Hi Miklos, Here's version 4 of my patches to allow fuse mounts from within user namespaces. I'm not sure whether or not Eric and I managed to satisfy your doubts about using fixed namespaces for conversions, but since the discussion has died down and I've accumulated a few changes I thought it was time to send new patches. I also never got any feedback from you about my proposal for restricting xattrs, so I went ahead and included the patch (with some updates) here. Changes since v3: - Broke out some changes into separate patches. - Added missing pid namespace conversion for file locks. - Fixed pid/user ns reference leaks when using cuse. - Fail operations and invalidate inodes if uids passed over the fuse connection don't map into the superblock's user namespace. Also dropped vfs patches which are no longer needed after this change. - Restrict getting and setting of xattrs to user.* unless the privileged_xattrs mount option is passed. This option is only permitted for system root. Thanks, Seth Seth Forshee (5): fuse: Add support for pid namespaces fuse: Support fuse filesystems outside of init_user_ns fuse: Restrict allow_other to uids already controlled by the user fuse: Support privileged xattrs only with a mount option fuse: Allow user namespace mounts fs/fuse/dev.c | 13 +++--- fs/fuse/dir.c | 106 ++++++++++++++++++++++++++++++++++--------------- fs/fuse/file.c | 38 ++++++++++++------ fs/fuse/fuse_i.h | 21 ++++++++-- fs/fuse/inode.c | 118 +++++++++++++++++++++++++++++++++++++++++-------------- 5 files changed, 213 insertions(+), 83 deletions(-) -- To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
