Re: userns idea: preventing SCM_CREDENTIALS from leaking out

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Quoting Miklos Szeredi (miklos@xxxxxxxxxx):
> On Wed, Nov 27, 2013 at 5:24 PM, Andy Lutomirski <luto@xxxxxxxxxxxxxx> wrote:
> >> Actually an option to aufs and overlayfs to say "any unix domain socket
> >> which is opened must first be copied to the writeable layer" would
> >> solve the issue (at least for all reasonable cases, iiuc)
> >
> > I guess I'm reasonably convinced that overlayfs is the right place to
> > fix this.  (Containers using lvm will be left in the cold -- oh,
> > well.)
> >
> > cc: Miklos, who is the most likely to implement one or both of these features.
> 
> AFAICS implementing the option to copy up a unix domain socket on open
> is trivial:  just need to tweak ovl_open_need_copy_up().
> 
> Is that what you were thinking?

Exactly.

thanks,
-serge
_______________________________________________
Containers mailing list
Containers@xxxxxxxxxxxxxxxxxxxxxxxxxx
https://lists.linuxfoundation.org/mailman/listinfo/containers




[Index of Archives]     [Cgroups]     [Netdev]     [Linux Wireless]     [Kernel Newbies]     [Security]     [Linux for Hams]     [Netfilter]     [Bugtraq]     [Yosemite Forum]     [MIPS Linux]     [ARM Linux]     [Linux RAID]     [Linux Admin]     [Samba]

  Powered by Linux