[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20080903220215.GA27705@us.ibm.com>
Date: Wed, 3 Sep 2008 17:02:15 -0500
From: "Serge E. Hallyn" <serue@...ibm.com>
To: Miklos Szeredi <miklos@...redi.hu>
Cc: ebiederm@...ssion.com, akpm@...ux-foundation.org,
hch@...radead.org, viro@...IV.linux.org.uk,
linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: unprivileged mounts git tree
Quoting Miklos Szeredi (miklos@...redi.hu):
> On Wed, 27 Aug 2008, Serge E. Hallyn wrote:
> > Ok, thanks. I look forward to playing around with it when you publish
> > the resulting git tree :)
>
> A couple of centuries later...
>
> ...here's the updated git tree:
>
> git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs.git unprivileged-mounts
>
> Changes since the previous version:
>
> - update to apply against latest git
> - downgrade shared mounts to slave for unprivileged binds (if owners differ)
> - don't allow unprivileged recursive binds
>
> Serge, thanks again for testing and reviewing these patches!
Ooh.
You predicate the turning of shared mount to a slave mount on
!capable(CAP_SYS_ADMIN). But in fact it's the mount by a privileged
user, turning the mount into a user mount, which you want to convert.
So my series of steps was:
as root:
(1) mount --bind /mnt /mnt
(2) mount --make-rshared /mnt
(3) /usr/src/mmount-0.3/mmount --bind -o user=hallyn /mnt \
/home/hallyn/etc/mnt
as hallyn:
(4) mount --bind /usr /home/hallyn/etc/mnt/usr
You are turning mounts from shared->slave at step 4, but in fact we need
to do it at step 3, where we do have CAP_SYS_ADMIN.
-serge
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists