On Mon, Nov 16, 2015 at 07:40:26PM -0600, Serge E. Hallyn wrote: > On Mon, Nov 16, 2015 at 07:13:49PM -0600, Serge E. Hallyn wrote: > > On Mon, Nov 16, 2015 at 04:24:27PM -0600, Eric W. Biederman wrote: ... > > > Similary have you considered what it required to be able to safely set > > > FS_USERNS_MOUNT? > > > > I think the only thing we need to do is > > > > 1. go through and make sure that any ability to change mount flags is under > > capable() (which I have not yet done). The cgroup_mount() itself checks that > > flags are not changed, but there may be some subtle way to effect a change > > that I'm not aware of yet. > > > > At least the ability to change the clone_children and release agent through > remount need to be restricted to init_user_ns root. No, they can only be changed on a new mount, so these are fine. _______________________________________________ Containers mailing list Containers@xxxxxxxxxxxxxxxxxxxxxxxxxx https://lists.linuxfoundation.org/mailman/listinfo/containers
