U.Mutlu wrote on 11/16/2015 04:43 PM:
Mike Frysinger wrote on 11/16/2015 05:19 AM:
On 16 Nov 2015 03:26, U.Mutlu wrote:
The other solution via user namespace is IMHO overkill and in my case
impractical and irritating because user gets a root-prompt (#)
eventhough it is only inside the user namespace.
so remap it to your own user instead of to root
Sorry, I forgot the dangers of mounting into existing mount namespace.
Yes, user namespace seems to be the way to go, so I tried the sample from
man user_namespaces:
$ ./userns_child_exec -v -p -m -U -z bash
./userns_child_exec: PID of child created by clone() is 2950
ERROR: write /proc/2950/gid_map: Operation not permitted
About to exec bash
Am I on the right track with the above method for user remapping?
It's maybe that under Debian another sysctl-setting is needed
for this to work, I'll need to do some research on the net.
If someone here knows the solution let me know pls.
I did some research on the net, and the findings are:
- user namespaces have their own security holes
- a workaround exists, but then a new problem happens: loop devices cannot
be accessed
Here's the output of a modified (fixed) version of the above pgm,
but mount still not working, even with root-prompt inside the namespace:
$ ./userns_child_exec -v -m -U -z bash
uid=1003 gid=1006 pid=7728
./userns_child_exec: PID of child created by clone() is 7729
uid=1003 gid=1006 pid=7729
map_file=/proc/7729/setgroups map_val=deny
map_file=/proc/7729/uid_map map_val=0 1003 1
map_file=/proc/7729/gid_map map_val=0 1006 1
About to exec bash
# mount -o loop ../mount-test/theFile.img mnt
mount: /home/user/tmp/test/mount-test/theFile.img: failed to setup loop
device: Permission denied
# ls -l /dev/loop*
brw-rw---- 1 nobody nogroup 7, 0 Nov 16 20:01 /dev/loop0
brw-rw---- 1 nobody nogroup 7, 1 Nov 16 20:14 /dev/loop1
brw-rw---- 1 nobody nogroup 7, 2 Nov 16 15:29 /dev/loop2
brw-rw---- 1 nobody nogroup 7, 3 Nov 16 15:29 /dev/loop3
brw-rw---- 1 nobody nogroup 7, 4 Nov 16 15:29 /dev/loop4
brw-rw---- 1 nobody nogroup 7, 5 Nov 16 15:29 /dev/loop5
brw-rw---- 1 nobody nogroup 7, 6 Nov 16 15:29 /dev/loop6
brw-rw---- 1 nobody nogroup 7, 7 Nov 16 15:29 /dev/loop7
crw-rw---- 1 nobody nogroup 10, 237 Nov 16 15:29 /dev/loop-control
Does the user need to create his own loop device(s)?
Hmm. it looks like there is (currently?) a big mess with user namespaces:
https://code.google.com/p/chromium/issues/detail?id=457362
--
To unsubscribe from this list: send the line "unsubscribe util-linux" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
