On Thu, Oct 21, 2021 at 02:22:13PM +0000, Trond Myklebust wrote: > Yes, that's mostly fixed. As far as I'm concerned, there should be no > major obstacles to allowing unprivileged mounts in their own private > net namespace. Do you think it'd be a reasonable thing to turn on now by default in distros or something the admin should have to opt-in to only on trusted networks? I'm wondering how much confidence we have in the client's robustness in the face of possibly compromised servers. > The one thing to note, though, is that AUTH_SYS still required that the > container be given a CAP_NET_BIND_SERVICE privilege to allow binding to > a privileged port. Got it, thanks. --b.
