linux-kernel - Re: [PATCH 0/7] Initial support for user namespace owned mounts

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <87twslliyz.fsf@x220.int.ebiederm.org>
Date:	Thu, 30 Jul 2015 11:15:48 -0500
From:	ebiederm@...ssion.com (Eric W. Biederman)
To:	Colin Walters <walters@...bum.org>
Cc:	Casey Schaufler <casey@...aufler-ca.com>,
	Amir Goldstein <amir@...lrox.com>,
	Seth Forshee <seth.forshee@...onical.com>,
	"Theodore Ts'o" <tytso@....edu>,
	Stephen Smalley <sds@...ho.nsa.gov>,
	Andy Lutomirski <luto@...capital.net>,
	Alexander Viro <viro@...iv.linux.org.uk>,
	Linux FS Devel <linux-fsdevel@...r.kernel.org>,
	LSM List <linux-security-module@...r.kernel.org>,
	"SELinux-NSA" <selinux@...ho.nsa.gov>,
	Serge Hallyn <serge.hallyn@...onical.com>,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH 0/7] Initial support for user namespace owned mounts

Colin Walters <walters@...bum.org> writes:

> It's worth noting here that I think a lot of the use cases
> for unprivileged mounts are testing/development type things,
> and these are pretty well covered by:
>
> http://libguestfs.org/
>
> Basically it just runs the host kernel in a VM, and the userspace
> is a minimal agent that you can talk to over virtio.  You can use
> the API, or `guestmount` exposes it via FUSE.
>
> It doesn't magically make the kernel filesystems robust against
> untrusted input, but in the case of compromise, it's an
> "unprivileged" VM.  I've used it for several projects and been
> quite happy.

Thanks for pointing this out.  That makes it clear we only have to get
as far as making fuse work for this work to be useful in practice.

Eric

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/