lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Wed, 18 Nov 2015 09:05:12 -0600 From: Seth Forshee <seth.forshee@...onical.com> To: Al Viro <viro@...IV.linux.org.uk> Cc: Austin S Hemmelgarn <ahferroin7@...il.com>, "Eric W. Biederman" <ebiederm@...ssion.com>, linux-bcache@...r.kernel.org, dm-devel@...hat.com, linux-raid@...r.kernel.org, linux-mtd@...ts.infradead.org, linux-fsdevel@...r.kernel.org, linux-security-module@...r.kernel.org, selinux@...ho.nsa.gov, Serge Hallyn <serge.hallyn@...onical.com>, Andy Lutomirski <luto@...capital.net>, linux-kernel@...r.kernel.org, Theodore Ts'o <tytso@....edu> Subject: Re: [PATCH v3 0/7] User namespace mount updates On Wed, Nov 18, 2015 at 02:58:18PM +0000, Al Viro wrote: > On Wed, Nov 18, 2015 at 08:22:38AM -0600, Seth Forshee wrote: > > > But it still requires the admin set it up that way, no? And aren't > > privileges required to set up those devices in the first place? > > > > I'm not saying that it wouldn't be a good idea to lock down the backing > > stores for those types of devices too, just that it isn't something that > > a regular user could exploit without an admin doing something to > > facilitate it. > > Sigh... If it boils down to "all admins within all containers must be > trusted not to try and break out" (along with "roothole in any container > escalates to kernel-mode code execution on host"), then what the fuck > is the *point* of bothering with containers, userns, etc. in the first > place? If your model is basically "you want isolation, just use kvm", > fine, but where's the place for userns in all that? > > And if you are talking about the _host_ admin, then WTF not have him just > mount what's needed as part of setup and to hell with mounting those > inside the container? Yes, the host admin. I'm not talking about trusting the admin inside the container at all. >From my perspective the idea is essentially to allow mounting with fuse or with ext4 using "mount -o loop ..." within a container. -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists