On Tue, Mar 31, 2015 at 12:57 AM, Alexander Larsson <alexl@xxxxxxxxxx> wrote: > On fre, 2015-03-27 at 10:03 +0100, James Bottomley >> >> > On Fri, Feb 20, 2015 at 5:04 PM, Andy Lutomirski <luto@xxxxxxxxxxxxxx> wrote: >> > > It's currently impossible to mount devpts in a user namespace that >> > > has no root user, since ptmx can't be created. >> >> This is where I stopped reading because it's not true ... because it is >> possible, you just do it from the host as real root. > > The point is being able to set up a container as a user, not requiring > the setup to be run as root at all. In my case container is a desktop > application which will be started by the user, and will run as the user. > There is no root involved in the call chain at all. Even more precisely, I think the status quo has less to do with the privilege of the userns' creator and more to do with the configuration of the userns. Anyone (root or otherwise) can create a userns with or without a "root" inside. With the current code, if you create a userns with no inner root, you can't mount devpts inside. This gives no security benefit exactly because nonroot users *can* create user namespaces that contain a root user. In the use case for this patch, the user doesn't want to do that and then gets stuck with the current code. --Andy > > -- > =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= > Alexander Larsson Red Hat, Inc > alexl@xxxxxxxxxx alexander.larsson@xxxxxxxxx > He's a war-weary Catholic boxer for the 21st century. She's a beautiful > renegade magician's assistant looking for love in all the wrong places. > They fight crime! > -- Andy Lutomirski AMA Capital Management, LLC _______________________________________________ Containers mailing list Containers@xxxxxxxxxxxxxxxxxxxxxxxxxx https://lists.linuxfoundation.org/mailman/listinfo/containers
