an IP address * 0.0 T_TM2_M_HEADER_IN_MSG BODY: No description available. * 0.8 BAYES_50 BODY: Bayes spam probability is 40 to 60% * [score: 0.4980] * -0.0 DCC_CHECK_NEGATIVE Not listed in DCC * [sa07 1397; Body=1 Fuz1=1 Fuz2=1] X-Spam-DCC: XMission; sa07 1397; Body=1 Fuz1=1 Fuz2=1 X-Spam-Combo: **;Colin Walters X-Spam-Relay-Country: X-Spam-Timing: total 361 ms - load_scoreonly_sql: 0.05 (0.0%), signal_user_changed: 3.8 (1.1%), b_tie_ro: 2.7 (0.8%), parse: 0.81 (0.2%), extract_message_metadata: 16 (4.4%), get_uri_detail_list: 1.01 (0.3%), tests_pri_-1000: 8 (2.2%), tests_pri_-950: 1.39 (0.4%), tests_pri_-900: 1.19 (0.3%), tests_pri_-400: 20 (5.4%), check_bayes: 18 (5.1%), b_tokenize: 5 (1.5%), b_tok_get_all: 6 (1.6%), b_comp_prob: 2.0 (0.6%), b_tok_touch_all: 2.7 (0.7%), b_finish: 0.76 (0.2%), tests_pri_0: 302 (83.7%), tests_pri_500: 4.1 (1.1%), rewrite_mail: 0.00 (0.0%) Subject: Re: [PATCH 0/7] Initial support for user namespace owned mounts X-Spam-Flag: No X-SA-Exim-Version: 4.2.1 (built Wed, 24 Sep 2014 11:00:52 -0600) X-SA-Exim-Scanned: Yes (on in02.mta.xmission.com) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1018 Lines: 27 Colin Walters writes: > It's worth noting here that I think a lot of the use cases > for unprivileged mounts are testing/development type things, > and these are pretty well covered by: > > http://libguestfs.org/ > > Basically it just runs the host kernel in a VM, and the userspace > is a minimal agent that you can talk to over virtio. You can use > the API, or `guestmount` exposes it via FUSE. > > It doesn't magically make the kernel filesystems robust against > untrusted input, but in the case of compromise, it's an > "unprivileged" VM. I've used it for several projects and been > quite happy. Thanks for pointing this out. That makes it clear we only have to get as far as making fuse work for this work to be useful in practice. Eric -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/