On Sun, Jan 01, 2017 at 02:32:20PM -0600, Linas Vepstas wrote: [..] > It's somehow ironic that the push for user-space mounts and containers > comes from this general fuzzy sensation that they are somehow "safer", > yet the changes to enable this provide a new attack surface for > privilege escalation. Funny world we live in. :-) Happy New Year! Only if unprivileged users want to be able to mount overlayfs. Otherwise, a privileged user can just mount overlayfs on host and bind mount that inside container (this is what docker does). And then you don't have to worry about allowing unprivileged users to be able to allow mounting. Vivek -- To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
