This patch creates a list of allowed filesystems per-namespace.
The goal is to prevent users inside a container, even root,
to mount filesystems that are not allowed by the main box admin.
My main two motivators to pursue this are:
1) We want to prevent a certain tailored view of some virtual
filesystems, for example, by bind-mounting files with userspace
generated data into /proc. The ability of mounting /proc inside
the container works against this effort, while disallowing it
via capabilities would have the effect of disallowing other
mounts as well.
2) Some filesystems are known not to behave well under a container
environment. They require changes to work in a safe-way. We can
whitelist only the filesystems we want.
This works as a whitelist. Only filesystems in the list are allowed
to be mounted. Doing a blacklist would create problems when, say,
a module is loaded. The whitelist is only checked if it is enabled first.
So any setup that was already working, will keep working. And whoever
is not interested in limiting filesystem mount, does not need
to bother about it.
Please let me know what you guys think about it.
Glauber Costa (4):
move /proc/filesystems inside /proc/self
per-namespace allowed filesystems list
show only allowed filesystems in /proc/filesystems
fslist netlink interface
fs/Kconfig | 9 +++
fs/Makefile | 1 +
fs/filesystems.c | 108 ++++++++++++++++++++++++------
fs/fsnetlink.c | 145 ++++++++++++++++++++++++++++++++++++++++
fs/namespace.c | 5 +-
fs/proc/base.c | 64 +++++++++++++++---
fs/proc/root.c | 1 +
include/linux/fs.h | 11 +++
include/linux/fslist_netlink.h | 35 ++++++++++
include/linux/mnt_namespace.h | 20 ++++++
10 files changed, 368 insertions(+), 31 deletions(-)
create mode 100644 fs/fsnetlink.c
create mode 100644 include/linux/fslist_netlink.h
--
1.7.7.4
--
To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
