It's worth noting here that I think a lot of the use cases for unprivileged mounts are testing/development type things, and these are pretty well covered by: http://libguestfs.org/ Basically it just runs the host kernel in a VM, and the userspace is a minimal agent that you can talk to over virtio. You can use the API, or `guestmount` exposes it via FUSE. It doesn't magically make the kernel filesystems robust against untrusted input, but in the case of compromise, it's an "unprivileged" VM. I've used it for several projects and been quite happy. _______________________________________________ Selinux mailing list Selinux@xxxxxxxxxxxxx To unsubscribe, send email to Selinux-leave@xxxxxxxxxxxxx. To get help, send an email containing "help" to Selinux-request@xxxxxxxxxxxxx.
