On Thu, Mar 23, 2017, at 07:25 PM, Jay Lan wrote: > > After discussing internally, we find that there are a large number of > our systems where root should not be able to unlink remotely mounted > files, but root does need to be able to scan directories and read files. Another way to do this with the built-in functionality would be to run these scripts in a new mount namespace, and remount the target filesystems read-only. One of the nice things about the Linux "container" functionality is that you can pick and choose; you don't have to go all of the way to "full containers", just use a mount namespace. `unshare -m` from util-linux for example.
