[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <E1Hgblk-00045y-00@dorka.pomaz.szeredi.hu>
Date: Wed, 25 Apr 2007 09:18:28 +0200
From: Miklos Szeredi <miklos@...redi.hu>
To: kzak@...hat.com
CC: miklos@...redi.hu, akpm@...ux-foundation.org, serue@...ibm.com,
viro@....linux.org.uk, linuxram@...ibm.com, ebiederm@...ssion.com,
linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org,
containers@...ts.osdl.org
Subject: Re: [patch 0/8] mount ownership and unprivileged mount syscall (v4)
> > The following extra security measures are taken for unprivileged
> > mounts:
> >
> > - usermounts are limited by a sysctl tunable
> > - force "nosuid,nodev" mount options on the created mount
>
> The original userspace "user=" solution also implies the "noexec"
> option by default (you can override the default by "exec" option).
Unlike "nosuid" and "nodev", I don't think "noexec" has real security
benefits.
> It means the kernel based solution is not fully compatible ;-(
Oh, I don't think that matters. For traditional /etc/fstab based user
mounts, mount(8) will have to remain suid-root, the kernel can't
replace the fstab check.
In fact the latest patches don't even support these "legacy" user
mounts too well: setting the owner of a mount gives not only umount
privilege, but the ability to submount. This is not necessarily a
good thing for these kinds of user mounts.
We could add a new "nosubmount" or similar flag, to prevent
submounting, but that again would go against the simplicity of the
current approach, so I'm not sure it's worth it.
Miklos
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists