Re: enhance security via private TMP/TMPDIR by default

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Wed, 2005-05-18 at 18:48 -0400, Bill Nottingham wrote:
> Colin Walters (walters@xxxxxxxxxx) said: 
> > On Wed, 2005-05-18 at 20:15 +0200, Enrico Scholz wrote:
> > 
> > > This CLONE_NEWNS and (related) 'mount --bind' operations are not very
> > > well supported by the kernel:
> > > 
> > > * there does not exist a way to enter an already existing namespace; so,
> > >   e.g. two different ssh sessions would have different /tmp directories
> > 
> > Right, but that shouldn't be a problem since you can share data via your
> > home directory or a specially-designated scratch area, etc.
> 
> Well, there's agent sockets and the like in your tmp dir.

Yes, but if all namespaces bind mount the same tmp dir, it doesn't
matter that processes are running in different namespaces.

-- 
Nicholas Miell <nmiell@xxxxxxxxxxx>

-- 
fedora-devel-list mailing list
fedora-devel-list@xxxxxxxxxx
http://www.redhat.com/mailman/listinfo/fedora-devel-list

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Fedora Announce]     [Fedora Kernel]     [Fedora Testing]     [Fedora Formulas]     [Fedora PHP Devel]     [Kernel Development]     [Fedora Legacy]     [Fedora Maintainers]     [Fedora Desktop]     [PAM]     [Red Hat Development]     [Gimp]     [Yosemite News]
  Powered by Linux