linux-kernel - Re: unprivileged mounts git tree

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 11 Sep 2008 03:37:45 -0700
From:	ebiederm@...ssion.com (Eric W. Biederman)
To:	Miklos Szeredi <miklos@...redi.hu>
Cc:	serue@...ibm.com, akpm@...ux-foundation.org, hch@...radead.org,
	viro@...IV.linux.org.uk, linux-fsdevel@...r.kernel.org,
	linux-kernel@...r.kernel.org
Subject: Re: unprivileged mounts git tree

Miklos Szeredi <miklos@...redi.hu> writes:

> On Fri, 5 Sep 2008, Serge E. Hallyn wrote:
>> Ok I should take the time to properly add these to ltp, but for now here
>> is the result of 15-minutes of playing around with shell scripts to do
>> some basic testing.
>> 
>> Run usermounts_root.sh as root first, then usermounts_user as a user.
>> Cleanup for the usermounts_root.sh side-effects is not done.
>> 
>> Miklos, do you have better-thought-out or more complete testcases?
>
> Thanks for the scripts, I don't have any better ones, I have only been
> testing by hand.
>
> As for -mm, sure it would be nice.  I'll do a resubmission of the
> whole series with proper changelog, etc.  It would be really nice if
> Al and/or Christoph could review if there are any major conceptual
> problems left.

There is a weird corner case I'm trying to wrap my head around.
unlink and rmdir do not work on dentries that are mount points
in another mount namespace.

Which is at least needed for the moment so we don't leak mounts.

Once we have unprivileged mounts does that introduce a DOS attack?

Eric
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/