Re: CGroup Namespaces (v4)

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Mon, Nov 16, 2015 at 07:40:26PM -0600, Serge E. Hallyn wrote:
> On Mon, Nov 16, 2015 at 07:13:49PM -0600, Serge E. Hallyn wrote:
> > On Mon, Nov 16, 2015 at 04:24:27PM -0600, Eric W. Biederman wrote:
...
> > > Similary have you considered what it required to be able to safely set
> > > FS_USERNS_MOUNT?
> > 
> > I think the only thing we need to do is
> > 
> > 1. go through and make sure that any ability to change mount flags is under
> > capable() (which I have not yet done).  The cgroup_mount() itself checks that
> > flags are not changed, but there may be some subtle way to effect a change
> > that I'm not aware of yet.
> > 
> 
> At least the ability to change the clone_children and release agent through
> remount need to be restricted to init_user_ns root.

No, they can only be changed on a new mount, so these are fine.
_______________________________________________
Containers mailing list
Containers@xxxxxxxxxxxxxxxxxxxxxxxxxx
https://lists.linuxfoundation.org/mailman/listinfo/containers



[Index of Archives]     [Cgroups]     [Netdev]     [Linux Wireless]     [Kernel Newbies]     [Security]     [Linux for Hams]     [Netfilter]     [Bugtraq]     [Yosemite Forum]     [MIPS Linux]     [ARM Linux]     [Linux RAID]     [Linux Admin]     [Samba]

  Powered by Linux