On Tue, 2009-09-15 at 23:35 +0300, Sergey Kononenko wrote: > I've come across the need to restrict ability of mounting filesystems > inside container and probably forbid remounting of already mounted > filesystems in container namespace (mounted by lxc-start for example). > It semms that the obvious solution is to drop capability from bounding > set of processes inside container. Unfortunately there is no separate > capability for mount/umount and dropping of CAP_SYS_ADMIN is > unacceptable in my case. Could you explain a little more why you have this requirement? Anybody in their own filesystem namespace can do no harm to users in other namespaces. What's the worry? -- Dave _______________________________________________ Containers mailing list Containers@xxxxxxxxxxxxxxxxxxxxxxxxxx https://lists.linux-foundation.org/mailman/listinfo/containers
